Account and Data Deletion

App: Octavox Developer: Preventa DDDD EOOD Page address: https://octavox.bg/en/delete-account Version: 1.2 · Date: 24 September 2026 (following the external review of 23 September 2026 and the owner's decisions of 24 September 2026; previous versions 1.0 of 22 September 2026 and 1.1 of 24 September 2026)

This page explains how to request the deletion of your account in the Octavox mobile app and of the data associated with it, what we delete, what is kept and for how long. You do not need to open the app in order to submit a request.

In brief:

What we delete ourselves: your profile and your extension, your profile settings and content, the call history of your extension, voicemail, the call recordings stored on your extension, and the notification code on your phone held on our servers. In detail — section 4.
What depends on the manufacturer: the messages and files from the internal chat are stored for one year at the provider of the messaging service (China) via the manufacturer of the platform; the manufacturer has no mechanism for a shorter period or for deletion per individual phone system (confirmed in writing by the manufacturer on 21 September 2026). For the notification code on the manufacturer's push servers and on the phone push channels we have no confirmed mechanism and no confirmed outcome. In detail — section 4.
What is kept: technical traffic data (no content) — 12 months from the date of the call, which is the minimum term of your company's contract for the use of the phone system; security and access logs — 6 months; invoices — 10 years; the contract — 5 years and thereafter until the limitation period for disputes under it expires. These are the periods we have adopted; we are bringing the settings of each phone system into line with them (section 5). App diagnostics are kept under the rules of Google Firebase in the manufacturer's build. In detail — section 5.
How long it takes: confirmation that we have received your request within 3 working days; deletion within 30 days of receiving the request. In detail — section 7.

If what you want is not deletion but a copy of your data or a correction to it, write to info@octavox.eu. Where your company is the controller of the data, we will forward your request to it (section 8).

1. What an Octavox account is

Octavox is a work phone on your mobile device. It works with the cloud phone system of the company you work for.

Your account is an extension on your company's phone system.
It is created and managed by your company's administrator. We delete it only on the company's instruction, or if the company does not reply within the period set out in section 3.
There is no sign-up in the app. You log in with a phone system domain, a username and a password that you receive from the administrator.
The data in the account (calls, call history, chat, voicemail, recordings) is your company's data. For the purposes of the GDPR your company is the controller of that data, and Octavox (Preventa DDDD EOOD) processes it on your company's instructions (Article 28 GDPR).
Separately from this, we keep a minimal set of technical traffic data (numbers, date and time, duration, which phone system the call passed through) for billing your company under its contract for the use of the phone system, for resolving disputes over invoices during the term of that contract, and for security. Your company's contract is for a minimum of 12 months, which is why that data is kept for 12 months from the date of the call. For that set we are the controller (section 5).

For this reason, deleting an account goes through your company's administrator. The two ways to request it are set out below.

2. How to request deletion

2a. Through your company's administrator (the fastest route)

Contact the person responsible for the phone system at your company (usually the IT department, the office manager or the manager). Ask them to delete your extension.

The administrator can do this themselves, without contacting us. Once the extension is deleted, your access to the app ends. Which data we delete ourselves and which depends on the manufacturer is set out in section 4. The manufacturer has not confirmed what exactly is removed when the extension is deleted from the phone system's panel (section 4). We send a request to the manufacturer for the chat and for the notification code only where the request has reached us — if you have gone by route 2a and want that as well, write to us at info@octavox.eu.

2b. Directly with us

If you do not know who the administrator is, if you no longer work at the company, or if you would rather come to us directly, write to us by email. Requests are accepted at info@octavox.eu — you do not need to log in to the app or to any other system.

Write to info@octavox.eu with the subject line “Octavox account deletion”. In your email, state:

The phone system domain (the address you log in with in the app, for example firma.cloud.octavox.eu);
Your extension number (for example 1002);
Your name as it appears in the app;
An email address or telephone number on which we can reply to you.

What you need to do beforehand — nothing in the app. You do not need to log out, to delete anything or to open the app.

What has to happen before deletion — on your company's side. The extension belongs to the company. When the request comes to us, we ask the company's administrator for an instruction — nothing is required of you. If the administrator does not reply in time, we delete the extension ourselves (section 3, item 4). If you prefer, you may ask the administrator directly (route 2a), which is the fastest way.

3. What we do once we receive a request

We confirm receipt of your request by email within 3 working days.
We verify that the request comes from the person the extension belongs to. We may ask you for additional confirmation.
We notify your company's administrator. The data belongs to the company and we are a processor under Article 28 GDPR — we cannot delete an extension without the company's instruction. We give the administrator 10 working days to object.
We act on the administrator's instruction. If the administrator instructs us to delete, we delete the data within 30 days of receiving your request — this is a commitment we make ourselves; under Article 12(3) GDPR we respond without undue delay and in any event within one month. If the administrator does not reply within the 10 working days, this is treated as an instruction to delete — as agreed in the Data Processing Agreement your company has signed with us (Article 28(3)(a) GDPR) — and we delete the data.
We notify you in writing of the outcome — which sets of data we have deleted and on what date, and which have been requested for deletion at a provider.

If your company's administrator objects (for example because the extension is a work extension and has to remain active), we do not delete the data controlled by the company without its instruction. In that case we notify you in writing of the objection and the reason for it.

4. What is deleted

When the account is deleted, we delete the following from our own systems:

Data	Where it is stored
Profile — name, extension, username and password for logging in	on our servers in Bulgaria
The extension on the phone system	on our servers in Bulgaria
Profile settings and content — avatar, personal status, presence status, do not disturb, forwarding rules, call notes	on our servers in Bulgaria
The call history of your extension on the phone system — who called whom, when and for how long (what you see in the app)	on our servers in Bulgaria; your company's data, deleted on its instruction
Voicemail	on our servers in Bulgaria
Call recordings stored on your extension (if the feature was enabled by your company)	on our servers in Bulgaria
The notification code on your phone (the push token — the code through which your device receives notification of an incoming call)	on our servers; kept for as long as the app is registered to the phone system with your extension; when the account is deleted it is deleted from our servers, and when the app is uninstalled it stops being used and is deleted in the cleanup of our servers (section 5)

Messages you have sent in group chats, and call recordings stored on another employee's extension, are your company's data. How a request that comes from only one participant in the conversation is handled is something we are still clarifying. If you are in that position, write to us at info@octavox.eu.

What depends on the manufacturer

Part of the deletion is carried out by components supplied by the manufacturer of the phone system. For the following data we have no confirmed mechanism and no confirmed outcome:

The messages and files from the internal chat. They are processed by the provider of the messaging service via the manufacturer of the platform. The manufacturer confirmed in writing on 21 September 2026 that they are stored at that provider (China) for one year, that there is no mechanism for a shorter period or for deletion per individual phone system, and that files may be stored unencrypted at that provider (the latter is recorded in the manufacturer's agreement of 30 April 2026). The one-year period was communicated by email and does not appear in any contractual document. The chat can be disabled for your company's phone system.
The notification code on the manufacturer's push servers and on the phone push channels. Whether it is removed when the extension is deleted — we asked the manufacturer of the platform on 17 September 2026; its reply of 21 September 2026 gives no confirmation. We will update this page if we receive confirmation.

What remains on the phone system and at the provider of the messaging service after an extension is deleted — we asked the manufacturer on 17 September 2026; its reply of 21 September 2026 gives no confirmation. We will update this page if we receive confirmation. Until then, the following applies: with every request that has reached us, we send a documented deletion request to the manufacturer for those components too, and we inform you in writing of what has been confirmed and what has not (section 3, item 5).

Deletion at the providers who work for us

When we delete an account, we also send a deletion request to the providers who process the data on our behalf. The request goes through the manufacturer of the platform; what it had confirmed as at 21 September 2026 is stated under each point:

the chat — from the provider of the messaging service via the manufacturer of the platform. The manufacturer confirmed in writing on 21 September 2026 that messages and files are stored at that provider for one year and that there is no mechanism for deletion per individual phone system;
the notification code — from the relay of the manufacturer of the platform, from Google (for Android and for iPhone via Firebase), from Apple/APNs for iPhone and from the notification channels of the phone manufacturers. For the branded app the manufacturer supports only Firebase Cloud Messaging (confirmed in writing on 21 September 2026). The notification channels of the phone manufacturers are present in the package; according to the manufacturer (by email, not in a contract) they are not activated on devices with Google services. Where we have no channel through which to make a request, the code drops out when it expires;
the technical crash and usage data — from Google Firebase. The Firebase project is part of the manufacturer's build, so the periods are set by the manufacturer and not by us: with Crashlytics, 90 days is the point at which removal begins, and separate rules and periods apply to Google Analytics and to the notification identifiers.

For the provider of the messaging service and for the manufacturer of the platform, the legal basis for the transfer is the EU Standard Contractual Clauses included in the manufacturer's data processing agreement. In its new agreement of 30 July 2026 the manufacturer expressly specifies Module 2 and Module 3 of the clauses, included by reference; there is as yet no signed copy with the annexes completed and the supervisory authority indicated. Besides Firebase, the app package also contains components of a Chinese provider: one for crash reports and one for the local database on the phone (which sends no data out). Whether the crash-report component is active in our version, the manufacturer has not confirmed; for it and for the notification channels of the phone manufacturers (China) we do not at present have a confirmed legal basis for a transfer. The app is the manufacturer's build — whether those components can be disabled or removed depends on a new build from the manufacturer. We sent a written enquiry to the manufacturer on 17 September 2026 and received a reply on 21 September 2026: according to the manufacturer (by email, not in a contract), the notification channels of the phone manufacturers are not activated on devices with Google services, and removing them requires rescheduling and a new build on its side. Which libraries in the app are active besides the two it confirmed (the voice call library and Firebase Cloud Messaging) — the reply of 21 September 2026 gives no confirmation; we will update this page if we receive confirmation.

The list of recipients, with the country for each, is published in the Privacy Policy, section 6 “Who else sees the data” (https://octavox.bg/en/privacy).

Data on your device

The app keeps some of the data (chat history, settings) locally on your phone. That data is not deleted remotely. To remove it, uninstall the app:

Android: Settings → Apps → Octavox → Uninstall. Or press and hold the icon and choose “Uninstall”.
iPhone: press and hold the icon → “Remove App” → “Delete App”.

Uninstalling deletes the app's data from the device. If your phone makes backups (Google backup on Android, iCloud on iPhone), some of the settings may also have been kept there — in that case, delete them from the backup settings. The manufacturer has not confirmed whether the app is included in the system backups on Android and iPhone; checking in the backup settings is the reliable way.

The app also works with CarPlay (approved by Apple on 21 July 2026). The data you see in the car comes from the same account and goes with it.

5. What is kept and why

Some data is kept for a set period because the law or the contract with your company requires it. For that data we (Octavox) are the controller, not your company:

Data	Period	Basis
Technical traffic data for billing, security and dispute resolution — numbers, date and time, duration, which phone system the call passed through; no content	12 months from the date of the call	your company's contract for the use of the phone system is for a minimum of 12 months; the data is needed for billing under it and for resolving disputes over invoices during its term, as well as for security and fraud detection; the controller is Octavox; Article 6(1)(f) GDPR
Security and access logs — when and from what address the account was accessed	6 months	security of the service and investigation of incidents
Accounting documents (invoices, contract) in which your extension may appear	Invoices — 5 years after expiry of the limitation period for VAT (Article 121(1) of the Bulgarian Value Added Tax Act; Article 38(1)(3) of the Bulgarian Tax and Social Security Procedure Code), in practice not less than 10 years; we apply 10 years from 1 January after the year of issue. Contract — 5 years as a document relevant to taxation (Article 38(1)(4) of the Tax and Social Security Procedure Code), and thereafter until the limitation period under the Bulgarian Obligations and Contracts Act for disputes under it expires	legal obligation (Article 6(1)(c) GDPR) for the tax period; legitimate interest (Article 6(1)(f)) — defence against claims — for the remainder
App diagnostics — crash reports, usage statistics, approximate location from IP address; held at Google Firebase (USA)	set by the manufacturer	the Firebase project is part of the manufacturer's build; with Crashlytics, 90 days is the point at which removal begins, and separate rules apply to Google Analytics and to the notification identifiers

The call history you see in the app is not in this table — it belongs to your company and is deleted as set out in section 4.

The contract for the telephone service is concluded directly between your company and the telecoms operator. We provide the cloud phone system. What data the operator keeps about the calls made, for how long and under what rules is governed by its own terms and privacy policy — for that data, please contact the operator.

These are the periods we have adopted and to which we are bringing the settings of each phone system and of our servers into line. They are set through the automatic cleanup of the phone system and on our servers; the factory value of that setting is “no limit”, which is why it is set explicitly for each phone system. We are bringing the settings into line with the table above and will note here when this has been done for all phone systems. You can check the specific values for your company's phone system with your administrator or with us at info@octavox.eu.

6. Backups

Our servers (at a data centre in Sofia, Bulgaria) make backups. Deleted data may remain in those backups for a limited period, until the backup is overwritten. During that time it is not used for any other purpose and is not accessible in the system.

If you need the exact backup retention period for your company's phone system, write to info@octavox.eu.

7. Timescales and confirmation

Confirmation that the request has been received: within 3 working days, by email.
Period for your company's administrator to object: 10 working days from our notification to them.
Deletion: within 30 days of receiving the request — a commitment we make ourselves; under Article 12(3) GDPR we respond without undue delay and in any event within one month. If your company's administrator does not reply within the 10 working days, this is treated as an instruction to delete (as agreed in the Data Processing Agreement with your company) and we delete the data.
Notification of the outcome: by email, with the date of deletion, which sets of data we have deleted and which have been requested for deletion at a provider.

If you have not received a reply from us within one month, write again to info@octavox.eu or contact the Commission for Personal Data Protection (section 8).

8. Contact

Preventa DDDD EOOD (trading as Octavox) UIC 201690143 Registered seat: Sofia 1582, Druzhba residential district, block 214, entrance B, floor 1, apartment 29 Customer office: 46 Pop Gruyo Street, Sofia Data protection email: info@octavox.eu

We have not appointed a Data Protection Officer. The contact point for all data questions is info@octavox.eu.

At the same address you may request a copy of your data or a correction to it. Where your company is the controller of the data, we forward the request to it.

We sent a written enquiry to the manufacturer on the points noted above on 17 September 2026 and received a reply on 21 September 2026; the reply is reflected on this page. Where it gives no confirmation, this is noted; we will update this page if we receive confirmation.

You have the right to lodge a complaint with the supervisory authority: Commission for Personal Data Protection (CPDP) 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria kzld@cpdp.bg · www.cpdp.bg

More on how we process your data: https://octavox.bg/en/privacy

↑ Back to top