Compliance is the product

The framework we work inside

Which rules apply, and where

Four things govern what we do. The UK GDPR and the Data Protection Act 2018 cover how we handle personal data. The Privacy and Electronic Communications Regulations 2003 (PECR) cover the marketing channels themselves — and PECR is stricter than the GDPR on live calls, automated calls, email and SMS. Ofcom's rules on persistent misuse cover how a dialler may behave. And the CAP Code covers the claims made in the marketing that follows.

We are a data controller for the survey we run, and usually a processor for the campaign work we do on your behalf. Which hat we are wearing changes who is responsible for what, so it is set out explicitly in the contract rather than assumed.

Lawful basis and consent

Survey respondents are told at the start of the call who is calling and why. The marketing permission is taken at the end, once they know what they have shared, and the agent reads the statement in full. That statement names the channels — telephone, email, SMS, post — and describes the categories of company that may contact them. Consent is recorded against the record with the date, time, agent and campaign, and the audio is retained.

Consent obtained this way is specific and evidenced, which is what the ICO looks for. A tick box on a competition entry from four years ago is not, which is why we do not buy that kind of data in.

Screening before dialling

Consumer numbers are screened against the Telephone Preference Service and business numbers against the CTPS before they reach the dialler, and re-screened on a rolling cycle for long-running campaigns. Postal selections are screened against the Mailing Preference Service. Client suppression files are applied on top. Screening dates are recorded per record and appear in the monthly compliance log.

Dialler conduct

We hold the abandoned-call rate below the 3% threshold in Ofcom's persistent misuse guidance, measured per campaign per day. Calls are left to ring for at least 15 seconds before clearing. Calling line identification is presented on every outbound marketing call, and the number presented is answered by a person during office hours — not a recorded message.

Vulnerable people

Agents are briefed to end the call politely and suppress the record at any sign that the person does not understand the conversation, is distressed, or is being pressed into it by someone else. This applies particularly to the over-50s propositions such as funeral plans. A suppressed record is not sold, not re-dialled, and not passed to a client.

Individual rights

Requests to access, correct, erase or object to processing are handled within one calendar month. An objection to marketing is actioned immediately on the call and propagated across every campaign within 24 hours. Where a request concerns data we processed for a client, we pass it on and support their response.

Security and location

Personal data is held on systems inside the United Kingdom. Access is role-based and logged, transfers to clients are encrypted with credentials sent by a separate channel, and staff are trained on data protection at induction and annually after that. Personal data breaches are assessed immediately and, where the threshold is met, reported to the ICO within 72 hours and to affected clients without undue delay.

Where regulated products are involved

We are not authorised by the Financial Conduct Authority and we do not advise on financial products. Insurance and funeral plan leads are supplied only to FCA-authorised firms or their appointed representatives, and we verify the firm on the FCA register before the first delivery. Our scripts introduce the client's proposition without recommending it.