Privacy policy
Last updated 6 November 2026
Who we are
Callpathway is a call tracking service run by Vendo Digital Limited, a company registered in England and Wales (company number 11933532), registered office 5 Sandiford Road, Sutton, England, SM3 9RN. In this policy "we", "us" and "Callpathway" mean Vendo Digital Limited.
For anything about this policy or your personal data, email [email protected].
Two different roles
We handle personal data in two ways, and the rules are different for each.
- Our own records. When you visit this website, ask for a demo, or use a Callpathway account, we decide how that data is used. We are the controller, and this policy explains what we do.
- Calls to our customers. When someone phones a practice that uses Callpathway, we process details of that call on the practice's behalf. The practice is the controller and we are its processor: we only use the data to provide the service the practice has asked for. If you called a practice and have a question about your data, contact the practice first. We will help them answer it.
This website
Demo requests
If you fill in the demo form we collect your name, work email, practice or group name and number of locations. We use them to reply to you and arrange a demo. Our lawful basis is legitimate interests: answering a business enquiry you sent us.
If the enquiry doesn't lead to you becoming a customer, we delete it within 12 months.
Server logs
Like any website, our server records technical details of each request: IP address, browser type, the page requested and the time. We use these to keep the site secure and working (legitimate interests) and delete them after 90 days. To stop abuse of the demo form we also count requests per IP address for one hour; that count is held in memory only.
No cookies or tracking
This website does not set cookies and has no analytics or advertising trackers. Fonts and scripts are served from our own server, so your visit isn't shared with other companies. If we add analytics or advertising tools in future, we will ask for your consent first and update this policy.
Customers and account users
If your practice uses Callpathway, we hold the details needed to run your account: names, work email addresses and phone numbers of the people who use it, billing details, and records of activity in the account (such as sign-ins and settings changes) for security and support. Our lawful basis is the contract with your practice, and legitimate interests for security and support records.
Card payments are handled by Stripe; we never see or store full card numbers. We keep account data while the account is open. After it closes we keep invoices and financial records for six years, as UK tax law requires, and delete the rest as described in our terms.
Call data we process for practices
Depending on the features a practice switches on, Callpathway processes:
- the caller's phone number, the time and length of the call, and which tracking number was dialled;
- how the caller found the practice, for example the advert, search result or web page that showed the tracking number;
- call recordings, if the practice turns recording on;
- transcripts, call summaries and call scores, if the practice turns these AI features on;
- text messages sent to callers whose call was missed, if the practice turns missed-call text back on.
The practice decides which of these are used and must tell callers about it, for example with a recording message and a privacy notice. The tracking code on a practice's website stores a short-lived cookie so the same visitor keeps seeing the same phone number; the practice's own cookie notice covers it.
Who we share data with
We don't sell personal data. We use these suppliers to run Callpathway. Each is bound by a contract that requires them to protect the data and use it only to provide their service to us.
| Supplier | What for | Where |
|---|---|---|
| OVHcloud | Servers that run Callpathway and store its data | UK |
| Amazon Web Services | Backups | UK (London) |
| Cloudflare | Security and delivery of our websites | Global network |
| Twilio | Phone numbers, call connection, recordings and text messages | USA |
| AssemblyAI | Call transcription, only when a practice turns it on | EU (Ireland) |
| Anthropic | AI call summaries and scoring, only when a practice turns them on | USA |
| Stripe | Card payments and billing | USA and EU |
| Google Workspace | Our email, including demo requests | USA and EU |
Where data goes outside the UK, we rely on the UK's adequacy regulations (including the UK–US data bridge where the supplier is certified) or the ICO's international data transfer agreement or addendum.
We may also share data if the law requires it, or with a buyer if our business is sold, under the same protections.
Keeping data secure
Data is encrypted in transit, access is limited to staff who need it, and accounts are protected by sign-in controls and activity records. No system is perfectly secure, but we take reasonable steps and keep them under review.
Your rights
Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another organisation. Email [email protected]. We'll reply within one month. For call data, we'll pass your request to the practice you called, as they decide how it is handled.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put it right first.
Changes
We'll update this page when how we use data changes, and change the date at the top. If a change affects customers significantly, we'll tell them by email first.