PRIVACY POLICY

Effective date: 15.10.2026

This Privacy Policy explains how personal data is processed when using the website, personal account, OnePhone mobile application, and related OnePhone / OneVOIPlanet services, including IP telephony, virtual numbers, cloud PBX, voice menus, call recording and statistics, integrations, and eSIM services.

This Policy applies in accordance with Ukrainian law and other data protection regulations applicable to the relevant User and data processing, including the General Data Protection Regulation (GDPR) where applicable. It does not replace separate privacy notices that may be legally required for a specific feature or service.

1. Data Controllers (Who processes personal data)

OnePhone / OneVOIPlanet services are provided by separate legal entities. The Data Controller of your personal data is the legal entity to which you direct your payment and which directly provides you with the ordered service:

LIMITED LIABILITY COMPANY “ONEVOIPLANET” (ТОВ «ВАНВОІПЛЕНЕТ»), Ukrainian company registration number (EDRPOU) 43509964, registered address: 12 Volodymyra Monomakha Street, Dnipro, 49000, Ukraine — acts as the Data Controller when ordering and paying for services provided by this legal entity (including orders within Ukraine).

ONELINK PLANET LLC, EIN 61-2236261, registered address: 1445 Dolgner Pl, Ste 13, Sanford, FL 32771, United States — acts as the Data Controller when ordering and paying for services provided by this legal entity (including international payments and purchases via the App Store / Google Play).

The specific Data Controller is automatically determined during checkout and is specified on the payment page, in order confirmations, invoices, and payment documents. For inquiries regarding this Policy or data processing, contact: sales@onevoiplanet.com.

To ensure platform operation and service delivery, the companies may share technical infrastructure and engage each other as technical service providers (Data Processors). In such cases, the processor company acts strictly under an Intra-Group Data Processing Agreement (DPA), solely on behalf of the controller company, and does not use the data for its own purposes.

2. Categories of Personal Data Processed

Depending on the features used and permissions granted, the following categories of data may be processed:

1. identity and contact data: first and last name, telephone number, email address, country, region/state, city, and postal code;
2. account and device data: user identifier, device identifiers, and information needed for sign-in, app operation, account security, and technical support;
3. payment and purchase data: order details, amount, currency, payment status, purchase history, transaction identifiers, and other information needed for payment processing, refunds, accounting, and dispute resolution; full payment card details are handled directly by the payment provider;
4. communications and service usage data: numbers, selected services and tariffs, usage information, technical logs, call and connection details, and audio files or call recordings where the feature is used;
5. contacts: where the User grants access to device contacts or uses a feature requiring them;
6. support requests, messages, and other information voluntarily sent by the User to the company;
7. technical website and app data: including data collected through cookies and similar technologies as described in the separate Cookie Policy.

Not every category is collected from every User. The specific data processed depends on the service, settings, and device permissions.

3. Purposes and Legal Bases for Processing

Personal data is used to the extent necessary to:

1. register, create, and maintain accounts, authenticate users, and provide access to services;
2. provide, configure, and support communications services, virtual numbers, cloud PBX, eSIM, integrations, and related features;
3. process payments, confirm orders, renew services, issue refunds, maintain accounting and tax records, prevent fraud, and handle payment disputes;
4. respond to inquiries, provide technical support, and send service-related or account-security notices;
5. maintain security, detect abuse, resolve outages, and maintain or improve platform performance;
6. comply with legal obligations and lawful requests from competent authorities;
7. perform analytics, statistics, and research, including using aggregated or de-identified data;
8. send marketing communications and personalized advertising only where permitted by applicable law and subject to prior explicit consent (opt-in) where required.

The legal basis for processing is performance of a contract, compliance with legal obligations, legitimate interests of the company (service security and fraud prevention), or explicit User consent. Consent is requested separately where legally required; using a service does not replace consent where separate consent is mandatory.

4. Telephony, Call Recordings, and Third-Party Data (B2B Processing)

When using IP telephony, cloud PBX, call recording, voice menus, call statistics, CRM integrations, and call forwarding, the service processes call details, participant numbers, call duration, routing settings, call recordings, and related comments.

User Responsibility: If a User uses the Service to process personal data of their customers, employees, or other third parties, the User acts as an independent Data Controller for such data. The User is solely responsible for:

1. establishing a lawful basis for processing and recording calls of third parties;
2. providing required notifications to call participants regarding call recording (including configuring automated audio warnings);
3. obtaining all necessary consents required under applicable laws in the User's and participant's jurisdictions.

Regarding third-party data processed by the User, the company acts strictly as a technical service provider (Data Processor). Upon request by B2B users, the parties may execute a Data Processing Agreement (DPA). The company bears no liability for any violations of data protection laws or call privacy regulations committed by the User.

5. Payments and Third-Party Providers

Third-party service providers may be involved in payment processing, in-app purchases, eSIM provisioning, and telecommunications functions, including payment gateways, app stores, telecom operators, virtual number providers, hosting, analytics, and infrastructure providers. They process data under their own privacy policies.

When paying, the payment provider receives data necessary to execute transactions, verify identity, prevent fraud, and handle refunds or disputes. The company receives order and payment confirmation details needed for service provision and accounting. For purchases made through the Apple App Store or Google Play, payments and subscriptions are governed by the respective store's terms.

6. Data Recipients

Access to personal data may be provided, strictly as necessary, to:

1. the relevant OnePhone / OneVOIPlanet entity acting as the Data Controller for the ordered service;
2. the other group entity acting strictly as a technical Data Processor to support infrastructure, customer care, or order fulfillment on behalf of the Data Controller;
3. payment providers and app stores;
4. telecom operators, virtual number providers, eSIM providers, and suppliers required for service delivery;
5. hosting, IT infrastructure, security, analytics, customer support, and CRM integration providers;
6. professional advisers, auditors, banks, and public authorities where required by law or to protect legal rights.

Data may also be transferred during corporate reorganizations or business transfers where permitted by law and subject to appropriate safeguards. Recipients may be located outside the User's country.

7. International Data Transfers

Because services are provided by entities located in Ukraine and the United States and rely on global cloud infrastructure, personal data may be processed or transferred internationally.

Where data is transferred between group entities or third-party providers located in third countries, the company ensures appropriate safeguards and transfer mechanisms in accordance with applicable law, including:

Standard Contractual Clauses (SCCs) approved by the European Commission or national regulators;

Intra-Group Data Processing Agreements (DPAs);

1. transfers to countries providing an adequate level of data protection under adequacy decisions.

8. Cookies and Advertising Technologies

The website may use session and persistent cookies, as well as similar technologies, to operate the site, store preferences, measure traffic, and support advertising. For details, see the separate Cookie Policy: https://onevoiplanet.com/en/cookies. Where required by law, non-essential cookies and advertising technologies are activated only after receiving User consent. Users can manage cookie preferences via browser settings.

9. Data Retention

Personal data is retained no longer than necessary for the purposes for which it was collected, taking into account account duration, service provision, customer support, dispute resolution, fraud prevention, accounting and tax requirements, legal obligations, and protection of the company's legal rights. Upon reaching the retention period, data is deleted, destroyed, or anonymized.

10. Data Security

The company implements appropriate technical and organizational measures to protect data against accidental or unlawful destruction, loss, alteration, disclosure, or unauthorized access. No method of transmission or storage is 100% secure. Users are responsible for safeguarding their credentials and devices and must immediately report suspected unauthorized access.

11. User Rights

Depending on applicable law, Users may have the right to:

1. obtain information regarding data processing and access their personal data;
2. request correction of inaccurate or incomplete data;
3. request erasure ("right to be forgotten") or restriction of processing where legal grounds exist;
4. object to processing, including direct marketing;
5. withdraw consent where processing is based on consent;
6. receive personal data in a structured, portable format (data portability);
7. lodge a complaint with a competent data protection authority or court.

To exercise your rights, please submit a request to: sales@onevoiplanet.com. Requests regarding data subject rights are treated as priority and answered within statutory deadlines (up to 30 days). The company may request identity verification before processing requests.

12. Marketing Communications

Marketing and promotional communications are sent only with prior User consent. Users may opt out of marketing messages at any time by following the unsubscribe link in emails or contacting sales@onevoiplanet.com. Opting out of marketing does not affect essential service, transactional, or security notices.

13. Minors

Services are not intended for individuals under 18 years of age. The company does not knowingly collect data from minors. If such data is collected without a valid legal basis, it will be promptly deleted.

14. Links and Third-Party Services

The website and application may contain links or integrations with third-party resources, which are governed by their respective privacy policies.

15. Changes to this Policy

This Policy may be updated to reflect changes in services, processing activities, or applicable laws. The latest version will be published on the website with an updated effective date. Continued use of the service after updates constitutes acknowledgment of the revised Policy.

16. Contact Details

For questions regarding personal data processing or to exercise your rights, contact: sales@onevoiplanet.com.

LIMITED LIABILITY COMPANY “ONEVOIPLANET”: 12 Volodymyra Monomakha Street, Dnipro, 49000, Ukraine; EDRPOU 43509964.

ONELINK PLANET LLC: 1445 Dolgner Pl, Ste 13, Sanford, FL 32771, United States; EIN 61-2236261.