Auftragsverarbeitungsvertrag

This data processing agreement ("DPA") covers the personal data we process for you inside the PBXs you order from PBXfactory. It meets Art. 28 GDPR and is part of our terms of service: it applies to every order automatically, so there is nothing to sign. Your own account and billing data is not covered here; for that we are the controller, see our privacy policy.

1. Who is who

• You — the company that ordered the PBX — are the controller. You decide who gets an extension, what is recorded and how long data is kept.
• We — TheVoĉo, which runs PBXfactory — are your processor. Contact: [email protected].

2. What we do, and for how long

• Subject matter: hosting and operating your PBX (today: Yeastar P-Series Cloud), installing the vendor's firmware and security updates, and support.
• Duration: as long as your subscription runs, plus the 30 days after it ends until the PBX is deleted (see section 9).
• Purpose: so your users can make, receive, record and manage calls, voicemail, chat and contacts. We process the data only on your documented instructions: the settings you make in the PBX and the portal, and your support tickets. We never use it for our own purposes, never sell it and never use it for advertising.

3. Whose data, and which data

• People: your employees and other users with an extension, the people they call or who call them, and the contacts stored in the PBX.
• Data: names, extension numbers, email addresses and phone numbers; sign-in data; call records (numbers, names, times, durations, routing); call recordings; voicemail; company and personal contacts; chat messages and files; IP addresses and device data of phones and apps; operation and system logs; call statistics and agent activity.
• Special categories (Art. 9 GDPR) are not needed for the service. Recordings, voicemail and chats can still contain them if someone says them out loud. Call recording is available on every PBX; whether and what you record is your decision, and so is the legal basis for it.

4. Where the data lives

Your PBX runs on infrastructure we operate, in the region you choose at checkout. Today that is Central Europe (Vienna, Austria), so everything inside your PBX stays in the EU. The PBX software is licensed from its vendor; the vendor does not host your PBX and gets no personal data from us, only technical identifiers for licensing and updates (licence, version, instance id).

5. Sub-processors

You allow us to use these sub-processors:

• Google Cloud — hosts the PBXfactory portal, its database and its backups. Holds the administrator contact for each PBX and your portal accounts; no call data.
• Cloudflare — delivers and protects the PBXfactory website and portal.
• SMTP2Go — sends the emails we and the PBX platform send you, such as sign-in links, activation emails and notices.

We bind each sub-processor to data protection duties at least as strict as this DPA, and we stay responsible for them. Where one processes data outside the EU/EEA, the transfer is covered by an adequacy decision (including the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses.

We tell your company's owners and admins by email at least 30 days before we add or replace a sub-processor. If you have a reasonable data protection objection, tell us in that time; if we can't resolve it, you may cancel the affected subscription before the change takes effect.

Features you turn on inside the PBX that connect it to other providers — a SIP trunk, a CRM, transcription, SMS and the like — are your choice. Those providers work for you, not for us, and are not our sub-processors.

6. How we protect the data

• Access to the platform is limited to the staff who run it, each with a personal account, and everyone with access is bound to confidentiality.
• Changes made through PBXfactory are logged with who made them and when. Staff can view your portal read-only for support; they cannot act as you.
• The portal is served over HTTPS only. Sign-in is passwordless (email link, one-time code or passkey), so there are no passwords to leak. Credentials for the PBX platform are never stored in our database.
• The portal database runs isolated and is backed up every night; backups are kept for 7 days.
• We install the vendor's security updates — routine ones in announced maintenance windows, urgent fixes as soon as they are available.
• Inside the PBX your admins control users, permissions, recording and retention, and can turn on two-factor sign-in, encrypted calls (TLS/SRTP) and IP blocking.

7. Helping you

• Requests from people: if someone asks us directly about their data in your PBX, we pass the request on to you and help you answer it.
• Impact assessments and authorities: we give you the information you reasonably need for a data protection impact assessment or a request from a supervisory authority.
• Data breaches: we tell you without undue delay, and at the latest within 48 hours of becoming aware of a personal data breach affecting your data, with what we know at that point — and keep you updated, so you can meet your own 72-hour duty to report.
• Instructions we can't follow: if we believe an instruction breaks data protection law, we tell you and may hold it until you confirm or change it.

8. Audits

We give you the information you need to check that we keep to this DPA. If that is not enough, you — or an auditor bound to confidentiality who doesn't work for a competitor of ours — may inspect our compliance once a year, after at least 30 days' notice, during business hours and without disrupting the service. Each side carries its own costs, unless the audit finds that we broke this DPA.

9. At the end

When your subscription ends, the PBX is stopped. Until it is deleted you can ask us to start it again so you can export what you want to keep with the PBX's own backup feature. 30 days after the end, we delete the PBX with everything in it: configuration, users, call records, voicemail and recordings. We keep no copies, except what the law requires us to keep, such as invoices.

10. Everything else

Liability under this DPA follows our terms of service, except where the GDPR rules otherwise. If this DPA and the terms disagree on data protection, this DPA wins. We change it the same way as the terms: with notice by email.