Privacy Policy

Purpose

This policy describes the processing of personal data carried out by BREIZH VOIP in connection with this website, subscription to its services and their use. It complements the separate privacy policy for the mobile application.

Data controller

The controller for the processing described below is:

• •BREIZH VOIP, association
• •SIREN: 821039971
• •4 rue Descartes, 29480 Le Relecq-Kerhuon, France
• •Email: [email protected]. Phone: +33 2 57 52 04 32

Allocation of roles

BREIZH VOIP is the controller for managing the customer relationship: account creation, ordering, billing and support. However, for data you process through the service as part of your own activity (your staff's call logs, voicemail, recordings, internal directory), your company is the controller and BREIZH VOIP acts as processor within the meaning of Article 28 GDPR, acting solely on your instructions.

Data collected

The following categories of data are processed:

• •Identification and contact details: first and last name, email address, phone number, postal address.
• •Business data: company name, registration number, legal form, activity, establishment address, trading status and legal representatives. This information is either declared by you or obtained from the French national business registry, where it is public.
• •Billing and payment data: bank details (IBAN, BIC) for SEPA direct debit, order and invoice history, payment identifiers. Card numbers do not pass through our servers and are never stored by us.
• •Identity verification: the outcome of the check carried out by our provider (status, verified name, date, and whether it matches the legal representatives published in the registry). The identity document itself is captured and retained by the provider; we receive no copy and retain none.
• •Connection and service usage data: session identifiers, timestamps, IP address, technical logs.
• •Telephony service data: call metadata (numbers, date, duration) and, depending on the configuration chosen by your company, voicemail and call recordings.

Purposes and legal bases

Each processing operation rests on a specific legal basis:

• •Providing the service, managing the account and fulfilling the order: performance of the contract (Art. 6(1)(b) GDPR).
• •Billing, debt recovery and bookkeeping: legal obligation (Art. 6(1)(c)).
• •Identity verification prior to number allocation and porting: legal obligation applicable to electronic communications operators (Art. 6(1)(c)).
• •Support, technical assistance and customer relationship follow-up: performance of the contract and legitimate interest (Art. 6(1)(b) and 6(1)(f)).
• •Infrastructure security, fraud and abuse prevention: legitimate interest (Art. 6(1)(f)).
• •Sending commercial information and newsletters: consent, collected separately and revocable at any time (Art. 6(1)(a)).

Recipients and processors

Your data is not sold, transferred or used for advertising purposes. It is accessible to:

• •Authorised BREIZH VOIP staff, within the limits of their duties.
• •OVH, which hosts in France the servers on which the service runs.
• •Stripe, for processing card payments.
• •Stripe, for the identity verification required before opening a line: the identity document is captured and retained by Stripe, under its own policy, and never by BREIZH VOIP. You may ask us to have it erased at that provider.
• •GoCardless, for setting up and executing SEPA direct debit mandates.
• •Pennylane, for issuing and retaining invoices and for bookkeeping.
• •Google Cloud, where your company enables assisted voice features: the audio of a voicemail or a call is sent for transcription, text is sent for speech synthesis, and exchanges with the phone assistant are processed by a language model. These transfers only occur where the relevant feature is enabled.
• •Google (Firebase Cloud Messaging) and Apple (APNs), to deliver incoming-call notifications to your devices: they receive the device token and the fact that a call is intended for you.
• •Google or Microsoft, where you connect your calendar to the phone assistant, limited to what you authorise at that point.
• •Partner operators and carriers, for routing calls and porting numbers, strictly as necessary.
• •Judicial or administrative authorities, upon lawful request.

Hosting and location

The servers on which the service runs are hosted in France, at OVH, and administered by BREIZH VOIP. Some of the processors listed above (in particular for payment, identity verification and assisted voice features) may process data outside the European Union. Those transfers are framed by the safeguards of Chapter V GDPR: an adequacy decision where one exists, failing that the European Commission’s standard contractual clauses.

Retention periods

Data is not kept beyond what is necessary for the purpose pursued or required by law:

• •Account and service configuration data: for the duration of the contract, then deleted or anonymised.
• •Account holder's civil identity data: five (5) years from the end of the contract's validity, under French decree no. 2021-1362 of 20 October 2021.
• •Other information provided on subscription: one (1) year from the end of the contract or closure of the account, under the same decree.
• •Invoices and accounting records: ten (10) years from the close of the financial year, under Article L123-22 of the French Commercial Code.
• •Identity verification outcome: retained under the same conditions as the civil identity data above. The document itself is not retained by BREIZH VOIP but by the provider that checked it, under its own retention policy.
• •Traffic and connection data: retained for one (1) year, under the retention obligations imposed on electronic communications operators.
• •Call recordings and voicemail: according to the periods set by your company in the service configuration, your company being the controller for that content.
• •Prospecting data: three (3) years from the last contact, or until consent is withdrawn.

Cookies and local storage

This site uses neither advertising cookies nor third-party analytics trackers. Only mechanisms strictly necessary for the service are used, in particular keeping your session while you are signed in to your customer area, and these are therefore exempt from prior consent under Article 82 of the French Data Protection Act.

Security

BREIZH VOIP implements appropriate technical and organisational measures: encryption of data in transit, per-customer data segregation, access control and logging of sensitive operations, strengthened authentication for administration accounts. Passwords and authentication secrets are never stored in clear text.

What you must provide, and what happens if you do not

Not all data is optional, and the consequence of refusing differs from case to case:

• •Identity, contact details and business data: necessary to enter into and perform the contract. Without them, the order cannot proceed.
• •Verification of the legal representative’s identity: required by the regulations applicable to electronic communications operators. Without it, no phone line can be opened and no number allocated. The rest of the services remain available.
• •Bank details: necessary to collect instalments. Without them, the subscription cannot be activated.
• •Consent to marketing: entirely optional. Refusing it, or later withdrawing it, has no effect on the service.

Automated decision-making

The check carried out before a line is opened is automated: the existence and trading status of your company are verified against the French national business registry, and your identity through a specialised provider, without human intervention. A negative outcome prevents the line from being opened. No profiling is carried out, and no other decision producing legal effects is taken on this basis. You may at any time request human review, express your point of view and contest the outcome, by writing to the address given below.

Your rights

Under the GDPR, you have the following rights:

• •Right of access to your data and to obtain a copy of it.
• •Right to rectification of inaccurate or incomplete data.
• •Right to erasure, within the limits of statutory retention obligations.
• •Right to restriction of processing and right to object, in particular to prospecting.
• •Right to portability of the data you have provided to us.
• •Right to withdraw your consent at any time, where processing is based on it.
• •Right to set directives on what happens to your data after your death.

Exercising your rights

Requests may be sent to [email protected]. You may be asked to prove your identity where reasonable doubt exists. A response is provided within one month, extendable by two months for complex requests. If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

Changes to this policy

This policy may be updated to reflect legal or technical developments, or changes to the service offering. The applicable version is the one published on this page; its last update date appears below.