Privacy Notice

Callvox OÜ (“Callvox”, “we”, “us”) is a private limited company registered in Estonia, registry code 17467209, registered office Lootsa tn 5, Tallinn, 11415, VAT no. EE102976692. This Notice explains how we handle personal data when you visit our websites, use our customer portal or APIs, deal with us as a business contact, apply for a job, or when personal data is processed as part of the telecommunications services we deliver.

“You” means the individual visiting our website or portal (for yourself or on behalf of a company), a business contact, a job applicant, or an individual whose data is processed in our Services, such as the recipient of an SMS, the user of a phone number or eSIM, or the beneficiary of an airtime top-up.

1. Who we are and our role

Callvox is a wholesale telecommunications platform. We provide voice termination, A2P SMS, airtime top-ups, eSIM provisioning and DID (telephone number) services to carriers, mobile operators, MVNOs, resellers and enterprises (“Customers”). We route traffic and transactions between Customers and upstream carriers, SMS aggregators, airtime providers and mobile operators, who deliver them to the end user.

Our role under the GDPR depends on the activity:

If you are an end user of one of our Customers, that Customer decides why your data is sent to us and is usually your first point of contact.

2. Scope

This Notice covers personal data processed:

1. through our websites, customer portal, developer portal and APIs (the “Website”);
2. for recruitment (“Job Applications”);
3. to deliver our Services to Customers, where end-user data is personal data (“Services”); and
4. about business contacts such as Customer representatives, prospects, suppliers and partners (“Business Contacts”).

3. What we collect, why, and on what legal basis

3.1 Website and customer portal

You give us: name, job title, company, business email and phone, country, products and corridors of interest, and anything else you choose to share in forms such as Get a Quote, Become a Partner, API access applications or rate deck downloads.

Collected automatically: IP address, device type and identifiers, browser, approximate location (country or city level), pages viewed, links clicked, timestamps, via server logs and cookieless analytics.

Portal and API data: account credentials, user roles, API key identifiers and scopes, IP addresses used or whitelisted for API access, usage logs, support tickets.

3.2 Services

Depending on the Services a Customer uses, and only to the extent it is personal data, we process:

• Voice: calling and called numbers, SIP signalling data, routing parameters.
• A2P SMS: sender IDs, recipient numbers, message content, delivery receipts.
• Airtime top-ups: recipient number, operator, product and amount, transaction references, and beneficiary details where a Customer supplies them.
• eSIM: ICCID, EID, profile and activation data, device information given at provisioning, status and data usage.
• DIDs: numbers assigned and, where a local regulator requires it, identity and address details of the end user or business holding the number.
• Support data: logs, screenshots and other material Customers send us for troubleshooting.
• Generated by us: call and message detail records (origin, destination, date, time, duration or size, route, price, result codes). These never include the content of voice calls. Also fraud and risk indicators, such as traffic anomalies, flagged numbers or sender IDs, and reports of suspected or confirmed fraud, including SMS pumping.

We do not use end-user message content for advertising and we do not sell personal data.

3.3 Business contacts

We collect business contact data (name, business email and phone, job title, company, professional profile links), enquiry data and marketing preferences, from you or from sources such as your employer, public business directories, industry events and professional networks.

3.4 Recruitment

If you apply for a role we collect what you provide (identity and contact details, CV, employment and education history, referees, right-to-work information where relevant) and, where lawful, information from referees, recruitment agencies and public professional profiles. We do not seek sensitive categories of data. If you choose to provide any, we rely on your explicit consent or a legal requirement.

Legal basis: legitimate interest in recruiting suitable candidates (Art. 6(1)(f)); steps before an employment contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); consent where stated. If you are hired, your data becomes part of your personnel record. If not, we may keep your application for up to 12 months for other openings unless you ask us to delete it.

4. Who we share personal data with

We share personal data only as needed for the purposes above, and never with third parties for their own direct marketing.

• Upstream carriers, SMS aggregators, airtime and top-up providers, eSIM and SM-DP+ partners, and mobile operators that carry, deliver or fulfil the traffic and transactions submitted through us. Delivery to the destination operator is the service, so these recipients necessarily receive the relevant numbers, message content and metadata.
• Callvox group companies, including Offist Telecommunications Services Ltd (United Kingdom), where needed to run the Services, billing, support and compliance.
• Service providers acting on our instructions: cloud hosting and database providers, background job and messaging infrastructure, email and CRM tools, analytics, invoicing and payment providers, KYC and sanctions screening providers, auditors and advisers. A current list is available on request at legal@callvox.net.
• Customers, regarding their own traffic, detail records, invoices, delivery receipts and webhooks.
• Authorities and other third parties where disclosure is required by law, regulation, court order or government request, or is needed to establish, exercise or defend legal claims or to prevent fraud and abuse. Where lawful we will tell the affected party.
• Successors in a merger, acquisition, financing, reorganisation or asset sale, subject to confidentiality and this Notice.

We may share aggregated or de-identified data that does not identify you.

5. International transfers

Our Services are international by nature. Routing a call, SMS, top-up or eSIM request to a destination outside the European Economic Area (EEA), including in Africa, Latin America, South Asia and the Middle East, requires sending the relevant data to carriers and operators there. Some of our service providers are also outside the EEA.

For transfers outside the EEA we rely on: an adequacy decision of the European Commission (which currently includes the United Kingdom); the Commission’s Standard Contractual Clauses with supplementary measures where needed; or, where a transfer is necessary to perform a contract with you or in your interest, or to establish, exercise or defend legal claims, the derogations in Article 49 of the GDPR. You can request a copy of the applicable safeguards by contacting us.

6. How long we keep personal data

We keep personal data only as long as needed for the purposes in this Notice, then delete or anonymise it.

Data may be kept longer where the law requires it, or for a pending claim or investigation. Data in backups is deleted as backup cycles allow and is isolated from other use meanwhile.

7. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse and alteration, including access controls and least-privilege permissions, encryption in transit, logging and monitoring, supplier due diligence and staff confidentiality obligations. No system is completely secure and we cannot guarantee that a breach will never occur. If a breach puts your rights and freedoms at risk, we will notify you and the competent authority as the law requires.

8. Your rights

Under the GDPR and applicable local law you may have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected or incomplete data completed;
• have your data erased;
• restrict our processing;
• receive your data in a portable format;
• object at any time to processing based on our legitimate interests, including direct marketing;
• withdraw consent where we rely on it, without affecting earlier processing; and
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects. We use automated tools to detect fraud and abusive traffic, and you can ask for a person to review a decision that affects you.

These rights are not absolute. We may refuse or limit a request where it would reveal another person’s data, conflict with a duty to retain data (such as accounting, AML or telecom rules), or prejudice a fraud investigation. We will explain our reasons if we do.

To exercise your rights, write to legal@callvox.net. We may ask you to verify your identity, and we aim to reply within one month. If you are an end user of a Customer, we may forward your request to that Customer where we act as its processor.

You may also complain to a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee. You may instead contact the authority in the EU/EEA country where you live or work.

9. Marketing choices

You can opt out of marketing emails at any time through the unsubscribe link in any message or by writing to legal@callvox.net. We will still send service and contractual messages such as invoices, security notices and changes to terms.

10. Children

Our websites and Services are intended for businesses and are not directed at children. We do not knowingly collect children’s personal data through the Website. End-user data that Customers submit to us is the Customer’s responsibility.

11. Third-party links

Our Website may link to third-party sites. We are not responsible for their privacy practices.

12. Changes to this Notice

We may update this Notice from time to time. We will change the “Last updated” date and, for material changes, tell you through the Website or by email.

13. Contact us

Law enforcement and regulatory requests: legal@callvox.net