Call Recording & AI Disclosure

The UAE TDRA Consumer Protection Regulations and Federal Decree-Law 45/2021 (PDPL) require that callees be informed (a) they are speaking to an automated system and (b) the call is being recorded, before any personal data is collected. Lumaa enforces this disclosure on every outbound call.

Disclosure delivered at the start of every call

English

"Hi, this is an automated assistant from {client_company}. This call is being recorded for quality and may be processed by an AI to take notes. If you'd prefer not to continue, just say 'opt out' and I'll end the call."

Arabic

"السلام عليكم، أنا مساعد آلي من شركة {client_company}. يتم تسجيل هذه المكالمة لأغراض الجودة وقد تتم معالجتها بواسطة الذكاء الاصطناعي. إذا كنت تفضل عدم المتابعة، يكفي أن تقول 'إلغاء الاشتراك' وسأنهي المكالمة."

How "opt out" works

If the callee says "opt out", "stop calling", "remove me", or the Arabic equivalent, the AI:

1. Replies: "Understood, ending the call. Your number will not be contacted again."
2. The number is added to the tenant's Do-Not-Call list in the system.
3. The outbound dispatcher checks the DNC list before placing each call — listed numbers receive a 451 response and are not dialled.
4. The opt-out is logged in the audit log with call ID, phone number (E.164 only), and timestamp — retained 7 years per UAE consumer-protection record-keeping.

Recording storage

• Stored in tenant-segregated S3 prefixes by the orchestrator.
• Pre-signed URLs expire in 5 minutes — no permanent links.
• Default retention: 90 days. Configurable per tenant in their DPA. Longer retention requires explicit business justification.
• On tenant termination: 30 days post-termination, recordings are hard-deleted from S3 and transcripts from the database. Customers may request a deletion certificate.

Lawful basis

Recording and AI processing is performed under UAE PDPL Art. 4 on one of:

• The callee's prior consent (typically when they have submitted a contact request and ticked an explicit consent box).
• The Client's legitimate interests (e.g., quality assurance, fraud prevention) where these are not overridden by the callee's privacy interests, supported by a documented Legitimate Interest Assessment.
• Performance of a contract the callee is party to.

The Client (the entity dispatching calls) is the data controller and is responsible for selecting and documenting the lawful basis. Lumaa acts as data processor on behalf of the Client.

Callee rights

Anyone called by an AI on the Lumaa platform can:

• Request a copy of their recording / transcript.
• Request correction of any data tied to their phone number.
• Request deletion (subject to legal-retention obligations).
• Lodge a complaint with the UAE Data Office.

Email privacy@lumaa.ai with the date, time, and number that was called. We will route the request to the relevant Client controller within 5 business days.