Sales training privacy: keeping personal data out of practice

Short answer

Personal data enters sales training in two places. First, in scenarios and profiles: when a real customer's name, phone number, company or conversation is copied into a profile. Second, about the employee: their name, phone number, the text or audio of practice conversations, and their scores. In the first case the rule is simple — real customer data must not enter a profile, only anonymised behaviour and situation. In the second, employees must be told in advance what data is kept, who sees what and what it will not be used for.

Personal data processing is regulated by country; in Azerbaijan the core text is the Law on Personal Data. This article sets out practical rules and is not legal advice — check the specific requirements with a lawyer.

Data set one: customers

The most realistic profile is written from a real customer, and that creates a temptation: copy the transcript of a failed conversation into a profile, complete with the customer's name and company. That causes two problems. First, the real customer's data moves from the purpose it was collected for — sales or service — to another purpose, training. Second, the data becomes visible to more people — the whole team practising.

Managing personal data in real call recordings is a separate topic; see personal data in call recordings. In training, the aim is to take only the lesson from a real conversation, not the person.

Anonymising a scenario: five steps

1. 1Remove namesReplace the names of the customer, company and employee with a general description: "director of a mid-sized construction firm".
2. 2Remove contact detailsPhone numbers, emails, addresses and order numbers do not belong in a profile.
3. 3Change identifying detailsIn a small market, a detail such as "the only three-storey furniture store in town" identifies someone. Generalise such details.
4. 4Remove sensitive informationHealth, financial situation, family matters — even if they came up in the conversation, leave them out unless the profile needs them.
5. 5Keep only behaviourWhat the profile needs: what the customer wants, how they talk, which objection they raise, which answer they accept.

Data set two: employees

To work, AI practice has to keep some data about the employee: name, phone number (for the test call), messenger username (for chat practice), department and position. Practice itself also creates data: the conversation text, the transcript or audio of call practice, evaluations and scores.

• Minimum: fill in only the fields practice needs. Do not write personal characterisations into an "additional information" field.
• Access: employees see their own results, managers their own team's. Access to another department's results needs a reason.
• Purpose: practice results are for learning. State in writing which decisions they will not be used for.
• Retention: decide in advance how long data is kept and what happens when an employee leaves.

What to tell employees

Before the pilot or first session, prepare a short written notice. It should answer five questions: what data is collected, why, who sees it, how long it is kept, and what the results will not be used for. The last question matters especially: state openly that practice scores will not be the sole basis for pay, bonus or dismissal decisions. Such a notice helps with legal requirements and builds trust.

Voice practice is a special case

In call practice, or when replying by voice message in a messenger, the employee's voice is processed. Voice can be biometric in nature and is given extra protection in many jurisdictions. Explain to employees how voice practice works, that audio is converted to text and what is kept; if possible, keep a written practice option so voice practice is not compulsory.

Check the knowledge base too

Profiles are sometimes generated from the company's knowledge base. If customer lists, real chats or employee data have ended up in the knowledge base, they may carry over into a profile. Before training starts, check the knowledge base for personal data. For its structure see the training knowledge base.

Who is responsible for what

• Profile owner: anonymises profiles and checks each new one with "could a colleague recognise them?".
• Sales head: controls who has access to results and for what purpose they are used.
• HR or legal: sets the notice to employees, the retention period and what happens to data when someone leaves.
• The employee: does not use real customer data in practice and reports wrong information when they see it.

When roles are not written down, privacy becomes "everyone's job" — which means nobody's.

Illustrative example: anonymising

This is not a real customer case. A manager wants to write a profile from a failed real conversation. First draft: a named customer, their company, a mobile number, "two of his orders were late last month, he's in a hurry because of his daughter's wedding". Anonymised version: "owner of a small logistics firm, had delays with a previous supplier, tied to a specific date for personal reasons". The profile is just as useful for practice but does not identify a real person.

Common mistakes

• Copying a real conversation into a profile with names.
• Writing personal opinions about an employee in the "additional information" field.
• Giving the whole company access to all results.
• Starting practice without telling employees what data is kept.
• Making voice practice compulsory with no alternative.
• Not checking the knowledge base for personal data.

Limitations

Anonymisation is never complete: in a small market even a general description can identify someone. Legal requirements differ by country, sector and the terms of employment contracts; for companies operating in the European Union, the GDPR may also apply. This article gives general practical rules and does not replace a lawyer's review.

Data in Vexvon AI Training

In Vexvon AI Training an employee record has fields for first and last name, phone number, Telegram username, department, position and additional information; the text of practice conversations and test-call transcripts are kept for reports. The company writes its own customer profiles — so anonymisation is the company's responsibility. Agree retention and deletion terms in the contract; the platform's security approach is described on the security page.

Next step

Check your existing profiles with the question "could a colleague recognise the customer?" and write the five-question notice for employees. For the pilot plan see the pilot, and for building profiles the AI customer profile; more articles are in rollout and reliability. To build it together, get in touch.