Privacy Policy

1.1The controller of the personal data described in this Policy is Protremix Technology Limited, business licence no. 07011554 issued by the Innovation City Authority, Government of Ras Al Khaimah, Office A, Innovation City Business Centre, RAK BANK ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates (Protremix, we, us).

1.2We handle personal data under the laws of the United Arab Emirates. This Policy is written with reference to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL). We hold no data-protection or security certification and this Policy does not claim that any authority or auditor has confirmed compliance with a law or standard.

1.3Contact for any matter in this Policy: info@eriusphone.com, or by post to the address in clause 1.1.

1.4Words defined in the Terms of Service have the same meaning here.

2.1Where we are the controller. For data about visitors to our website, about people who ask for access, and about Customers and their use of the Service (rows 3.1 to 3.4 and 3.10 to 3.12 of the table below), we decide why and how it is processed, and this Policy applies in full.

2.2Where we act for a Customer. The contents of a Device, files uploaded to it and the content of Calls (rows 3.5 to 3.9) are Customer Data. The Customer decides what is put there and why, and we process it on the Customer's behalf under the Data Processing Addendum. If you are a Guest in a Call, or your data is on a Customer's Device, the Customer is responsible for telling you how it uses your data, and requests about that data should go to the Customer first. We will pass on any request we receive.

4.1We process the data in rows 3.2 to 3.10 because it is necessary to perform the contract with the Customer, or to take steps at the request of a person before entering into it.

4.2We process the data in row 3.11, and keep the records in row 3.7 after an Account closes, to meet obligations under accounting and tax law.

4.3We process the data in rows 3.1, 3.4 and 3.12 to keep the Service and the website secure and working, which is necessary to provide them to you.

4.4We set analytics and advertising cookies on the basis described in the Cookie Notice. Where the law requires consent, we ask for it and you may withdraw it at any time.

4.5For Customer Data, the Customer is responsible for having a lawful basis, including any consent of a Guest that the law requires.

5.1We do not sell personal data and do not share it for anyone else's advertising.

5.2The following categories of recipient process personal data on our behalf, each only as needed for its task:

5.3We may disclose personal data where the law or an order of a competent authority requires it, or where it is necessary to establish or defend a legal claim or to protect a person or the Service from serious harm.

5.4If the business of the Service is transferred, personal data will pass to the successor, which will remain bound by this Policy until it is changed in accordance with clause 12.

6.1The retention periods are stated in the table in clause 3. Where no fixed period is stated, we keep the data for as long as the Account exists or until you ask us to delete it.

6.2When an Account is closed we delete its Devices and their storage, its private network, its API Key hashes and its calling configuration. Deleting a Device is permanent.

6.3After closure we keep a record that the Account existed (the contact email address and the dates of creation and closure) to prevent abuse of sign-up limits and to answer later questions, and the call and billing records that the law requires us to keep.

6.4The Call text log in row 3.8 is not yet subject to automatic deletion. On request from the Customer we delete the entries of its Calls.

6.5We take encrypted backups of the Service every day and keep fourteen daily and eight weekly copies. Data deleted from the live Service remains in those backups until they expire, and is not restored except to recover the Service.

7.1The Service runs on servers that we rent in data centres in the European Union. Backups are stored, encrypted, on other servers that we operate in the European Union.

7.2We are established in the United Arab Emirates and operate the Service from the United Arab Emirates and other countries. The recipients in clause 5.2 may process data in other countries, including the United States of America. Personal data is therefore transferred to, and accessed from, countries other than the one in which you live, some of which may not give the same protection as your own.

7.3Where the law that applies requires a safeguard for such a transfer, we rely on the contract terms offered by the recipient and on the necessity of the transfer to perform the contract with you.

8.1The measures in place at the Effective Date are:

1. (a)each Device runs in its own isolated container on its own private network, and an API Key reaches only the Devices of its own Account;
2. (b)API Keys are stored only as one-way hashes;
3. (c)connections to the website, the Dashboard and the API are encrypted in transit;
4. (d)the debugging interface of a Device is not exposed to the internet;
5. (e)uploaded files are held in a restricted area from which nothing can be executed;
6. (f)API requests are recorded in the audit log described in row 3.4;
7. (g)backups are encrypted and are written to stores from which the production server cannot delete;
8. (h)the integrity of production files and the isolation between Accounts are checked by automated tests on a schedule;
9. (i)logs and databases are readable only by the people who operate the Service.

8.2Devices are not end-to-end encrypted against us. People who operate the Service have the technical ability to access a Device and its contents. We do so only to operate and maintain the Service, to act on your request, to investigate a suspected breach of the Terms, or where the law requires.

8.3No system is completely secure. If we become aware of a breach of security that affects your personal data and is likely to put you at risk, we will tell you without undue delay and will notify the competent authority where the law requires.

9.1Subject to the conditions and exceptions in the law that applies to you (in the United Arab Emirates, the PDPL), you may ask us to:

1. (a)confirm whether we process your personal data and give you a copy of it;
2. (b)give you the data you provided in a structured, commonly used form;
3. (c)correct data that is inaccurate or incomplete;
4. (d)delete your data, or restrict or stop its processing;
5. (e)not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We make no such decisions.

9.2To exercise a right, write to info@eriusphone.com from the email address on your Account, or open a support ticket in the Dashboard. We may ask for information to confirm your identity. We answer within thirty (30) days and do not charge a fee unless a request is manifestly unfounded or repetitive.

9.3Where processing is based on consent you may withdraw it at any time. Withdrawal does not affect processing carried out before it.

9.4You may complain to the data-protection authority that is competent for you. In the United Arab Emirates that is the UAE Data Office.

10.1The Service is offered to businesses and adults. It is not directed at persons under eighteen (18), and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

11.1A Persona and the support assistant generate their replies automatically using AI systems. Their output is not reviewed by a person before it is delivered.

11.2We do not use the contents of Devices, the content of Calls or support messages to train AI models. The third-party AI services process this data on our behalf to provide the function concerned; their own retention for abuse monitoring is governed by their terms.

12.1We may change this Policy. We publish each version with a new version number and date, record it in the version history, and for a material change notify Customers by email or in the Dashboard before it takes effect.

Protremix Technology Limited, Office A, Innovation City Business Centre, RAK BANK ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates. Licence no. 07011554. Printable copy: PDF.