Recording sales calls in the EU: a practical checklist

This is not legal advice and does not pretend to be. It does organise the questions worth answering before your team starts recording customer conversations.

A recording is personal data

The starting point is straightforward: a recording of a customer call contains personal data. Voice is personal data, and so is most of the content — names, job titles, company details, sometimes information about financial circumstances.

That means the GDPR applies in full: a lawful basis for processing, transparency obligations, a defined retention period, and a workable process for handling data subject rights.

Lawful basis and transparency

In B2B sales the most commonly used basis is legitimate interest — documenting commercial agreements. That requires a balancing test that is actually performed and documented, not merely a reference to the article.

Whatever the basis, transparency applies. The other party should know the call is recorded, who the controller is, for what purpose, and for how long the recording is kept. In practice that means stating it at the start of the call and recording the fact that you did.

Four questions for any vendor

When evaluating a call recording and analysis tool, ask four questions and get the answers in writing.

• Where is the data physically processed? A data centre in the EU is not the same as a company registered in the EU. Ask about processing location, not the address on the incorporation documents.
• Do transcripts reach AI models outside the EU? This is the most common gap. A tool can host data in Europe and still send transcripts to a model in the United States, which requires a transfer mechanism.
• How long is audio retained? The cleanest position is that audio is not retained at all — processed in memory, with only the structured result persisted.
• Is customer data used to train models? The answer must be unambiguous and written into the data processing agreement, not into a privacy policy that can be changed unilaterally.

Our answers, for the record

For completeness, here is how Luminote answers those four questions. Hosting in Frankfurt or Warsaw, your choice. Transcription runs on Voxtral, analysis on Mistral AI, headquartered in Paris — no OpenAI and no data leaving the European Union.

Audio is processed in memory and not retained; what persists is the structured result: summary, tasks, signals and the CRM entry. For teams that want to revisit recordings for coaching there is a separate mode with AES-256 encryption — but that is a deliberate choice rather than the default.

The bot that joins online meetings appears in the participant list. There is no hidden mode, because recording that the other side is unaware of transfers legal risk onto our customer.