Privacy Policy

Page address: https://octavox.bg/en/privacy Version: 1.2 · Date: 24 September 2026 App: Octavox · Developer: Preventa DDDD EOOD

This policy explains what data the Octavox mobile app and the cloud phone system (PBX) behind it process, who is responsible for that data, and what your rights are. It is written for the employees of the companies that use Octavox and for the people who talk to them.

Contents

1. Who we are
2. How the app works, in brief
3. When your employer decides and when we decide
4. What data we process and why
5. Our legitimate interests
6. Who else sees the data
7. Data that leaves the EU
8. How long we keep data
9. What the app does on your device
10. Call recording
11. Your rights and how to exercise them
12. Data about people who are not our users
13. Security
14. Children
15. How to contact us
16. Changes to this policy

1. Who we are

In one sentence: Octavox is a trademark of the Bulgarian company Preventa DDDD EOOD, which publishes the app and operates the cloud PBX.

• App publisher and service provider: Preventa DDDD EOOD (a single-member limited liability company under Bulgarian law)
• Company registration number (UIC): 201690143
• Registered office: Sofia 1582, Druzhba district, block 214, entrance B, floor 1, apt. 29, Bulgaria
• Office and correspondence address: 46 Pop Gruyo St., Sofia, Bulgaria
• Trademark: Octavox
• Website: https://octavox.bg/
• Email for data protection enquiries: info@octavox.eu
• App: “Octavox” — Android (com.octavox.mobile) and iOS (App ID 6791456780)
• Date and version of this document: 24 September 2026, version 1.2

Further on in this text, “we” and “Octavox” mean Preventa DDDD EOOD.

The app is built on the platform of its manufacturer — a company established in China. In other words: the app is the manufacturer's, but it is offered under our brand (a white-label version). What this means for your data is explained in sections 6, 7 and 9.

Data Protection Officer (DPO): we have not appointed one — our core activities do not consist of regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special categories of data (Article 37(1) GDPR). All data protection questions are handled by our team at info@octavox.eu.

2. How the app works, in brief

In one sentence: Octavox is a work phone on your mobile device, and the account in it belongs to your employer.

• The app is a phone in an app (a so-called softphone) for the Octavox cloud PBX. It allows voice calls, internal chat with photos and files, voicemail, a company phone directory, conferences, call transfer and hold and, on iPhone, CarPlay. Video calls and video conferences work only if the feature is enabled for your company's phone system. Call recording is possible only if your company's administrator enables the feature.
• The app is only for employees of companies that have a contract with us. There is no sign-up in it. You cannot create an account yourself.
• Your account is an extension in your company's PBX. It is created, suspended and deleted by your company's administrator. You log in with the PBX domain, a username and a password that you receive from them.
• Your company's phone numbers are provided under a contract between your company and the telecommunications carrier (A1, Yettel or Vivacom). The contract for the telephone services is concluded directly between your company and the carrier; the carrier routes the numbers to our infrastructure. We provide the cloud PBX as a software service and do not hold ourselves out as an undertaking providing a public electronic communications service.
• Emergency calls (112): whether and how access to the emergency number 112 is ensured depends on the carrier your company has a contract with, not on the app. This matter is governed by the Terms of Use (https://octavox.bg/en/terms).

3. When your employer decides and when we decide

In one sentence: for most data in the app, your employer decides and we act on their instructions; for a few technical categories, we decide.

Under the GDPR, the “controller” is the party that decides why and how data is processed. The “processor” is the party that processes data on the controller's instructions (Article 28 GDPR). At Octavox the roles are split as follows:

Our relationship with each customer company is governed by a contract and a Data Processing Agreement (DPA) under Article 28 GDPR.

If you contact us about a right for which your employer is the controller (for example, you want us to delete a call recording or your chat history), we will refer you to your employer and notify them of your request. We will help them respond to you. We cannot delete or change that data without their instruction, because by law the decision is theirs.

4. What data we process and why

In one sentence: here is every category of data, what it is used for and on what legal basis.

The legal bases are those in Article 6(1) GDPR:

• point (a) — your consent;
• point (b) — performance of a contract;
• point (c) — a legal obligation;
• point (f) — legitimate interest (each one named in section 5).

Where your employer is the controller, the legal basis is determined by them. Usually it is the performance of your employment contract (point (b)) or their legitimate interest in organising work communication (point (f)). We process on their instructions.

Do you have to provide the data? Your account data (name, extension number, username, password) is entered by your company's administrator — it is necessary for using the work telephony; without it the account cannot work. You can refuse the device permissions (microphone, camera, contacts, notifications); the corresponding feature will then not work (section 9). The technical data about crashes and app usage cannot, as things stand today, be switched off from within the app itself. We will update this page if the manufacturer adds such a setting.

4.1. Account (extension)

• Data: first and last name, extension number, username, password, PBX domain, work email (if entered by the administrator), extension settings — including profile picture (avatar), personal status and presence status, “do not disturb” mode, call forwarding rules and call notes, if you use them.
• Purpose: to let you log in to the app and make calls.
• Controller: your employer. Legal basis: determined by them (usually point (b) or point (f)).

4.2. Calls and call data

• Data: the caller's and the dialled number, date, time, duration, direction, outcome (answered/missed), which extension and which company phone number the call went through. This call data (in the technical documentation — CDR) is “who called whom, when, for how long”, without the content of the call. Voice and video are transmitted in real time through our servers and are not stored, unless recording is enabled (section 10).
• Purpose: connecting the call and reports for your company (the call history in the PBX).
• Controller: your employer. Legal basis: determined by them. We keep the call history in the PBX on their instruction — by default for 12 months (section 8).
• Separately from this, we keep a minimal set of the same data (numbers, date and time, duration, PBX) for our own purposes — billing your company and detecting telephone fraud. For this set we are the controller; the legal basis is our legitimate interest (point (f)); for accounting retention — a legal obligation (point (c)). Where the customer is a natural person or a sole trader who signed the contract personally, the performance of the contract (point (b)) also applies in respect of that person. The period is 12 months because the contract with your company is for a minimum of 12 months, and the data is needed for billing under it and for resolving disputes over invoices during its term. It is this set that remains for 12 months, including after your account is deleted and after the contract with your company ends (section 8).

4.3. Call recordings

• Data: an audio file of the call, linked to the numbers and the time.
• Purpose: determined by your employer (for example, quality control, evidence in a dispute).
• Controller: your employer. Legal basis: determined by them; recording requires a legal basis and notification of the participants under the GDPR, and the prohibition in Article 246(1) of the Bulgarian Electronic Communications Act applies to a person other than the parties to the call (section 10). We only store the file for the period set out in section 8.

4.4. Voicemail

• Data: the audio message, the number of the person who left it, date and time.
• Purpose: so that you receive messages when you cannot answer.
• Controller: your employer. Legal basis: determined by them.

4.5. Internal chat

• Data: text messages, photos and files you send to colleagues, time sent, who chats with whom.
• Purpose: work communication between employees of the same company.
• Controller: your employer. Legal basis: determined by them.
• Important: the chat is served by the messaging service provider (China). Messages and attachments from the internal chat are processed by that provider and may be stored on servers in China. Messages and attachments are stored there for one year — a period communicated to us in writing by the manufacturer on 21 September 2026, which does not appear in any contractual document. Files may be stored unencrypted there (confirmed in writing by the manufacturer in its agreement of 30 April 2026). There is no mechanism for a shorter period or for deletion per PBX. The chat can be disabled for your company's PBX — speak to its administrator. The full list of recipients, with the country for each, is set out in the Data Processing Agreement your company has signed with us. Ask your company's administrator for it, or write to info@octavox.eu — we will tell you the countries and the basis for the transfer. See sections 6 and 7.

4.6. Company phone directory

• Data: names, extensions, job titles and phone numbers of your colleagues; at some companies, also external contacts (customers, partners) entered by the administrator.
• Purpose: to let you find and dial colleagues and company contacts.
• Controller: your employer. Legal basis: determined by them.
• Personal Contacts: the platform also allows personal contacts that you enter yourself in the app. They are kept in the PBX and are not visible to the administrator or to other users. This is not your phone's address book (section 4.7).

4.7. Contacts on your device

• The app asks for permission to access the contacts on your phone. According to the manufacturer's description, this is so that names are shown for calls and dialling is easier.
• The manufacturer confirmed in writing on 21 September 2026: the phone's address book is never uploaded to a server. The app reads it only locally on the device, to show a name for a call. Your contacts do not leave the device. This applies to the phone's address book; the personal contacts you enter yourself in the app are kept in the PBX (section 4.6).
• Access takes place only with a technical permission from the operating system, which you can refuse or withdraw in your phone's settings; the information required by Article 4a of the Bulgarian Electronic Commerce Act is this policy. The contacts do not leave the device and we do not receive them, so we do not process them as a controller. If you refuse the permission, names from your address book will not appear in the app.

4.8. Diagnostics and crash reports

• Data: technical crash data (which screen, which line of code), device model and manufacturer, operating system and app version, free memory, language, date and time, installation identifier, IP address at the time of sending.
• Purpose: to find and fix errors in the app.
• Controller: Octavox. Legal basis: legitimate interest (point (f)) — a stable and secure app. The crash-reporting library writes and reads an installation identifier in your phone's memory. For this, Article 4a of the Bulgarian Electronic Commerce Act requires that you are informed (this page) and have the possibility to refuse; EU law (Directive 2002/58, Article 5(3)) requires consent. Today the app offers neither a setting to refuse nor a request for consent. We will update this page if the manufacturer adds such a setting.
• Providers: Google Firebase Crashlytics (USA); a crash-reporting provider (China); the platform manufacturer's own crash-reporting channel (China). Both Chinese components are present in the app package. We sent a written enquiry to the manufacturer on 17 September 2026 and received a reply on 21 September 2026: the manufacturer confirmed as active in our version only the voice-call library and Google Firebase Cloud Messaging; whether the two Chinese components are active and where the reports are stored — the question remains open; we will update this text if we receive confirmation. Until then, we declare all three as possible recipients of diagnostic data.

4.9. App usage statistics

• Data: which screens and features you use, how often you open the app, session duration, technical device data. We also include approximate location (at city or country level), which Google may derive from your IP address when the statistics are sent — we declare it as collected in the app store listings, without having received confirmation that it is in fact derived in our case.
• Purpose: to understand which features are used and to improve the app.
• Controller: Octavox. Legal basis under the GDPR: legitimate interest (point (f)) — to understand which features are used. Separately from that, for the writing and reading of identifiers on your device, what is said in section 4.8 applies (Article 4a of the Bulgarian Electronic Commerce Act — information and the possibility to refuse; today there is no such setting).
• Provider: Google Firebase Analytics, Performance, Remote Config (USA).

4.10. Notification codes (push tokens) and incoming call notifications

• Data: the unique code by which your device receives the notification of an incoming call (the so-called push token); for an incoming call — the caller's number and name and the PBX serial number (according to the manufacturer's documentation). We refer to it below as “the notification code”. Notifications are relayed through the platform manufacturer's servers (China). We are clarifying with the manufacturer the exact content of the notification, where those servers are located and what they record in their logs, and we will update this page. Until that is confirmed, assume that the caller's number and name may be visible to the manufacturer.
• Purpose: so that your phone rings even when the app is closed.
• Controller: Octavox. Legal basis: legitimate interest (point (f)) — without the notification, incoming calls would not reach you; the contract with your company is the reason we provide the service, but you are not a party to it.
• Providers: Google Firebase Cloud Messaging (USA) — for the branded app the manufacturer supports only this channel (confirmed in writing on 21 September 2026); Apple (APNs, USA) — notifications to iPhone; every notification to an iPhone passes through it, including those sent via Firebase; relaying of the notifications through the platform manufacturer's relay (China). The notification channels of the phone manufacturers (China) are present in the app package; according to the manufacturer (by email, not in a contract) they are not activated on devices with Google services. On phones without Google services, incoming calls do not arrive as a notification when the app is closed.

4.11. Advertising ID

• We do not show ads and we do not use the advertising identifier for anything.
• Nevertheless, the Android version contains the ACCESS_ADSERVICES_AD_ID permission, and according to Google's documentation the Firebase Analytics library collects the advertising identifier by default. The com.google.android.gms.permission.AD_ID permission is absent, so on Android 13 and later the identifier is read as zeros; on Android 8–12 the library may collect it by default. Our own check of the package: 16 and 23 September 2026. We therefore treat the advertising identifier as possibly collected and declare it as such. We sent a written enquiry to the manufacturer on 17 September 2026 and received a reply on 21 September 2026: the manufacturer confirmed that the app contains no advertising; whether the identifier can be disabled or the permission removed — no answer was given and the question remains open.
• Legal basis: if it is collected, this would require your consent (point (a)), which is not requested today. Our goal is for this identifier not to be collected at all. You can reset or disable it in your Android settings (Privacy → Ads).

4.12. Security and access logs

• Data: the IP address you log in from, login date and time, failed login attempts, device registration with the PBX, administrative actions, server security events.
• Purpose: to protect your company's PBX from unauthorised access and telephone fraud (toll fraud); to investigate incidents.
• Controller: Octavox. Legal basis: legitimate interest (point (f)) and our security obligation under Article 32 GDPR.

4.13. Customer company account data and contact persons

• Data: company name and details; name, job title, work phone and email of the contact persons and the administrator; billing details; correspondence with us.
• Purpose: concluding and performing the contract, billing, support, notices of changes and incidents.
• Controller: Octavox. Legal basis: for contact persons — legitimate interest (point (f)); where the customer is a natural person or a sole trader who signed the contract personally — in respect of that person, also the performance of the contract (point (b)); for accounting documents — legal obligation (point (c)) under Article 121(1) of the Bulgarian VAT Act and Article 38(1) of the Bulgarian Tax and Social Security Procedure Code.

4.14. Support requests

• Data: whatever you send us — a description of the problem, screenshots, extension number, time of the problem; technical logs, if we request them.
• Purpose: to solve your problem.
• Controller: Octavox. Legal basis: legitimate interest (point (f)) — to solve the problem you contacted us about.
• The “Feedback” button in the app: the button is part of the manufacturer's app. We have not received confirmation as to whether what is sent through it reaches us or the platform manufacturer (China). Until that is confirmed, assume that the content of the feedback may reach the manufacturer. If you want to be sure that you are writing to us, send your message to info@octavox.eu.

5. Our legitimate interests

In one sentence: where we say “legitimate interest”, we mean precisely the following.

“Legitimate interest” means an interest of ours that is justified and that we have weighed against your interests, rights and freedoms. When we process on the basis of Article 6(1)(f) GDPR, our interests are:

1. Security of the service — protecting the PBXs from unauthorised access, telephone fraud (toll fraud) and abuse; investigating incidents.
2. Stability of the app — detecting and fixing crashes and errors.
3. Delivering incoming calls — the notifications, without which the app cannot “wake up” your phone.
4. Communication with our customers — contact with administrators and contact persons at customer companies.
5. Billing and protection in disputes — keeping the minimal set of traffic data (section 4.2) for billing under the contract with your company, which is for a minimum of 12 months, and for resolving disputes over invoices during its term; keeping the contractual documentation.
6. Improving the service — aggregated usage statistics (with the limitation in section 4.9: today there is no setting to refuse or to consent).
7. Support — solving the problems you write to us about (section 4.14).

For each of these, we have assessed that the processing is necessary and that your interests, fundamental rights and freedoms do not override it. You have the right to object (section 11); we will then stop the processing unless we have compelling legitimate grounds that take precedence.

6. Who else sees the data

In one sentence: besides us and your employer, the categories of provider listed below have access to the data — each with a role and a country.

The full list of recipients, with the country for each, is set out in the Data Processing Agreement your company has signed with us. Ask your company's administrator for it, or write to info@octavox.eu — we will tell you the countries and the basis for the transfer.

Our PBX runs on our own servers in Sofia, not on the manufacturer's hosting.

This list is not complete against the contents of the app. In the package itself we also find the crash-reporting provider and the notification channels of the phone manufacturers, which do not appear in the manufacturer's list. We sent a written enquiry to the manufacturer on 17 September 2026 and received a reply on 21 September 2026: in its new list of 30 July 2026 the crash-reporting provider and the notification channels of the phone manufacturers are still missing. Which libraries other than the voice-call library and Firebase Cloud Messaging are active — the question remains open; we will update this text if we receive confirmation.

The composition of the libraries in the iOS version (9.5.34) has not been confirmed to us in writing by the manufacturer. The list for iOS is not confirmed; notifications to iPhone pass through Apple (APNs). Until it is confirmed, assume that for the rest the same set of providers applies to iOS as to Android, insofar as the features are the same.

We do not sell data. We do not pass it to advertising networks for advertising purposes. The only thing we are still checking is the advertising identifier, which Google's library may collect by default (section 4.11). We may disclose data to public authorities when the law requires us to.

7. Data that leaves the EU

In one sentence: recordings, voicemail, call history and your account data are stored in Bulgaria; voice passes through our servers in real time and is not kept; technical data goes to the USA; the internal chat is stored for one year in China, and call notifications pass through China; for video conferencing — a separate provider, below.

What is stored in Bulgaria: recordings, voicemail, call history, traffic data, the company directory and your account data. Voice and video pass through our servers in real time and are not stored, unless recording is enabled (section 10). Our servers are in a data centre in Sofia, Bulgaria. Connections to the carriers run over private lines within Bulgaria.

That applies to storage. In transit there are exceptions: for every incoming call, the caller's number and name and the PBX serial number pass through the platform manufacturer's relay (section 4.10), and the manufacturer has remote access to our servers for support. Both are transfers to China, described below.

USA (Google LLC): notification codes, diagnostics, statistics, approximate location derived from the IP address. Google is certified under the EU-US Data Privacy Framework, for which the European Commission has issued an adequacy decision. In addition, the Commission's Standard Contractual Clauses (SCCs) apply.

USA (Apple): notifications to iPhone pass through Apple (APNs) — notification code, caller's number and name, PBX serial number. Certification under the EU-US Framework and the applicable Apple entity are verified under the Apple Developer Program License Agreement (Team ID Y3XNUA4SWN).

China. China has no adequacy decision from the European Commission — the law there has not been recognised as equivalent to the GDPR.

• The platform manufacturer and the messaging service provider (the chat): the basis is the EU's approved model contract (the Standard Contractual Clauses). The manufacturer expressly names Module 2 (for the data for which we are an independent controller) and Module 3 (for the data we process on behalf of the customer company) in its data processing agreement of 30 July 2026, incorporated in it by reference. A signed copy with completed annexes and a designated supervisory authority does not yet exist — the question remains open; we will update this text if we receive confirmation. The clauses oblige the manufacturer, and the messaging service provider, which is bound through it, to protect your data under European rules. A copy is available on request at info@octavox.eu.
• The crash-reporting provider and the notification channels of the phone manufacturers: these components are in the manufacturer's app, but they are not included in the manufacturer's list of sub-processors. For them, as at the date of this version, we have no confirmed legal basis for the transfer. We sent a written enquiry to the manufacturer on 17 September 2026 and received a reply on 21 September 2026: in its new list of sub-processors of 30 July 2026 these components are still missing; for the notification channels the manufacturer stated (by email, not in a contract) that they are not activated on devices with Google services; whether the crash-reporting provider is active — the question remains open; we will update this text if we receive confirmation. If no basis is provided, we will ask for the components to be disabled or removed from the app and we will reflect that here; when that can happen depends on the manufacturer, because the app is built by them.
• The manufacturer's remote support access to our servers is also a transfer — it takes place under the same clauses and is limited to support cases.
• According to the manufacturer, the connection to the messaging service provider can be disabled if the internal chat is not used; in that case, no data is sent to it.

Hosting of the manufacturer's components. This is processed in several countries, some of them outside the EU; the basis is the standard contractual clauses under the manufacturer's agreement. Our PBX does not run on that hosting.

Video conferencing — only if the feature is enabled for your company's PBX. The video conferencing provider processes data in several countries. Some of these are in the EU or covered by an adequacy decision; others are not. The full list of those countries is set out in the Data Processing Agreement your company has signed with us; ask your company's administrator for it, or write to info@octavox.eu — we will tell you the countries and the basis for the transfer. We have not been told which one serves European customers. We are clarifying that with the manufacturer, together with whether the component is active in our version at all, and we will update this section with the answer. The feature can be disabled, in which case no data is sent to that provider.

How to obtain a copy of the safeguards: write to info@octavox.eu. We will provide you with a copy of the applicable Standard Contractual Clauses (commercial information may be redacted).

8. How long we keep data

In one sentence: every category of data has a retention period, after which it will be deleted.

These are the periods we have adopted and to which we are bringing the PBX's automatic clean-up settings and the settings on our servers — for each PBX individually, with the exception of the diagnostics from the app, which are not on our servers. The platform's factory default is “no limit”, so the period is set explicitly for each PBX; we will note here when this has been done for all PBXs. You can check the actual values for your company's PBX with your administrator or with us at info@octavox.eu.

9. What the app does on your device

In one sentence: the app contains built-in third-party libraries — here is the list, what they are for and whether you can do without them.

The list for Android (version 5.27.15) was established from the installation package itself:

What you can switch off yourself: the device permissions (microphone, camera, contacts, notifications) — in your device settings. The chat — only your company's administrator, at PBX level. Diagnostics and statistics — there is no such setting in the app today. The advertising identifier you can reset or disable in your Android settings (section 4.11).

Permissions. The app requests the following permissions from the operating system:

• microphone — for voice calls;
• camera — to scan the sign-in QR code, and for video calls and video conferences if the feature is enabled;
• contacts — to show names for calls and make dialling easier (section 4.7);
• notifications — so that your phone rings on an incoming call when the app is closed (section 4.10);
• on Android — also ACCESS_ADSERVICES_AD_ID (advertising identifier), which we do not use (section 4.11).

You can view and manage the permissions you have granted at any time in your device settings. Refusing some of them will limit the corresponding feature.

Local data: the app keeps a local database and settings on the device, which also hold your login and session data. We are clarifying with the manufacturer exactly how the password and the tokens are protected on the device and whether the local database is encrypted; we will update this page. Until then, the best protection is a screen lock on your phone (section 13).

iOS (version 9.5.34): the manufacturer has not yet provided us with the full list of built-in libraries. The list for iOS is not confirmed; notifications pass through Apple (APNs). The table will be completed.

10. Call recording

In one sentence: recording is your company's decision and responsibility, not ours, and it requires a legal basis and notification of the participants under the GDPR; the prohibition in Article 246(1) of the Bulgarian Electronic Communications Act applies to a person other than the parties to the call.

• The PBX has a call recording feature. It is off until your company's administrator turns it on — for individual extensions, queues or the whole company. We do not enable recording on our own initiative. Whether recording is enabled for your company, and whether an announcement is played at the start of the call, depends on your company's settings — ask your administrator.
• The law is unequivocal. Under Article 246(1) of the Bulgarian Electronic Communications Act, recording a call by a person other than the sender and the recipient without the express consent of both is prohibited, except in the cases provided for by law. Under the GDPR, a recording is processing of the personal data of every participant.
• Therefore, the customer company that enables recording is obliged: to inform both its employees and the external persons they talk to (for example, by a voice announcement at the start of the call); to determine the legal basis for the recording under Article 6 GDPR in respect of all participants; where that basis is consent — to obtain it in a way it can prove, with the possibility to refuse (for example, by hanging up before the recording starts) and to withdraw (Article 7 GDPR); in respect of its own employees, as a rule, to rely on a basis other than consent; and to define the purpose and who has access to the recordings.
• Our role: we store the file on our servers in Bulgaria with a target period of 30 days (section 8); we are bringing the settings of all PBXs into line and will note in section 8 when this has been done. Your company's administrator has access to the recordings through their admin panel. Our staff do not listen to the recordings; their access to the files is limited to technical support at the customer's request.
• If you believe a call with you was recorded without your consent, contact the company you were talking to, or contact us (section 15) — we will notify the customer.

11. Your rights and how to exercise them

In one sentence: you have the right to know, correct, delete and restrict your data — and to complain if we have not responded to you.

Under Articles 15–22 GDPR, you have the right:

• of access — to find out what data we hold about you and to receive a copy;
• to rectification — to correct inaccurate data;
• to erasure (the “right to be forgotten”) — where one of the grounds in Article 17(1) GDPR applies; see which data remains and why in section 8;
• to restriction of processing;
• to data portability — to receive the data you have provided to us in a machine-readable format, where we process it on the basis of your consent or of a contract with you and the processing is carried out by automated means;
• to object to processing based on legitimate interest (section 5);
• to withdraw your consent at any time where we process on the basis of consent; this does not affect processing carried out before the withdrawal;
• not to be subject to a decision based solely on automated processing that significantly affects you — put simply: a computer does not take decisions about you on its own; we do not make such decisions.

How: write to info@octavox.eu or to the postal address in section 15. We may ask to verify your identity (for example, through your company's administrator).

Response time: we respond within one month (Article 12(3) GDPR). For complex or numerous requests, this period may be extended by a further two months — we will tell you why, within the first month. If we refuse to act on a request, we still reply within one month — with the reasons, and stating your right to lodge a complaint with the CPDP and to seek a judicial remedy (Article 12(4) GDPR).

If the right concerns data controlled by your employer (calls, recordings, chat, voicemail, call history, directory), we will refer you to them and notify them — see section 3. They decide; we carry out their instruction. If they decide that the data must remain, the decision and the reasons for it are theirs — you can challenge them with your employer or lodge a complaint with the CPDP.

Account deletion: the steps are described at https://octavox.bg/en/delete-account.

• How: you contact your company's administrator, or you send a request to info@octavox.eu — we notify the administrator and carry out their instruction; if they do not object within 10 working days, that is their instruction and we delete — within 30 days of the request.
• What is deleted: the profile and the extension, voicemail, recordings and the notification code (push token) — from our servers. What exactly remains after an extension is deleted in the PBX and in the chat platform — we asked the manufacturer in writing on 17 September 2026; its reply of 21 September 2026 gives no answer and the question remains open; we will update this text if we receive confirmation.
• The internal chat: the chat account is deactivated together with the extension; for the messages and files stored at the manufacturer's provider, we have no confirmed mechanism and no confirmed result (section 8). The messages and attachments themselves are stored at the messaging service provider (China) for one year — a period communicated to us in writing by the manufacturer on 21 September 2026, which does not appear in any contractual document; there is no mechanism for a shorter period or for deletion per PBX (section 8).
• Backups: data deleted from the live system may remain in a backup until that backup is overwritten (section 8). We have no procedure for selectively deleting individual data from a backup that has already been made.
• What remains and for how long: the minimal set of traffic data for billing and security (12 months — the contract with your company is for a minimum of 12 months and the data is needed for billing and for disputes over invoices during it), the security logs (6 months) and the documents (invoices — 5 years after the expiry of the limitation period for VAT, in practice 10 years, Article 121(1) of the Bulgarian VAT Act and Article 38(1)(3) of the Tax and Social Security Procedure Code; contract — 5 years under Article 38(1)(4) of the Tax and Social Security Procedure Code, thereafter until the expiry of the limitation period under the Obligations and Contracts Act) — for the periods in section 8. The call history in the PBX is deleted on your company's instruction.

Complaint: if you believe we are infringing your rights, you can lodge a complaint with the supervisory authority:

Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, email kzld@cpdp.bg, website www.cpdp.bg.

We would appreciate it if you contacted us first — we usually resolve the matter faster.

12. Data about people who are not our users

In one sentence: if you call a company that uses Octavox, or you are in its directory, some of your data passes through our servers.

This concerns:

• External callers and dialled external numbers — phone number, date, time and duration of the call (call data); voice in real time; voicemail, if you leave one; a recording, if the company has enabled recording (section 10).
• Conference participants — number and voice/video for the duration of the conference.
• Contacts in the company directory — name, number, job title, if the company's administrator has entered them.
• Contacts from an employee's phone — they do not leave that employee's device; the app reads them only locally, to show a name for a call (section 4.7).

The controller of this data is the company that uses Octavox — it decides why it processes the data and must inform you — under Article 13 GDPR already during the call, where the data comes from you (number, voice, voicemail), for example by a voice announcement or in its own privacy policy; under Article 14 GDPR, where it has entered you in its directory from another source. We are the processor. If you contact us, we will refer you to that company and notify it.

One exception: for the minimal set of traffic data (number, date and time, duration, PBX — section 4.2), which we keep for 12 months for billing under the contract with the company (a minimum of 12 months), for disputes over invoices and for security, we are the controller and you can exercise your rights directly with us (section 11).

The retention periods are those in section 8.

13. Security

In one sentence: we store the PBX data in Bulgaria — with the exceptions in section 7 (chat, notifications, diagnostics, video conferencing); our servers support an encrypted connection, access is restricted — and we do not promise more than has been verified.

• Where: our own infrastructure in a data centre in Sofia, Bulgaria.
• Connection app ↔ our servers: our servers support an encrypted connection — encryption of the same kind that banks use online. Whether the app actually uses that encrypted channel for both signalling and voice depends on a platform feature that is not yet enabled. Until this is verified by capturing the traffic, we do not guarantee encryption of the voice media between the app and our servers, and we will update this page once we have confirmed it.
• Within our infrastructure and towards the carriers: traffic runs over private lines that do not pass through the public internet. This is the standard of all three carriers and is not under our control.
• Access: only our authorised staff have access to the servers; the platform manufacturer has remote access for platform support (section 7). Access is recorded in the security logs (section 4.12).
• Incidents: as a processor, we notify the customer company without undue delay after we become aware (Article 33(2) GDPR); under our contract with the customer company we undertake to notify it within 48 hours. For the data for which we are the controller, we notify the CPDP without undue delay and, where feasible, not later than 72 hours — and where later, with the reasons for the delay; we notify you where there is a high risk (Articles 33 and 34 GDPR).
• On your device: protect your phone with a screen lock. If it is lost, notify your administrator so that your extension can be suspended.

14. Children

In one sentence: the app is not for children.

Octavox is a work tool for company employees. It is not intended for persons under 18 and we do not knowingly collect data about children. If we learn that an account has been created for a child without justification, we will notify the customer company. If a child calls a company that uses Octavox, the child's data is processed like that of any other external person (section 12); the company is the controller.

15. How to contact us

In one sentence: for anything related to this policy, write to info@octavox.eu.

• Data protection email: info@octavox.eu
• Postal address for correspondence: Preventa DDDD EOOD (Octavox), 46 Pop Gruyo St., Sofia, Bulgaria
• Registered office: Sofia 1582, Druzhba district, block 214, entrance B, floor 1, apt. 29, Bulgaria
• Website: https://octavox.bg/
• Account deletion: https://octavox.bg/en/delete-account
• Terms of Use: https://octavox.bg/en/terms

Data Protection Officer: we have not appointed one; the contact point for all data protection questions is info@octavox.eu.

16. Changes to this policy

In one sentence: when we change the policy, you will see a new version and date here, and earlier versions remain available.

For material changes, we will notify customer companies by email; they notify their employees. The date and the version number are always at the top of this page. Today, on first login the app shows the manufacturer's policy. We sent a written enquiry to the manufacturer on 17 September 2026 and received a reply on 21 September 2026: the policy shown is controlled by a platform setting and can be replaced with this one without a new version of the app. We will note here when the replacement has been made. Once it has, your confirmation of this policy in the app will certify that you have read it (information under Articles 13 and 14 GDPR); until then, the policy is published on this page and your company provides it to its employees. The confirmation is not consent to processing. Device permissions (section 4.7) are granted through the operating system. Where the law requires consent, we will ask for it separately and specifically; today the app offers no such option for the identifiers on your device or for the advertising identifier (sections 4.8, 4.9, 4.11) — we will update this page when the manufacturer adds one.

New purpose. If we ever decide to process data for which we are the controller for a purpose other than those described here, we will inform the customer companies beforehand — they inform their employees; for external persons whose traffic data we keep for our own purposes (section 12), the change will be published in advance on this page, which is our channel to them — and we will reflect the change in a new version of this page; where the law requires it, we will ask for consent.

Every version has a number and a date. Version history:

↑ Back to top