iNdex Voice privacy notice

This notice explains how iNdex Tech Solutions ("iNdex Tech", "we") handles personal information in iNdex Voice — the Android app, the web app at voice.indextech.co.za and the iNdex Voice servers — in line with the Protection of Personal Information Act 4 of 2013 (POPIA). The business using iNdex Voice (the "customer") decides who works on its phone system and how calls are handled; for its call records, voicemail and recordings the customer is the responsible party and we process that information on its behalf as an operator.

What we process

• Account details: name, email address, company name and role. Passwords are stored only as one-way hashes.
• Call records: calling and called numbers, the caller's name where the network provides it, date, time, duration, how the call was routed and who answered.
• Voicemail and recordings: voicemail messages left for the customer's staff, and call recordings only if the customer switches recording on.
• Devices: device name, app version and the push-notification token used to deliver incoming calls to the right phone.
• Billing: billing contact, company registration and VAT numbers, and usage such as call minutes.
• Technical and security logs: IP addresses and logs used to keep the service working and to prevent fraud.

Why we process it

To provide the business phone service the customer signed up for: connecting and routing calls, showing call history and voicemail, billing, preventing toll fraud and meeting our legal obligations. We do not sell personal information and we do not use call content for advertising.

Call recording

Recording is off by default. A customer that switches it on confirms that it will tell callers and comply with the law; iNdex Voice can play an announcement before the call is connected. Recordings are kept for the period the customer sets and are then deleted automatically.

Who else processes it

• licensed telecommunications carriers, to connect calls to and from the public telephone network;
• hosting, database and file storage providers (Render and S3-compatible storage);
• Google Firebase, to deliver incoming-call notifications to Android phones;
• an email delivery provider, for account and voicemail emails.

Some providers store information outside South Africa, for example in the European Union. We use providers that protect personal information to a standard comparable to POPIA.

Security

Information travels over encrypted connections (HTTPS, and encrypted media for calls in the app). Each business can see only its own information, access depends on each person's role, privileged changes are recorded in an audit trail, and voicemail and recordings are played through short-lived private links.

How long we keep it

By default voicemail and recordings are deleted after 90 days and call records after 12 months, unless the customer chooses a different period or the law requires us to keep them longer. Billing records are kept for the period South African tax law requires.

Your rights

People who call a business should first contact that business about its records. Anyone may ask us to see, correct or delete personal information we hold, or object to its processing, by writing to our information officer at privacy@indextech.co.za. You may lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za).

Contact

iNdex Tech Solutions, Cape Town, South Africa · privacy@indextech.co.za · 021 569 4997. See also the iNdex Voice terms and our website privacy notice.