{"id":6436,"date":"2026-10-12T13:04:25","date_gmt":"2026-10-12T11:04:25","guid":{"rendered":"https:\/\/eu.klytic.com\/business-telephony-data\/"},"modified":"2026-10-12T13:34:50","modified_gmt":"2026-10-12T11:34:50","slug":"business-telephony-data","status":"publish","type":"page","link":"https:\/\/eu.klytic.com\/en\/business-telephony-data\/","title":{"rendered":"What a phone platform knows about your company"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Home<\/a>\u203a<\/span>Guides<\/a>\u203a<\/span>Telephony<\/a><\/p>

Telephony \u00b7 Understand<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

What a phone platform knows about your company<\/h1>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Yes, a business conversation is company data. Its content is if it is recorded; its metadata (who calls whom, when, for how long) always is. To know who holds it, you need to list these traces and name four parties: the user, the administrator, the platform operator and the carrier.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Updated October 2026<\/b><\/span>7 min<\/b><\/span>Official sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

A conversation is company data<\/h2>

People think of the recording first. It is the most visible trace, but it only exists if someone decided it should. A call that is not recorded still leaves a line in a call history: the caller\u2019s number, the number called, the extension that answered, the time, the duration, sometimes the reason the call ended or the transfer.<\/p>

Call metadata<\/strong>: the information that describes a call without containing what was said. Numbers, extension, date, time, duration, queue, transfers. Linked to an employee or a customer, it is personal data.<\/p><\/div>

This metadata often says more than you might think. The list of numbers called by a salesperson maps out their portfolio. An executive\u2019s calls to a lawyer or a potential buyer reveal an ongoing deal. A call history is therefore an asset to protect, just like a customer file.<\/p>

The GDPR applies as soon as this data makes it possible to identify a person. It requires a specified purpose and a retention period that does not exceed what is necessary for that purpose. It does not set a period itself: it is up to the company to choose and justify one.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Inventory: what the platform keeps<\/h2>

A business phone system produces at least seven families of data. Not all of them exist everywhere, but it is better to have listed them before signing.<\/p>

Trace<\/th>What it contains<\/th>Exists if<\/th><\/tr><\/thead>
Directory<\/td>Names, extensions, direct numbers, groups, sometimes external contacts<\/td>Always<\/td><\/tr>
Call history<\/td>Metadata for each incoming, outgoing and internal call<\/td>Always<\/td><\/tr>
Recordings<\/td>The content of conversations<\/td>Recording is enabled on the line or queue<\/td><\/tr>
Transcripts and summaries<\/td>Text derived from a conversation<\/td>The feature is subscribed to and used<\/td><\/tr>
Voicemail<\/td>The caller\u2019s voice, often copied by email<\/td>Voicemail is active<\/td><\/tr>
Technical logs<\/td>Phone connections, IP addresses, errors, administrative actions<\/td>Always<\/td><\/tr>
Backups and tickets<\/td>Copies of the configuration and data; exchanges with support<\/td>Always, depending on the contract<\/td><\/tr><\/tbody><\/table><\/div>

The last two rows are the ones most often forgotten. The guide What is a sovereign cloud?<\/a> points this out: backups and logs are copies. They may be hosted somewhere other than the main service and last longer than the original data.<\/p>

Voicemail deserves particular attention. When it is sent by email, a copy leaves the phone platform and lands in the email system. It then follows the mailbox\u2019s rules: delegations, shared mailboxes, email backup.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Who can know the numbers called<\/h2>

\u201cThe cloud\u201d is not a party. Four distinct roles can see all or part of the call history.<\/p>

  1. The user<\/strong> generally sees their own calls, in their app or on their phone.<\/li>
  2. The company administrator<\/strong> sees the history of all the extensions they manage, often with statistics. They decide on everyone else\u2019s permissions.<\/li>
  3. The platform operator<\/strong> hosts the server, updates it and restores it. Technically, it can access the data. The useful question is when it accesses it, whether it does so in a logged way, and which law applies to it.<\/li>
  4. The carrier<\/strong> that connects the phone system to the public telephone network routes outgoing and incoming calls. It therefore knows the numbers, times and durations, if only for billing.<\/li><\/ol>

    The operator and the carrier may be the same company or two different companies. When you keep your carrier and entrust the phone system to another provider, your metadata is held by both. An external party also has their own carrier: a call to the outside leaves traces beyond your perimeter, whatever you choose.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t

    Who owns the call history<\/h2>

    The word \u201cown\u201d is misleading. From a data protection standpoint, the company that decides to use the phone system and keep its history is the controller of that processing. The platform operator generally acts on its behalf, as a processor, within the limits of a data processing agreement.<\/p>

    In practice, the operator holds the data for as long as the service runs, then for as long as its backups last. Three questions to ask:<\/p>