Privacy Notice

Information you give us

• Name, work email, phone number and company when you sign up, request a demo or contact us.
• Billing details processed through our PCI-DSS-certified payment provider — we don't store full card numbers.
• Support correspondence, including any attachments you choose to share.

Information collected automatically

• Service telemetry — IP address, device, browser, OS, referrer, and usage events necessary to operate the platform.
• Call signalling metadata (CDRs) — caller, callee, duration, region, route — required for billing and quality of service.
• Cookies and similar technologies — essential, preference, analytics. See Cookies & tracking.

Information from third parties

• Identity verification, sanctions and PEP screening for high-risk numbering products, conducted by accredited bureaus.
• CRM enrichment data (LinkedIn, Clearbit-equivalent) for B2B prospect outreach — opt-out is available at any time.

We process personal information only for the purposes listed below, each tied to a lawful basis under POPIA / GDPR.

• Service delivery — provisioning numbers, routing calls, sending messages and enforcing your account permissions. (Contract.)
• Customer support — answering tickets, debugging incidents and tracing SIP traffic with your authorisation. (Contract / Legitimate interests.)
• Billing & fraud prevention — invoicing, anti-fraud signal scoring, sanctions screening. (Legal obligation / Legitimate interests.)
• Product improvement — aggregated, de-identified telemetry to improve reliability and AI accuracy. (Legitimate interests.)
• Marketing — opt-in newsletter and product announcements. You can unsubscribe with one click. (Consent.)

We do not sell personal information, and we never use customer call content to train general-purpose AI models.

We share personal information only with parties that need it to deliver the service, and only under written contracts that obligate them to the same standard of protection.

• Sub-processors — cloud infrastructure (region-pinned), CDN, observability, payments, identity verification. The current list is published in our DPA appendix and updated 30 days before changes take effect.
• Carriers & numbering authorities — for call termination, number provisioning and regulatory directories.
• Legal & safety — to comply with subpoenas, lawful interception requests, or to protect rights, property and safety. We push back on overbroad requests and notify customers unless legally prohibited.
• Corporate transactions — in the event of a merger or sale, with prior notice to affected customers.

Retention is the minimum period needed for the purpose, plus any period required by South African or EU law (e.g. tax, AML, ICASA).

• Account records — for the duration of the contract and 7 years thereafter for tax compliance.
• Call signalling (CDRs) — 12 months by default; configurable per region down to 90 days.
• Call recordings — only retained if your organisation enables recording. Default 90 days, configurable.
• Marketing data — until you opt out, plus 12 months suppression list to honour your preference.
• Support tickets — 36 months for compliance reference.

You can request earlier deletion at any time — see Your rights.

Security isn't a tier on TKOS — it is the foundation. The short version:

• TLS 1.3 in transit; AES-256 at rest with per-tenant KMS keys.
• SAML SSO, SCIM provisioning, scoped API tokens and IP allow-listing.
• Tamper-evident audit log exportable to your SIEM.
• HIPAA-aligned controls for healthcare clients and STIR/SHAKEN actively implemented on US-bound traffic.
• 24/7/365 NOC with tier-3 engineers handling incident response on first call.

Full detail lives on the Security page and our DPA.

POPIA and GDPR give you control over your personal information. You can:

• Access — get a copy of the personal information we hold about you.
• Rectify — correct inaccurate or incomplete information.
• Erase — request deletion (right to be forgotten), subject to legal retention.
• Restrict or object — limit how we process your data, including for marketing.
• Port — receive your data in a machine-readable format.
• Withdraw consent — at any time, without affecting prior lawful processing.
• Lodge a complaint — with the Information Regulator (South Africa) or your EU supervisory authority.

Email info@techopensystems.co.za with the subject line Data subject request. We respond within 30 days.

TKOS services are designed for businesses. We do not knowingly collect personal information from children under 18. If you believe a child has provided personal information, contact us and we will delete it.

We may update this notice to reflect changes in law, our service or operating practices. Material changes are emailed to account admins at least 30 days before they take effect. The effective date at the top of the page is the source of truth for the current version.

For privacy questions, data subject requests or to reach our Information Officer:

• Email: info@techopensystems.co.za
• Post: Tech Knowledge Open Systems, Spaces Broadacres Willow Wood, 220 3rd Avenue, Fourways, Gauteng 2191, South Africa
• Phone: +27 10 070 6007 (Mon–Fri, 07:00–20:00 SAST)

You also have the right to lodge a complaint with the South African Information Regulator or your local EU supervisory authority.