PRIVACY POLICY
Last updated: [September 2026]
1. INTRODUCTION
1.1.
This Privacy Policy explains how your personal information is collected, used, stored, shared, and protected when you use the CloudPBX4U mobile application (“the App”).
1.2.
The App is developed by using frontend softphone technology from WebTrit and backend infrastructure from PortaOne and operated by Vox Telecommunications (Pty) Ltd (registration number 2011/000797/07), with its principle place of business at 5th Floor, 5 Magwa, Waterfall (“we”, “us”, “our”, or “Vox”).
1.3.
The communications service you receive through the App is provided by your Service Provider — a separate company that uses our technology platform to deliver its services to you.
1.4.
This Privacy Policy applies to the personal information that we process in connection with the App and the platform. Your Service Provider may have its own privacy policy that applies to the personal information it processes in connection with the communications service, your account, billing, and customer support. We encourage you to review your Service Provider’s privacy policy.
1.5.
We are committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and the Constitution of the Republic of South Africa, 1996.
2. WHO IS RESPONSIBLE FOR YOUR PERSONAL INFORMATION?
2.1.
When you use the App, your personal information may be processed by two separate parties, each with different responsibilities under POPIA:
(a)
Vox — Platform Provider
(i)
We are the operator of the App and the technology platform. We process certain personal information for the purposes of operating the App, providing the platform infrastructure, ensuring security, improving the App, and complying with our legal obligations.
(ii)
For this processing, we are the “responsible party” under POPIA. This means we determine the purpose and means of this processing and are accountable for it.
(b)
Your Service Provider — Communications Service Provider
(i)
Your Service Provider uses our platform to deliver communications services to you. Your Service Provider processes personal information for the purposes of providing you with the communications service, managing your account, billing, customer support, and complying with its own legal obligations (including telecommunications regulations).
(ii)
For that processing, your Service Provider is the “responsible party” under POPIA.
2.2.
When we act on your Service Provider’s behalf. In some cases, we process personal information on behalf of your Service Provider — for example, when we host your Service Provider’s customer data on our platform. When we do so, we act as an “operator” under POPIA, processing the information on your Service Provider’s instructions and under a written agreement that requires us to keep your information secure and confidential.
3. WHAT PERSONAL INFORMATION DO WE COLLECT?
3.1.
We collect and process the following categories of personal information:
| Category | Examples | Why we collect it |
|---|---|---|
| Registration and account data | Name, email address, phone number, username | To create and manage your account on the platform |
| Authentication data | SIP User and Password (stored in hashed form) | To secure your account and verify your identity |
| Device information | Country / Region, Android version, device, form factor. Crash Rates, ANRs, Cold Starts (only totals). App version, android process, device and version. Reach, Acquisition, Engagement (does not contain user info). Downloads, redownloads, Conversion rate, Crashes by App Version (OPT In Only) | To ensure the App functions correctly on your device, for troubleshooting, and for security |
| Network information | IP address, connection type (Wi-Fi / mobile data), mobile carrier name | To optimise App performance and for security |
| App usage data | Country / Region, Android version, device, form factor. Crash Rates, ANRs, Cold Starts (only totals). App version, android process, device and version. Reach, Acquisition, Engagement (does not contain user info). Downloads, redownloads, Conversion rate, Crashes by App Version (OPT In Only) | To improve the App, fix bugs, and understand how the App is used |
| Call and messaging metadata | Call timestamps, call duration, called/calling numbers, message timestamps | To enable the communications service and for platform operation. Note: We may process this data as an operator on behalf of your Service Provider. The data is used for billing, record keeping, troubleshooting. |
| Contact list data | Names and phone numbers from your device address book | Only if you grant permission. To display contact names during calls and enable calling from your address book |
| Push notification tokens | Device tokens for push notifications | To deliver incoming call and message notifications |
| Communications content | Voice call audio, message content | We do not access or store the content of your calls or messages unless call recording is enabled by your Service Provider / you use a voicemail feature. If call recording is a feature, it is controlled by your Service Provider. |
| Images and camera data | We only ask you to grant access to his/her camera for Video calls. We do not have access to Images on the end-users device. |
3.2.
Information we do NOT collect:
(a)
We do not collect your payment or billing information — that is collected by your Service Provider [and/or the app store payment processor].
(b)
We do not read or store the content of your calls or messages [unless the exceptions in clause 3.1 apply].
(c)
We do not collect [biometric data / health data / other categories not collected].
4. HOW DO WE COLLECT YOUR PERSONAL INFORMATION?
4.1.
Directly from you: When you register for an account, update your profile, or grant device permissions.
4.2.
Automatically from your device: When you use the App, certain information (device information, network information, usage data, crash data) is collected automatically.
4.3.
From your Service Provider: Your Service Provider may share certain information with us to enable the platform to function (e.g., your account status, service plan details).
4.4.
From third-party services: If you log in using a third-party service (e.g., Google, Apple ID), we may receive basic profile information from that service in accordance with your settings.
5. WHY DO WE PROCESS YOUR PERSONAL INFORMATION AND ON WHAT LEGAL BASIS?
5.1.
We process your personal information for the following purposes and on the following legal bases under POPIA:
| Purpose | Legal basis (POPIA) |
|---|---|
| Providing and operating the App and platform | Necessary for the performance of the contract between you and us (the EULA) — POPIA section 11(1)(b) |
| Account creation and authentication | Necessary for the performance of the contract — POPIA section 11(1)(b) |
| Enabling the communications service | Necessary for the performance of the contract between you and your Service Provider — POPIA section 11(1)(b); and/or processing as operator on behalf of your Service Provider |
| Security, fraud prevention, and abuse detection | Our legitimate interest in protecting the platform and its users — POPIA section 11(1)(f); and/or compliance with a legal obligation — POPIA section 11(1)(c) |
| App improvement and analytics | Our legitimate interest in improving the App — POPIA section 11(1)(f). Where feasible, we use aggregated or de-identified data for this purpose |
| Troubleshooting and technical support | Necessary for the performance of the contract — POPIA section 11(1)(b); and/or our legitimate interest — POPIA section 11(1)(f) |
| Compliance with legal obligations | Compliance with a legal obligation — POPIA section 11(1)(c). This includes obligations under RICA, tax laws, and regulatory requirements |
| Responding to your requests or complaints | Necessary for the performance of the contract — POPIA section 11(1)(b) |
| Direct marketing | Only with your prior consent — POPIA section 69. You may opt out at any time (see clause 10) |
6. WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?
6.1.
We may share your personal information with the following categories of recipients:
| Recipient | Purpose | Basis |
|---|---|---|
| Your Service Provider | To enable the communications service and manage your account | Necessary for the performance of the contract; operator relationship |
| Hosting and infrastructure providers | To host the platform and store data securely | Operator agreements with appropriate security safeguards |
| Analytics providers (Google Firebase Crashlytics) | To analyse App usage and improve the App. | Legitimate interest; data is aggregated/de-identified where feasible |
| Push notification services | To deliver incoming call and message notifications. [e.g., Apple Push Notification Service (APNs), Google Firebase Cloud Messaging (FCM)] | Necessary for the performance of the contract |
| Security and fraud prevention services | To detect and prevent fraud, abuse, and security threats | Legitimate interest; legal obligation |
| Professional advisors | Legal, audit, and insurance advisors, where necessary | Legitimate interest; legal obligation |
| Law enforcement and regulatory authorities | Where required by law, regulation, court order, or lawful request | Legal obligation |
| In connection with a business transfer | If we are involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy | Legitimate interest |
| Softphone Infrastructure Providers (including WebTrit) | To enable the App’s user interface, call signalling, and video/voice transmission. | Necessary for the performance of the contract; operator relationship |
6.2.
We do not sell your personal information to third parties.
6.3.
We require all third parties with whom we share personal information to implement appropriate security safeguards and to process the information only for the purposes for which it was shared.
7. INTERNATIONAL TRANSFERS
7.1.
Your personal information may be transferred to, stored in, or processed in countries outside the Republic of South Africa. This may occur because:
(a)
our Oracle Cloud Infrastructure hosting and infrastructure providers operate servers in the Republic of South Africa;
(b)
our analytics or push notification providers are based outside South Africa; or
(c)
your Service Provider may be based outside South Africa.
7.2.
When we transfer your personal information outside South Africa, we ensure that the transfer complies with section 72 of POPIA by relying on one or more of the following:
(a)
the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection for personal information that is substantially similar to the protection provided under POPIA;
(b)
the transfer is necessary for the performance of the contract between you and us (the EULA) or between you and your Service Provider; or
(c)
you have consented to the transfer.
8. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?
8.1.
We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required or permitted by law.
8.2.
The following retention periods apply:
| Category | Retention period |
|---|---|
| Account and registration data | For the duration of your account, plus 5 years after account closure or deletion |
| Call and messaging metadata | Between 5 and 7 years from the date of the call or message, or as required by applicable law |
| Device and network information | 5 years |
| App usage and analytics data | [PERIOD, e.g., twenty-four (24) months] from collection, after which it is aggregated or de-identified |
| Crash and diagnostic data | 60 days from collection |
| Contact list data | No contact list data is saved. |
| Communications content | Voicemail: Managed by you. Voicemail messages are retained until you choose to delete them.
Voice Call Recordings: Call content is not accessed or stored unless call recording is turned on. While the Service Provider enables the recording feature, you are responsible for managing your own recordings. Messaging: Only metadata is retained for messages; message content itself is not stored. |
8.3.
When personal information is no longer needed, we securely delete or de-identify it in accordance with our data retention and destruction procedures.
9. HOW DO WE PROTECT YOUR PERSONAL INFORMATION?
9.1.
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, damage, or unlawful processing, as required by section 19 of POPIA. These measures include:
(a)
encryption of data in transit (TLS/SSL) and at rest;
(b)
access controls and authentication mechanisms;
(c)
regular security assessments and vulnerability testing;
(d)
incident detection and response procedures;
(e)
staff training on data protection and security; and
(f)
contractual security obligations on our operators and service providers.