1. About this policy
Velto Ltd (“Velto”, “we”, “us”) is committed to protecting your personal data and respecting your privacy. This policy explains how we collect, use, store and protect personal data in connection with our services, including the Airo AI voice agent platform.
Velto Ltd is registered in England and Wales, Company No. 15233558, with a registered address at 1a Marsland Chambers, Marsland Road, Sale M33 3HP.
This policy applies to all individuals whose personal data we process, including visitors to our website, clients, business contacts, and individuals whose contact information is provided to us by our clients for the purposes of operating the Airo platform.
2. Data we collect
2.1 Data you provide directly
- Name, email address, phone number and company details when you contact us or engage our services
- Payment information when you purchase our services
- Communications you send to us by email or through our website
When you complete a form on this website, we keep a record of it rather than only sending it to our inbox. That record holds your name, email address, telephone number, company and the message you wrote, together with which form you used, the page you were on and the date and time. We use it to reply to you and to understand which parts of the site bring people to us.
We ask for a work email address on these forms and do not accept personal mailbox providers, because we sell to organisations rather than to individuals.
We do not store your IP address from these forms.
Enquiry records are held for 24 months from the day they are received and then deleted. If you would like yours removed sooner, write to us and we will do it.
2.2 Data provided by our clients
Where Velto operates the Airo voice agent on behalf of a client, the client provides us with contact data relating to individuals in their database. This may include:
- Name, telephone number and email address
- Any additional profile information provided by the client such as property interest, previous contact history or engagement status
In this context, Velto acts as a data processor on behalf of the client, who is the data controller. We process this data solely for the purposes instructed by the client and in accordance with our Data Processing Agreement.
2.3 Data collected during Airo calls and messages
Airo is an AI voice assistant. It makes and answers calls on behalf of our clients. It identifies itself as AI when disclosure is required and always answers honestly if asked.
If you decline recording, no audio recording or transcript is retained. We may still retain the information needed to assist with your enquiry, such as a suitable time for the client’s team to call you back. Your recording preference is noted on the client dashboard.
During Airo calls, the following data may be collected:
- Call recordings, where the individual has provided explicit consent at the start of the call
- Call transcripts, where consent has been provided
- Lead qualification information gathered during the conversation
- Callback preferences and requested contact times
Where a client uses Airo for website chat or WhatsApp, the assistant also uses AI. It identifies itself as AI when disclosure is required and always answers honestly if asked. Messages and information shared through these channels are processed to respond to the enquiry on the client’s behalf.
2.4 Website and usage data
- IP address and browser information when you visit our website
- Pages visited and interactions with our website via cookies and similar technologies
3. How we use your data
3.1 To deliver our services
- Operating and configuring the Airo platform on behalf of clients
- Conducting outbound calls within the permitted calling hours for the person’s country and, where relevant, state or region, taking account of their contact preferences, and handling inbound calls
- Generating call transcripts, qualification data and reports for client dashboards
- Sending automated follow-up emails on behalf of clients from agreed email addresses
- Processing payments and managing client accounts
3.2 To improve our services
- Using anonymised and aggregated performance data (call volumes, connection rates, qualification rates) for product development and benchmarking
- No personally identifiable information is used for this purpose without prior written consent
3.3 Legal and compliance
- Complying with applicable laws including UK GDPR and the Data Protection Act 2018
- Responding to lawful requests from regulatory authorities
- Protecting our legal rights and interests
3.4 AI-assisted enquiry handling
Airo organises and qualifies enquiries using criteria agreed with the client, so the client’s team can focus its follow-up. Its outputs support the team’s decisions and are not a substitute for human review. Decisions with legal or similarly significant effects on an individual require meaningful human review rather than reliance on Airo alone.
4. Legal basis for processing
We process personal data on the following legal bases:
- Contract performance: where processing is necessary to deliver services you or your organisation have engaged us for
- Legitimate interests: where we have a legitimate business interest that does not override your rights, such as improving our platform using anonymised data
- Consent: where you have given explicit consent, such as agreeing to call recording during an Airo call
- Legal obligation: where we are required to process data to comply with applicable law
5. Data storage and security
We use service providers to store and process personal data for the purposes described in this policy. Information about international processing is set out in section 6.
We implement the following security measures:
- Encryption of data in transit and at rest
- Role-based access controls limiting data access to authorised personnel only
- Multi-factor authentication on all business-critical systems
- Regular security reviews and access audits
- Incident response procedures with client notification within 24 hours of discovery of any breach affecting their data
Call recordings and transcripts are retained for a maximum of 90 days from the date of the call, after which they are permanently deleted unless a longer retention period is required by law or agreed with the client. Contact data provided by clients is retained for the duration of the service agreement. At the end of the agreement, we return client personal data if requested and delete remaining copies within 30 days, unless applicable law requires continued storage.
6. Data sharing
We do not sell your personal data. We may share data in the following limited circumstances:
- With sub-processors who assist in delivering our services, including cloud infrastructure providers, communication platforms and AI model providers. All sub-processors are bound by data processing agreements and hold appropriate security certifications.
- With clients, in the form of qualified lead data, call summaries and dashboard reporting generated by the Airo platform.
- With regulatory authorities where required by law.
- With professional advisors such as legal counsel where necessary.
Some of our service providers are located outside the United Kingdom and the European Economic Area, including in the United States. You can request the current list of service providers and information about international processing by contacting info@velto.co.uk.
7. Velto as data processor
Where Velto operates the Airo platform on behalf of a business client, we act as a data processor under UK GDPR Article 28. In this capacity:
- We process personal data only on the documented instructions of the client
- We do not use the data for any purpose other than delivering the contracted services
- We assist clients in fulfilling their obligations regarding data subject rights
- We notify clients within 24 hours of becoming aware of a personal data breach
- At the end of the service relationship, we return client personal data if requested and delete remaining copies within 30 days, unless applicable law requires continued storage
A formal Data Processing Agreement is available upon request and is executed with all enterprise clients prior to the commencement of services.
8. Your rights
Under UK GDPR, you have the following rights regarding your personal data:
- Right of access: you can request a copy of the personal data we hold about you
- Right to rectification: you can request correction of inaccurate or incomplete data
- Right to erasure: you can request deletion of your data where there is no longer a lawful basis for processing
- Right to restrict processing: you can request that we limit how we use your data
- Right to object: you can object to processing based on legitimate interests
- Right to data portability: you can request your data in a structured, machine-readable format
- Right to withdraw consent: where processing is based on consent, you can withdraw it at any time
To exercise your rights, please contact us at info@velto.co.uk. We respond within the timeframe required by the law governing your request. For UK and EU GDPR requests, this is normally one calendar month, subject to any lawful extension.
European Union: Where the EU GDPR applies, you can exercise the applicable data-protection rights and complain to a relevant local data-protection authority.
Australia: Where the Privacy Act 1988 applies, you can request access to and correction of your personal information and raise a privacy complaint with us. You may also complain to the Office of the Australian Information Commissioner.
New Zealand: Where the Privacy Act 2020 applies, you can request access to and correction of your personal information and raise a privacy complaint with us. You may also complain to the Office of the Privacy Commissioner.
If you are an individual whose data has been processed by Airo on behalf of one of our clients, your primary point of contact for data rights requests is the client organisation, who is the data controller for that data. We will cooperate fully with any such requests directed to us.
9. Cookies
Our website uses cookies to improve your experience. We use the following types:
- Functional cookies: to recognise you on return visits and remember your preferences
- Analytics cookies: to understand how visitors use our website so we can improve it
You can configure your browser to refuse cookies. Some features of our website may not function correctly if cookies are disabled. For more information, visit allaboutcookies.org.
10. Marketing
We may contact you with information about our services where you have given consent or where we have a legitimate interest in doing so. You can opt out of marketing communications at any time by emailing info@velto.co.uk or clicking the unsubscribe link in any marketing email.
To stop marketing calls made through Airo, say “stop calling” during a call or contact the business identified at the start of the call. Your request will be recorded and respected. You can also contact us at info@velto.co.uk so we can help direct your request.
We may retain the minimum information needed on a do-not-contact list to prevent further marketing calls. This information is used to respect your request, not to market to you.
11. Changes to this policy
We review this policy regularly and will publish updates on our website. The date at the top of this document reflects the most recent update. We will notify you of material changes where we have your contact details.
12. Contact us
For any questions about this policy or to exercise your data rights:
- Email: info@velto.co.uk
- Post: Velto Ltd, 1a Marsland Chambers, Marsland Road, Sale M33 3HP
To report a complaint or if you feel your concern has not been addressed satisfactorily, you may contact the Information Commissioner’s Office:
Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 Website: ico.org.uk