What a UK venue should ask an AI phone vendor about data protection

An AI phone host answers your calls and, in doing so, handles guest details — a name, a phone number, sometimes a dietary note. That is personal data, so UK GDPR applies, and the venue is responsible for how it is used. None of that is a reason to avoid an AI host; it is a reason to ask a vendor the right questions before you sign. Here are the ones that matter, and what a good answer sounds like.

This is a practical checklist, not legal advice. If you have a Data Protection Officer or adviser, run it past them.

1. What is the lawful basis for handling a caller’s data?

Every use of personal data needs a lawful basis under UK GDPR. For taking and confirming a booking, the natural fit is legitimate interests — using someone’s details in the way they would reasonably expect, with minimal privacy impact, to do the thing they called to do. The ICO sets out a three-part test for relying on it: identify the interest, show the use is necessary, and balance it against the individual’s rights (ICO guidance). Ask the vendor which basis they rely on and why. A vague answer is a red flag.

2. What exactly is collected, and is it only what the booking needs?

Data minimisation is a core principle: collect what the task requires, no more. Ask what fields the system captures on a call and whether anything is gathered beyond what a booking or enquiry actually needs. You want a short, obvious list.

3. Where is the data stored, and who processes it?

Ask plainly where enquiry and booking records are held and which providers are involved. You are the data controller; the vendor and its infrastructure providers are your processors, and you should know who they are. Ask for this in writing.

4. Is there a data processing agreement?

Where a vendor handles personal data on your behalf, UK GDPR expects a written data processing agreement setting out what they can do with it. Ask to see theirs before you commit.

5. How long is data kept, and can a guest’s data be deleted on request?

Personal data should not be kept longer than needed, and individuals have rights — including, in many cases, to have their data erased. Ask about retention periods and how you would action a guest’s request to see or delete their information.

6. Is the caller told they are speaking to an AI?

This is about trust as much as law. A good AI host says clearly, at the start of a call, that it is an AI, and lets the caller reach a person. Ask how transparency is handled — you do not want guests feeling misled on your line.

7. Is call data reused to train other products?

Ask whether recordings or transcripts are reused to train models beyond your own service, and get the answer in writing. You want guest conversations used to run and improve your service, not fed into an unrelated product.

What good looks like

A vendor worth signing with will answer all seven quickly and in plain language, put the important parts in writing, and be comfortable with your adviser reading the agreement. Watch for the opposite: claims that sound impressive but dodge specifics, or a reluctance to commit anything to paper.

For the record, Bella — the voice on a Vox call — says she is an AI at the start of every call, and callers can ask for a person at any point. Vox is built to take only what a booking needs and to keep records reviewable by the venue. It runs live for restaurants in Australia today and is opening UK pilots now, and we are happy to walk your adviser through the detail before anything is signed.

Want the specifics for your venue? Book a pilot and we will go through each question with you.