Your Data Requests — Access and Deletion

1. First: who should you ask?

It depends on whose data it is and why we hold it.

• You are a NumberGroup customer (or you contacted us, bought a number, or used this website). We are the controller for your account, billing, support and website data. Ask us directly — see section 2.
• You called a business that uses NumberGroup and your call was recorded, transcribed or analysed. That business is the controller of the recording and anything produced from it; we process it for them. Please ask the business you called first. They will ask us to find, export or delete the data and we will help them do it within the deadline. If you don’t know who to ask, or the business has not responded, contact us: we will tell you which business holds the data (where we can do so lawfully) and pass your request to them.
• Data we hold for our own purposes about callers, such as fraud-prevention and network-security records. We are the controller for this, so ask us directly.

2. How to make a request to us

Email help@numbergroup.com with the subject line “Data request”, or call 0800 310 1010 and we will log it for you. You don’t need to use any special words or form. Please tell us:

• what you want: a copy of your data, deletion, or another right (correction, restriction, objection or portability);
• your name, and the phone number(s) and/or email address(es) the data is linked to;
• for calls: roughly when you called and which business or number you called, if you know — this helps us find the right records quickly.

Someone can make a request on your behalf (for example a solicitor or a family member) if they give us your written authority.

3. How we check who you are

We only release or delete data once we are reasonably sure the request comes from the person the data is about. We ask for no more than we need. Usually that means:

• Account holders: a request from the email address on your account, or a confirmation code sent to it.
• Callers: a short call back to the phone number the calls came from, or a call from you to us from that number, so we can confirm you control it. Because a number can be shared or reassigned, we may also ask for the approximate dates of your calls.

The one-month deadline starts once we have the information we need to confirm your identity. We will tell you promptly if we need anything more.

4. How long it takes

We respond within one calendar month of receiving your request (or of confirming your identity, if later). If a request is complex or you have made several, we can extend this by up to two further months; if so, we will tell you within the first month and explain why. Requests are free. We may charge a reasonable fee or refuse only if a request is manifestly unfounded or excessive, and we will explain why.

Where a customer (the business you called) asks us to help with a caller’s request, we aim to give them what they need within [10] working days, so that they can meet their own one-month deadline.

5. “Send me my data”

We will send you a copy of the personal data we hold about you as controller, together with the information UK GDPR requires (why we hold it, who we share it with, how long we keep it, and your rights). Where a business asks us to help with a caller’s request, we provide them with an export that can include, for each matching call:

• the call details (date, time, duration, numbers);
• the audio recording, where we still hold it;
• the transcript; and
• the summary, call signals and other structured data extracted from the call.

We send exports through a secure, expiring link, in common formats (audio file, PDF or text, and a machine-readable file). We will remove or redact other people’s personal data where we must to protect their rights — for example, card details or another person’s private information mentioned on a call.

6. “Delete my data”

When an erasure request is valid, deletion covers every copy held by us or by our suppliers on our behalf of the data in scope:

• the audio recording (including the encrypted stored copy);
• the transcript;
• summaries, call signals, alerts and other data extracted from the call;
• your voice fingerprint, if one was created;
• copies held by our suppliers, such as internal alerts in Slack, support tickets in Freshdesk, and emails sent through our email provider. We delete these ourselves where the supplier’s tools allow, and otherwise ask the supplier to delete them. Some suppliers keep short-lived technical logs (for example email delivery logs) that expire on their own schedule; we list any such copy, and when it will expire, in the deletion confirmation;
• copies in our backups — these are not edited individually, but are overwritten on our normal backup cycle (no more than [35] days); we keep a record so that deleted data is not restored from a backup.

Deletion does not reach copies that a business has taken into its own systems — for example data it has downloaded, exported to its CRM, received by email, or pulled into its own systems or AI tools through our API or MCP access. Those copies are under the business’s control, not ours or our suppliers’. The business is responsible for deleting those copies, and we will remind them to.

De-identified, aggregated learnings (for example, general rules about how calls of a certain type tend to go) do not identify you and are not personal data, so they are not affected by erasure. See the Privacy Policy.

When we may not be able to delete. We may need to keep some data where the law requires it (for example billing and tax records), to establish or defend legal claims, or where data is subject to a legal hold. If so, we will tell you what we are keeping and why, and restrict its use to that purpose.

7. Confirmation of deletion

8. If you are not happy

Tell us first at help@numbergroup.com and we will try to put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Datazero Ltd, trading as NumberGroup. Registered in England and Wales, company number 07390438. Registered office: International House, 36-38 Cornhill, London EC3V 3NG. ICO registration ZA261621.