Privacy Policy
Last updated: August 2026 | Norango Ltd. | ICO Registration: ZA881807
1. Who We Are
Norango Ltd. ("Norango A.I.", "we", "us", "our") is the data controller responsible for your personal data. We are registered in England and Wales. Our registered office is at 9 St George's Yard, Castle Street, Farnham, Surrey, GU9 7LW. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you have any questions about this policy or how we handle your data, please contact our Data Protection contact at: privacy@norango.ai.
2. Data We Collect
We collect and process the following categories of personal data:
| Data Category | Examples | Legal Basis |
|---|---|---|
| Identity Data | Name, job title | Contract, Legitimate Interest |
| Contact Data | Email address, phone number, postal address | Contract, Legitimate Interest |
| Business Data | Company name, business category, website URL | Contract |
| Call Data | Call recordings, transcripts, caller details captured by our AI receptionist | Contract, Legitimate Interest |
| Technical Data | IP address, browser type, device information, pages visited | Legitimate Interest |
| Marketing Data | Preferences, communication history, campaign responses | Consent, Legitimate Interest |
3. How We Use Your Data
We use your personal data for the following purposes: to provide and manage our telephone answering and AI receptionist services; to process payments and manage your account; to communicate with you about your service, including sending invoices and service updates; to improve our services and develop new features; to comply with legal and regulatory obligations; and to send you marketing communications where you have given consent or where we have a legitimate interest to do so.
4. Call Recording and AI Processing
Our AI receptionist service involves the recording and processing of telephone calls. Callers to your business number will be informed that their call may be recorded and handled by an AI system. Call recordings and transcripts are stored securely and retained for a period of 90 days unless a longer retention period is required by law or agreed in writing. Call data is processed by our AI systems (including Retell AI) solely for the purpose of providing the receptionist service and is not used for training AI models without explicit consent.
5. Data Sharing
We do not sell your personal data to third parties. We may share your data with: our technology partners who provide infrastructure for our services (including Retell AI for voice processing, and cloud hosting providers); professional advisers including lawyers, accountants, and auditors; regulatory authorities and law enforcement agencies where required by law; and business partners where you have consented to such sharing.
All third-party processors are subject to data processing agreements and are required to process your data only on our instructions and in accordance with UK GDPR.
6. International Transfers
Some of our service providers are based outside the UK. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO) or adequacy decisions. Retell AI is based in the United States and processes data under Standard Contractual Clauses.
7. Data Retention
We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Client account data is retained for 7 years after the end of the client relationship in accordance with UK tax and accounting law. Call recordings are retained for 90 days. Marketing data is retained until you withdraw consent or opt out.
8. Your Rights Under UK GDPR
Under UK GDPR, you have the following rights:
- Right of access — to request a copy of the personal data we hold about you
- Right to rectification — to request correction of inaccurate or incomplete data
- Right to erasure — to request deletion of your data in certain circumstances
- Right to restrict processing — to request that we limit how we use your data
- Right to data portability — to receive your data in a structured, machine-readable format
- Right to object — to object to processing based on legitimate interests or for direct marketing
- Rights related to automated decision-making — not to be subject to solely automated decisions that significantly affect you
To exercise any of these rights, please contact us at privacy@norango.ai. We will respond within 30 days.
9. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These measures include encryption of data in transit and at rest, access controls and authentication, regular security assessments, and staff training on data protection. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay.
10. Complaints
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator. You can contact the ICO at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concerns directly before you contact the ICO.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by email or by posting a prominent notice on our website. The date at the top of this policy indicates when it was last updated.
12. Contact Us
For any questions about this Privacy Policy or our data practices, please contact: privacy@norango.ai | Norango Ltd., 9 St George's Yard, Castle Street, Farnham, Surrey, GU9 7LW.