AI call recordings: GDPR + retention in 4 decisions
Recording confirmation calls is operational standard, but every e-commerce store needs 4 legal decisions: recording basis (Art. 6 GDPR), greeting disclosure, retention period, deletion policy. We show how to make each and capture in panel.
AI call recording in e-commerce has four legal decisions. Basis: Art. 6(1)(b) GDPR (contract performance) — simple, no consent needed. Disclosure: must be in greeting ('this call is recorded for...'). Retention: 90/180/365 days choice, 180 recommended for ops. Deletion: on customer request + automatic after retention.
- Legal basis: Art. 6(1)(b) GDPR (contract performance) — default in our product.
- Recording disclosure = obligation in first 8 seconds of call.
- Recommended retention: 180 days (balance: ops + minimization).
- Right to erasure handled in panel in 1 click — auto after retention.
Art. 6(1)(b) GDPR: contract performance — default basis
Art. 6 GDPR gives 6 bases for legal processing: consent (a), contract (b), legal obligation (c), life and health (d), public interest (e), legitimate interest (f). For recording e-commerce confirmation calls simplest and most appropriate is (b) — contract performance.
Why (b), not (a) consent: consent requires proactive 'yes' before recording (impossible mid-call without hellish friction) AND gives customer right to withdraw anytime (you'd have to delete recording even mid-dispute). Basis (b) — contract performance — allows recording without proactive consent, if recording is necessary for order fulfillment.
Is order confirmation 'necessary'? Yes, if recording serves to: (1) document customer consent to fulfillment, (2) verify shipping data, (3) resolve potential disputes. Standard ops use cases. Reviewed with DPO law firm, consistent with UODO interpretation.
Information obligation in first 8 seconds
Art. 13 GDPR requires informing customer about processing before it begins. For phone calls: first thing customer hears must include recording info + purpose.
Pattern that meets requirement in one sentence (DPO-tested): 'Hello, I'm calling from [store] to confirm your order. This call is recorded to confirm the order and handle potential complaints. May I continue?' Time: ~8 seconds.
Customer has right to refuse. If they refuse, AI cannot continue recording — must hang up and route to follow-up via different channel (e-mail with online confirmation link). Frequency <1% of calls, but must be handled.
Retention 90 / 180 / 365 days — choice per use case
GDPR requires minimization: don't store longer than necessary for the purpose. For e-commerce confirmation calls three periods are realistic:
90 days — operational minimum. Covers standard e-commerce complaint window (14-day return + buffer) and typical card chargeback window (60-90 days). Best for stores with simple orders and low cart values.
180 days — recommended. Covers all standard ops disputes + warranty period (if applicable). Optimal for most stores. Default in CallBotAgent panel.
365 days — for audit/legal. Required if store falls under specific industry regs (e.g. URPL for supplements + longer complaint periods), or if store has specific dispute handling policies.
Right to erasure: 1 click in panel + auto after retention
Art. 17 GDPR gives customer right to request data deletion. For call recordings we handle this as 1-click delete per recording in panel (with audit log: who, when, why deleted). Deletion confirmation goes to customer via email within 30 days (statutory GDPR period).
Automatic deletion after retention is frozen — can't disable in panel. After 90/180/365 days (per setting), recording is physically deleted from our storage + backups (30-day cycle). Deletion log goes to compliance audit log.
Exception: if store has retention request linked to active dispute (chargeback, complaint, court case), recording can be marked 'litigation hold' in panel — won't be auto-deleted until dispute resolves.
Four things to remember
Legal basis: (b) contract performance. Not consent. Default in panel. Reviewed with DPO law firm.
Disclosure in first 8 seconds. Art. 13 GDPR. Pattern: store name + recording purpose + refusal option.
Recommended retention: 180 days. Covers standard disputes + warranty. Default in panel.
Deletion: 1 click + auto after retention. Art. 17 GDPR right handled in product. Litigation hold for active disputes.
GDPR-friendly setup?Check the panel in your 7-day trial.
1,000 trial credits (~20 confirmation calls) · full access to your chosen plan · cancel anytime. Card required · no charge during trial · auto-activates on day 8.