Compliance
Outbound calling in the UK and EU comes with rules. Decibel enforces the ones a product can enforce and gives you the documents for the rest.
Last updated 1 October 2026
TPS and CTPS screening
Regulation 21 of the Privacy and Electronic Communications Regulations (PECR) prohibits unsolicited live marketing calls to numbers registered with the Telephone Preference Service (TPS) or the Corporate TPS (CTPS), unless the person has told you they do not object.
Decibel checks every number before every dial. The check runs on our servers as part of placing the call, so it cannot be skipped from the browser. If a number is listed, the call is blocked and the rep sees why. Numbers imported by CSV are screened row by row in the same way.
Your do-not-call list
Each workspace has its own do-not-call list. When a rep logs the outcome “Do not call”, or an admin adds a number, it takes effect immediately: the next attempt to dial that number from anyone in the workspace is blocked.
Caller ID
Every call presents a valid caller ID that the person can ring back: either your workspace number or an existing number you have verified. There is no option to withhold the number.
Call recording notices
Calls are recorded so teams can review and coach. Workspace admins choose how people are told:
- Always. A recording announcement plays at the start of every call.
- Rep’s choice. The rep decides per call, for example when they will tell the person themselves.
- Never. No automatic announcement. You are responsible for informing people another way.
We recommend “Always” unless you have taken advice on your own approach.
Lawful basis
For B2B outreach the lawful basis under UK GDPR and EU GDPR is legitimate interest (Article 6(1)(f)). That basis needs a documented Legitimate Interests Assessment (LIA) showing the purpose, why the processing is necessary, and how it balances against the rights of the people you contact.
Decibel maintains an LIA for the database. As a customer you are a controller for your own outreach, so you need one too. Download LIA template
Article 14 notices
People in the database did not give us their details directly, so Article 14 of the GDPR requires that they are told who holds their data, why, and how to object. Our notice is published at Article 14 notice.
Right to object and erasure
Anyone can object to direct marketing at any time, and that objection is absolute. People can ask to be removed at Opt out. Customers can action objections themselves by marking a person “Do not call” or deleting the record.
Data residency and sub-processors
The primary database, including contact records, call metadata and recordings metadata, is hosted in the UK (Supabase eu-west-2, London).
| Sub-processor | Purpose |
|---|---|
| Supabase | Database, authentication and file storage (London) |
| Twilio | Voice calls, phone numbers and call recordings |
| Stripe | Subscription billing and payments |
| Vercel | Application hosting |
| Resend | Transactional email |
| PostHog | Product analytics |
Details of each sub-processor are listed in the Data Processing Addendum.
Retention
| Data | Kept for |
|---|---|
| Call recordings, Pro plan | 1 year |
| Call metadata (who, when, duration, outcome) | 3 years |
| Deleted workspaces | Purged 30 days after deletion |
Country notes
Rules differ by country. Germany and Austria are notably stricter about unsolicited B2B calls and generally expect prior or at least presumed consent. Decibel shows a warning in the product when you search for or open contacts in those countries. Check local rules before calling outside the UK.
Ofcom and abandoned calls
Ofcom’s rules on abandoned and silent calls are aimed at predictive diallers that place more calls than there are agents to answer. The Decibel dialler places one call at a time, started by a rep who is on the line when it connects, so those rules do not apply to it.
Questions
Email oliver@usedecibel.com and we will answer in plain English.