Terms of Service for the Octavox App

Version: 1.2 · Date: 24 September 2026 · Address of this document: https://octavox.bg/en/terms

Publisher: Octavox (Preventa DDDD EOOD), UIC 201690143, registered seat: Sofia 1582, Druzhba residential district, block 214, entrance B, floor 1, apartment 29, Bulgaria. The service is offered under the Octavox brand. Referred to below as “Octavox”, “we” or “us”.

In brief

• Octavox is a cloud phone system that your company uses under a contract with us. The Octavox app is the work phone that goes with it.
• Your account (your extension) belongs to the company, not to you. It is created, suspended and deleted by your company's administrator.
• Your company's administrator may have access to data about your calls (who called whom, when and for how long), to recordings, voicemail and chat — under the company's own rules.
• A minimal set of technical traffic data (numbers, date and time, duration) is kept by us for 12 months — the minimum term of your company's contract with us: for billing under it, for resolving disputes about the invoices during its term, and for security.
• Do not rely on the app for emergency calls. Use the ordinary telephone network on your phone.
• Keep your password safe. The cost of a compromised account is borne by the customer company under its contract with us.
• How we process personal data is set out in the Privacy Policy: https://octavox.bg/en/privacy.

1. What the service is

1.1. A cloud phone system under a contract with your company

Octavox is a cloud phone system (Cloud PBX). We provide it to customer companies under a written contract. Your company (your employer, or whoever engaged you) is such a customer.

The contract between your company and us governs the scope of the service, the prices, liability and the processing of data. These Terms govern your use of the mobile app as an end user. In the event of a conflict, the contract prevails as regards the customer company.

1.2. The app is a client for the phone system

The Octavox mobile app (Android: com.octavox.mobile; iOS: App ID 6791456780) is a work phone in an app (a softphone). It connects to your company's phone system and gives you access to its features: voice calls, internal chat with photos and files, voicemail, call recording (if the administrator has enabled it), the company directory, conferences, call transfer and hold, video calls and video conferences (if the feature is enabled for the phone system), and, on iPhone, CarPlay.

Which features are available to you is decided by your company's administrator. The app does not work without an active account on the phone system of a customer company.

The phone system runs on our own infrastructure in Bulgaria.

1.3. Phone numbers and carriers

Your company's phone numbers are provided by a telecommunications carrier (for example A1, Yettel or Vivacom) under a contract concluded directly between the carrier and your company. The carrier routes the numbers to our infrastructure.

We are a provider of a cloud phone system — a software service. We are not a party to the contract between your company and the carrier. The telephone service and the numbers come from the carrier.

1.4. The manufacturer's documents in the app

On first login the app may display a document of the platform manufacturer (for example a “Privacy Policy Agreement”). Whatever document that screen shows, your relationship with us is governed by these Terms and by our Privacy Policy at https://octavox.bg/en/privacy.

2. Who may use the app

• The app is only for employees and other people to whom a customer company with a contract in force with us has issued an account. It is not intended for children.
• There is no sign-up in the app. You cannot create an account yourself. The account (an extension) is created by your company's administrator.
• To log in you need the phone system domain, a username and a password. You receive them from the administrator.
• By logging in and using the app you accept these Terms. If you do not agree with them, do not use the app and speak to your company's administrator.

3. Whose account it is

3.1. The account belongs to the company

The extension and the account associated with it belong to your company, not to you personally. The company decides how the account is to be used and who has access to it.

3.2. What the administrator can do

Your company's administrator may at any time, without any involvement on our part:

• create, suspend or delete your account;
• reset your password and change the settings of the account;
• turn features on and off (for example call recording, chat, video);
• reassign the extension to someone else.

We act on the instructions of the company's administrator. We cannot restore access that the administrator has suspended.

3.3. When you leave the company

When your employment or other engagement with the company ends, the administrator terminates your access. From that moment you can no longer log in to the app. The data in the account is processed under the company's own rules and within the periods set out in section 12.

3.4. If you want your account deleted

There are two routes:

1. Speak to your company's administrator. The administrator can delete the account directly.
2. Submit a request through https://octavox.bg/en/delete-account or to info@octavox.eu. We notify your company's administrator and act on the administrator's instruction. We give the administrator 10 working days to object. If the company does not object, we delete the account within 30 days of the request and confirm to you in writing what we have deleted, what is kept (section 12.2) and on what date.

Exactly what is deleted and what is kept is set out in section 12.

If the company objects (for example because the number needs to remain active), we will tell you so and refer you to the company. Your company is the controller of this data and we process it on the company's behalf.

3.5. You cannot transfer the account

You may not give your account to anyone else. Only the administrator may reassign extensions.

4. What your company's administrator can see

4.1. A work tool, not a personal phone

The app is a work tool. Content that you might otherwise consider private may be accessible to your company's administrator. How far this goes depends on the settings of the phone system and on your company's internal rules. Ask the administrator what the rules are where you work.

If you install the app on a personal phone, that does not change the work-related character of the data in it.

4.2. What the administrator may have access to

Depending on the settings, the administrator may have access to:

• the call history in the phone system (known as the CDR) — who called whom, when, and how long the call lasted;
• call recordings — if the feature is enabled for your extension;
• voicemail — the messages in your mailbox;
• the company directory and your availability status;
• the internal chat — the messages and files you send through the app. Whether the administrator can see the content of the chat depends on the platform; we have no confirmed ability to do so (section 6.3). Even so, work on the basis that the content of the work chat may be accessible to your company, and do not use it for personal correspondence.

4.3. Call recording

Recording is your company's decision and your company's responsibility. The company must inform the participants in the call and obtain their consent, for example by means of a voice announcement at the start. Under Article 246(1) of the Bulgarian Electronic Communications Act, the recording of a call by a person other than the sender and the recipient without the express consent of both is prohibited, save in the cases provided for by law.

Whether recording is enabled for your extension, and whether an announcement is played at the start of the call, depends on the settings your company has made. Ask the administrator.

We only store the recording for the period set out in section 12 and make it available to the company's administrator.

4.4. Our own access

Our access to your company's data is limited to technical support, security and performance of the contract with the company. The platform manufacturer has remote access for support, governed by contract. Details are in the Privacy Policy.

5. Emergency calls

Do not rely on the app for emergency calls. The app is not a substitute for an ordinary telephone service. We do not guarantee that 112 or any other emergency number can be dialled through it.

• Whether and how 112 (and the other emergency numbers) can be dialled through the phone system depends on your company's contract with its telecommunications carrier, on the settings of the phone system and on the network. We give no undertaking that such a call will be connected.
• The app only works when you have a working internet connection, a charged phone and a reachable phone system. If the power, the internet or the service is interrupted, a call through the app is not possible.
• On a call made through the app, the emergency services may not receive your exact location, or may see a company number instead of yours.
• In an emergency, use the ordinary mobile network on your phone (the standard phone app) or a landline.

6. Rules of use

6.1. What is allowed

Use the app for the work purposes set by your company, in accordance with the law and with the company's internal rules.

6.2. What is prohibited

The law

• using the service in breach of the law, including for fraud, threats, harassment or unsolicited marketing calls;
• automated bulk dialling (robocalls), bulk messaging or similar automated activity, unless this is expressly agreed in your company's contract and is lawful;
• falsifying the caller identification (Caller ID) in order to mislead;
• recording calls without the consent of the participants.

Access and passwords

• reselling, leasing or otherwise giving third parties access to the service;
• using someone else's account or giving yours to another person;
• circumventing, probing or defeating the protections of the app, the phone system or our network, including searching for vulnerabilities without our written consent;
• overloading the service or disrupting it for other customers.

Content

• distributing recordings, voicemail or chat messages in breach of the law or of the company's rules;
• sending through the chat any unlawful, offensive or harmful content, malicious code, or material in which you hold no rights.

6.3. Content in the chat

You are responsible for the content you send through the internal chat. If you receive inappropriate content, speak to your company's administrator — they are the first point for such reports (section 8.5). We have no procedure for reviewing other people's chat messages and no confirmed ability to view or preserve an individual message — the chat runs on the platform of the messaging service provider (section 10.3). At info@octavox.eu we answer questions about personal data.

6.4. Consequences

In the event of a breach, your company's administrator or we may suspend your account temporarily or permanently. Where we identify a suspicion of a criminal offence or of fraudulent traffic, we notify your company, and the competent authorities where the law obliges us to do so. We do not monitor the content of the chat and do not guarantee that every breach will be noticed.

7. Fraudulent traffic and password security

7.1. Keep your password safe

• Your password is personal. Do not share it with anyone, including colleagues.
• Use a strong password and change it when the administrator asks you to.
• Lock your phone (PIN, fingerprint or face).
• If your phone is lost or stolen, if you suspect that someone else has gained access, or if your password may have leaked, notify your company's administrator immediately. The administrator can suspend the account and change the password.

7.2. Who pays if an account is compromised

If someone steals your password or hacks your phone and calls premium-rate numbers at your expense, this is “toll fraud”. The cost of such traffic, including the telecommunications carrier's charges, is borne by the customer company under its contract with us and with the carrier.

Whether and how the company then seeks to recover those costs from you is a matter for your relationship with the company, not for these Terms.

7.3. What we can do

Where we suspect fraudulent traffic or a breach, we may restrict or suspend your account even without prior notice, in order to protect your company and the service. We notify the company's administrator. We do not guarantee that every abuse will be detected or stopped in time.

8. Availability and support

8.1. No guarantee of uninterrupted service

We aim to keep the service running at all times, but we do not guarantee uninterrupted access or freedom from errors. The service level for your company, where one has been agreed, is set out in its contract with us.

8.2. Planned maintenance

We may take the service down for planned maintenance and updates. We notify your company's administrator in advance where this is possible. If your company's contract sets out a procedure and a notice period for such notifications, the contract prevails.

8.3. What the service depends on

How the app works depends on things outside our control:

• your internet connection (Wi-Fi or mobile data) and its quality;
• your device, its operating system and its battery-saving settings;
• the telecommunications carriers of your company and of the other party;
• the notification services of Google and Apple, the platform of the manufacturer, and the third-party platforms described in the Privacy Policy;
• the Google Play and Apple App Store app stores.

Incoming-call notifications on Android are delivered only through Google's Firebase Cloud Messaging — the platform manufacturer supports only that channel for the branded app (confirmed in writing on 21 September 2026). On phones without Google services, incoming calls do not arrive as a notification when the app is closed.

8.4. Updates

We may release new versions of the app. New versions are built and signed by the platform manufacturer; we publish them in the app stores once we receive them from it. Some updates may be mandatory if you are to continue using the service. Older versions may stop working. The app is updated through Google Play or the App Store.

8.5. Who to turn to

Your first point of support is your company's administrator. We support the administrator in accordance with the contract with the company. On questions about personal data you may write to us directly at info@octavox.eu.

8.6. App stores

The app is distributed through Google Play and the Apple App Store. Those stores' rules also apply to you. Google and Apple are not parties to these Terms and are not responsible for supporting the app.

9. Intellectual property

9.1. The software is licensed

The software of the app, including the code, the design and the documentation, is owned by the platform manufacturer and/or its licensors and is licensed to us. The Octavox brand, name and logo are our property.

The app also contains third-party components with their own licences. Those components are governed by the terms of the respective licences.

9.2. What you receive

You receive a limited, non-exclusive, non-transferable and revocable right to install and use the app on your own device, solely in order to access your company's phone system, for as long as your account is active. You acquire no rights in the software.

9.3. What is prohibited

You may not copy, modify, decompile, disassemble, extract the source code of, create derivative works from, or remove copyright notices from the app, except to the extent that a mandatory provision of law expressly permits you to do so.

10. Privacy

10.1. Privacy Policy

How we process personal data is set out in the Privacy Policy at https://octavox.bg/en/privacy. It forms part of your relationship with us. Only the essentials are given here.

10.2. Who is responsible for what

• Your company is the controller of the data about calls, recordings, voicemail, chat, the call history in the phone system (who called whom, when and for how long), the company directory and the data about its own employees. We process that data on the company's behalf as a processor — under a contract and a data processing agreement. We keep the call history on the company's instruction, by default for 12 months.
• We are the controller of: the minimal set of technical traffic data kept for billing, security and the resolution of disputes (numbers, date and time, duration, which phone system the call passed through — no content); the data of the customer company and of its contact persons; security and access logs; the diagnostics from the app (crash reports, usage statistics); the code by which your device receives notification of an incoming call (the push token); and support.

We keep the traffic data for 12 months from the date of the call. The period follows the contract with the customer company, which is concluded for a minimum of 12 months: the data is needed for billing under it and for resolving disputes about the invoices during its term. Basis: our legitimate interest in billing and in defending against disputes (Article 6(1)(f) GDPR); for the invoices themselves — a legal obligation under the Bulgarian VAT Act and Tax and Social Security Procedure Code (point (c)); where the customer is a natural person or a sole trader who signed the contract personally — in respect of that person, also point (b).

10.3. Third parties

The app and the phone system use third-party services:

• Google (USA) — notifications, crash reports, usage statistics;
• the platform manufacturer (a company established in China) — the platform, support, relaying call notifications;
• the messaging service provider (China) — the internal chat platform;
• the manufacturer's app also contains components of a provider of crash reports and of a local database (China), as well as the notification channels of the phone manufacturers (China). These components are present in the app package. The manufacturer confirmed in writing on 21 September 2026 that for the branded app it supports only notifications through Firebase Cloud Messaging and that the notification channels of the phone manufacturers are not activated on devices with Google services — that assurance was given by email, not in a contractual document. Which of the remaining components are active in our version, the manufacturer's reply of 21 September 2026 does not say; we will update this text if we receive confirmation (see the note at the end of this section);
• video conferencing — the app package contains a component of a video conferencing provider. Whether the component is active in our version, and which country serves European customers, has not been confirmed to us by the manufacturer (see the note at the end of this section).

China has no adequacy decision from the European Commission — its law has not been recognised as equivalent to the GDPR. For the United States the legal position on transfers depends on whether the particular provider is certified under the EU–US Data Privacy Framework.

The list of recipients, with the country for each of them so far as it is known to us, is set out in the Data Processing Agreement — an annex to the contract between your company and us, signed together with it. Ask your company's administrator for it.

• For the platform manufacturer and the messaging service provider we rely on the EU standard contractual clauses (Module 3 for the data we process on behalf of the customer company; Module 2 for the data for which we are an independent controller), which are included in our agreement with the manufacturer; the messaging service provider is bound through the manufacturer.
• For the provider of crash reports and of a local database, and for the notification channels of the phone manufacturers, we do not at present have a confirmed legal basis for such a transfer. We sent a written enquiry to the manufacturer on 17 September 2026 and received an answer on 21 September 2026: according to the manufacturer, the notification channels are not activated on devices with Google services; for the provider of crash reports and of a local database the reply gives no information. We will update this text if we receive confirmation from the manufacturer.
• For the providers in the USA the basis is the EU-US Data Privacy Framework (DPF) or standard contractual clauses.

The internal chat runs on the platform of the messaging service provider — chat messages and files pass through it. The manufacturer confirmed in writing on 21 September 2026 that chat messages and files are stored at the messaging service provider (China) for one year; that period was communicated in a letter and does not appear in any contractual document. In its agreement of 30 April 2026 the manufacturer states in writing that files may be stored unencrypted at that provider (data in transit is protected with TLS). There is no mechanism for a shorter period or for deletion per individual phone system. The chat can be disabled for your company's phone system by its administrator.

Note to this section (as at 24 September 2026): we sent the questions above to the manufacturer in a written enquiry on 17 September 2026 and received an answer on 21 September 2026. Answered: the period and conditions of storage of the chat (above); the device's address book is never uploaded to a server (section 10.4); for the branded app only notifications through Firebase Cloud Messaging are supported, and the notification channels of the phone manufacturers are, according to the manufacturer, not activated on devices with Google services (by email, not in a contract). Unanswered remain: which components other than the voice library and Firebase Cloud Messaging are active in our version; what remains after an extension is deleted — in the phone system and on the notification relay (for the messaging service provider the answer is clear: one year, with no deletion per phone system); which country serves European customers for video conferencing. On these three questions the reply of 21 September 2026 gives no information. We will update this text if we receive confirmation from the manufacturer.

The purposes and the safeguards applied to transfers are set out in the Privacy Policy. The list of third parties there reflects what we have established as at the date of this version and is being added to.

10.4. Device permissions

The app asks for permissions (for example microphone, camera, contacts, notifications) in order to work. What each of them is used for is described in the Privacy Policy. If you do not want the app to process data from your device's address book, do not grant the contacts permission. The address book does not leave the device: the app reads it locally only, in order to show a name when a call comes in, and never uploads it to a server — confirmed in writing by the platform manufacturer on 21 September 2026. That applies to the phone's address book. Separately from it, the app has “Personal Contacts”, which you enter yourself; they are kept in your company's phone system, and the administrator and other users have no access to them.

10.5. Security of the connection

The login and data connection between the app and the phone system is encrypted. Signalling and voice pass through an encrypted tunnel only if that platform feature is enabled for the particular phone system; until it is enabled and verified, we do not guarantee encryption of the voice media.

10.6. Your rights

You have the rights set out in Articles 15-22 GDPR. Write to info@octavox.eu. We reply without undue delay and within one month at the latest. Where requests are complex or numerous, that period may be extended by a further two months, of which we inform you within the first month (Article 12(3) GDPR). If we refuse a request, we reply within the same period, giving reasons and stating your right to lodge a complaint with the Commission for Personal Data Protection and to a judicial remedy (Article 12(4)). If your request concerns data for which your company is the controller, we will forward it to the company and let you know.

You may lodge a complaint with the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, kzld@cpdp.bg, www.cpdp.bg.

11. Liability and limitations

11.1. Within the limits of the law

The limitations in this section apply only to the extent permitted by law. Nothing in these Terms excludes or limits any liability that cannot be excluded or limited by law.

11.2. What we are not liable for

We are not liable for loss or damage caused by:

• interruptions or degraded quality due to your internet connection, your device or your operating system;
• the telecommunications carriers, the services of Google, Apple or the platform manufacturer, or other third parties outside our control;
• use in breach of these Terms or of the law — whether by you or by anyone else using your password;
• the inability to make an emergency call through the app (section 5);
• content that you or other users send through the chat;
• force majeure.

11.3. Indirect loss

We are not liable for loss of profit or indirect loss, to the extent permitted by law.

11.4. As regards the customer company

Our liability towards your company, including its limits, is governed by the contract with the company. These Terms create no additional rights for the company.

11.5. Your responsibility

You are responsible for the use of your account, for the content you send, and for complying with these Terms, with your company's internal rules and with the law.

12. Termination — what happens to the data

12.1. When your access ends

Your access to the app ends when:

• your company's administrator suspends or deletes the account;
• the contract between your company and us is terminated;
• you breach these Terms (section 6.4);
• you request deletion under section 3.4 and the company does not object.

12.2. Retention periods and what happens when an account is deleted

Notes on the table:

• These are the retention periods we have adopted and to which we bring the settings of each phone system and of our servers. They are set through the automatic clean-up of the phone system and of our servers. The factory setting of the phone system is “no limit”, which is why the period is set explicitly during configuration. You can check the actual values for your company's phone system with your administrator or with us.
• Internal chat: the phone system has no setting for how long chat messages are retained. The manufacturer confirmed in writing on 21 September 2026 (in reply to our enquiry of 17 September 2026) that messages and files are stored at the messaging service provider for one year, that there is no option for a shorter period or for deletion per individual phone system, and that the chat can be disabled for the phone system. The period does not appear in any contractual document. Exactly what the phone system erases when an extension is deleted — the reply of 21 September 2026 does not say. We will update this text if we receive confirmation from the manufacturer.

12.3. When the contract with the company ends

The company's data, including the call history, is returned or deleted in accordance with the contract and the data processing agreement between the company and us, subject to the periods set out above — with the exception of the internal chat, which remains at the messaging service provider until the one-year period expires (section 12.2). What remains with us is the data for which we are the controller (section 12.2), including the push token, whose erasure from the phone system has not been confirmed to us (see the row in 12.2): the traffic data for billing and security — 12 months from the date of the call (the minimum term of the contract with the company), the security logs — 6 months, the diagnostics and crash reports — 90 days, and the accounting documents — for the statutory period.

12.4. What survives termination

Sections 9, 11 and 14 remain in force after termination.

13. Changes to these Terms

• We may change these Terms. Every new version carries a number and a date and is published at https://octavox.bg/en/terms.
• Where the changes are material, we notify your company's administrator in advance by email.
• If you continue to use the app after the new version takes effect, you accept the changes. If you do not agree with them, stop using the app and speak to your company's administrator.

14. Governing law and jurisdiction

These Terms are governed by Bulgarian law. Disputes are settled by agreement and, where that is not possible, by the competent Bulgarian court at our registered seat (section 15). This does not affect rights that cannot be derogated from by law. The rights of a data subject under Article 79(2) GDPR and of a consumer under Regulation (EU) 1215/2012 remain unaffected.

Disputes between us and your company are governed by the contract with the company.

15. Contact

Preventa DDDD EOOD · UIC 201690143

• Registered seat: Sofia 1582, Druzhba residential district, block 214, entrance B, floor 1, apartment 29
• Customer office: 46 Pop Gruyo Street, Sofia
• Email: info@octavox.eu
• Website: https://octavox.bg/
• Privacy Policy: https://octavox.bg/en/privacy
• Account deletion: https://octavox.bg/en/delete-account

We have not appointed a data protection officer: our core activity does not consist of regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special categories of data (Article 37(1) GDPR). On any question about personal data, write to info@octavox.eu.

Version history

↑ Back to top