Unify Phone Service

Privacy Notice

(Effective as of February 15, 2024)

If You are, or plan to become, a user of Unify Phone Service, this document is meant for you.

In order to provide the Unify Phone Service we might need to process Your Personal Data. This Privacy Notice contains all necessary information that you need to know for such processing of Your Personal Data.

The below terms shall have the following meaning:

  • Personal Data” means any information relating to an identified or identifiable natural person (“You”, “Data Subject”;
  • Identifiable Person” means an individual who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
  • Applicable DataProtection Laws” means the laws and regulations relating to the processing and protection of Personal Data applicable to Unify or  You, including but not limited to EU Regulation 2016/679 (General Data Protection Regulation (“GDPR”), the UK GDPR, Brazil’s LPGD (Lei Geral de Proteção de Dados Pessoais), etc;
  • Controller” means the natural or legal person, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
  • Processor” means a natural or legal person, agency or other body which processes personal data on behalf of the controller;
  • Tenant” means the company or organization you work for (or are otherwise engaged with) that provides you access to the Unify Phone Service

Terms used in this Privacy Notice shall have the meaning provided in the Applicable Data Protection Law unless otherwise defined in this Privacy Notice.

Unify operates Unify Phone Service by the URL https://phoneapp.unify.com.

 

1 Controller

With respect to Personal Data submitted to the Unify Phone Service, Unify is a “Processor” and Unify’s Tenant is the “Controller”.

This Privacy Notice serves to describe how Unify processes Personal Data as a Processor for and on behalf of its Tenants for the purpose of providing Unify Phone Service to Your Tenant and You, pursuant to the Data Protection Agreement (“DPA”), concluded with Your Tenant and the Applicable Law.

Your Tenant as the Controller is directly accountable to you for the protection of Your Personal Data. Your Tenant is contractually obligated by the DPA to give you access to this Privacy Notice and to provide You with all the information that is in its area of responsibilities it has to provide to you to comply with its obligations under the Applicable Data Protection Laws and which information we are not able to provide to you.

 

2 Data Protection Officer

Unify has appointed a Data Protection Officer (“DPO”). You can reach the DPO at the following email address: gdpr@mitel.com

Depending on the size of the business your Tenant might also have a Data Protection Officer, whose contact details should be provided to You by Your Tenant.

 

3 Purpose and Legal Basis for Processing

You have the right to be informed about the purpose and legal basis for the processing of your Personal Data in Unify Phone Service. This is however the responsibility of your Tenant, as explained in section 1 above.

 

4 Categories of Personal Data

We process the following  Personal Data categories within the Unify Phone Service :

  • Profile Data: Personal Data You create about yourself or are assigned to You by Your Tenant, in particular: name, email address, phone numbers, access rights (user vs Tenant administrator).
  • Activity Data: Personal Data collected by Unify Phone Service from your use of the services, in particular call journal data, content deletion or change records or data relating to service usage (e.g. used end-points). These Personal Data are collected to provide call journal functionalities and transparency to the users of Unify Phone Service and for troubleshooting purposes. These Personal Data are also used in strictly anonymized form for usage, adoption, and user experience statistics and reports.
  • Transient and Session Data: Transient Data are data that flow from the OpenScape platform or the Unify Video cloud service through the Unify Phone cloud service without storage (e.g. personal phone book data from a third provider). Session Data are Personal Data (such as IP addresses) which are collected but not stored on Unify Phone Service beyond the duration of the session (such as presence) or which are tied to a log-on session on Unify Phone Service (e.g. IP addresses).

Notes:

  1. Private Address Books may contain Personal Data of your personal contacts. Such Private Address Books residing on other systems (such as MS Exchange) are accessible from Unify Phone Service for search and phone number retrieval, but data are not stored on Unify Phone Service. This feature is only available upon Your activation .
  2. Statistics and Reporting Data which Unify produces regularly from Activity Data and shares with Tenants are strictly anonymized. You should be aware that Tenants may ask for non-anonymized reports, which Unify may provide under certain circumstances. The usage of such reports and their compliance which GDPR, other applicable laws, or applicable business policies is entirely at your Tenant`s sole discretion. You have the right to receive from Your Tenant or Unify information if such reports were requested and/or used.
  3. User Data may be accessible by the Tenant’s administrator in the OpenScape platform administration. If a user is deleted, the User Data of that user may still be accessed by other users who had communicated with the deleted user.
  4. The above-mentioned categories of Personal Data shall be obtained either directly from You or indirectly from Your Tenant.

 

5 Recipients of Personal Data

Data you enter into Unify Phone Service including your Personal Data might be shared with third parties in one of the below cases:

a)  The Unify Phone Service displays the phone number or the name of a calling party to the called party.

b) Your Profile Data will also be shared with your Tenant administrators on Unify Phone Service.

c) Profile Data are shared between Unify Phone Service, Unify Video and the OpenScape VoIP platform. Private Address Book data residing on other systems are accessible on Unify Phone Service as explained above in section 4 a).

Unify will only share your Personal Data with approved internal or external subcontractors for the purpose of delivering the service and supporting you as a user.

Sub-contractors are listed in section 6.

Unify Phone Service however have features which, when activated by the Tenant administrator or by You, disclose Personal Data, for example:

  • Your Tenant might assign Tenant administration privileges to the reseller the business purchased the cloud service from.

We only provide the technical features. You or Your Tenant administrator can activate these features and must be aware of which Personal Data will be disclosed and to whom and under which circumstances.

 

6 Sub-Contractors and Transfers of Personal Data to Third Countries

Name Address Scope of Processing
Google Ireland Limited Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland Data Center Services
Mitel Networks (Bulgaria) EOOD 2 Maria Luiza Blvd.,
TZUM Business Center,
1000 Sofia, Bulgaria
Technical Support Services
Mitel Networks Romania S.R.L. 21st Mihail Kogalniceanu str. Bdg. C6/AP11,
500090 Brasov, Romania
Technical Support Services
Unify Communications Spain S.A.U. 25 Calle de Albarracin,
28307 Madrid, Spain
Technical Support Services
Unify Communications and Collaboration GmbH & Co. KG Otto-Hahn-Ring 6
81739 München
Technical Support Services
Mitel Networks Greece AE 455 Irakleiou Ave, N. Irakleio, 14122 Athens, Greece Technical Support Services
Unify – Soluções em Tecnologia da Informação Ltda Rua do Semeador, 702, Cidade Industrial –
Curitiba City, Paraná State,
Address Code (CEP 81.270-050), Brazil
Technical Support Services
Mitel Communications Private Limited MIDC Plot B1 & B2
Software Technology Park
411062 Talwade, Pune, Maharashtra, India
Technical Support Services
(Resource Pool)
MongoDB Inc. 1633 Broadway 38th floor New York, NY 10019, USA Managed Data Base Service

 

Unify Phone (incl. MongoDB) are hosted in Google data centers, located in Saint Ghislain, Belgium and Frankfurt a. M., Germany.

Note that technical support services can be provided by Mitel Group Companies located globally, e.g., India, United States of America, Brazil, etc. to support different languages and time-zones. The Mitel Group owns and operates the Unify business.

Where Personal Data is transferred for processing operations that are necessary for the performance of Unify Phone Service to a subcontractor that is part of the Mitel Group or  third-party sub-contractors authorized to process Tenants’ Personal Data and located in countries that are not part of the European Economic Area (EEA), any such international transfers are based on an adequacy decision by the European Commission pursuant to Article 45 GDPR or in case there is no such adequacy decision in place, are governed by standard contractual clauses under Article 46 (2) GDPR as set forth by the European Commission (or any competent authority) (in particular the European Commission’s Standard Contractual Clauses pursuant to decision 2021/914 of 4 June 2021).

 

7 Data Retention

Retention of Personal Data, and the deletion of Personal Data, is managed in Unify Phone Service on the following three levels:

  1. Retention managed by Unify;
  2. Retention managed by Unify Phone Service; and
  3. Retention You can manage.

 

7.1 Data Retention Managed by Unify

We don’t delete Personal Data of Unify Phone Service Tenants on our own as long as there are active Unify Phone licenses. Upon expiry of the Unify Phone license with your Tenant, we delete all tenancy data at the latest 60 days after the effectiveness of the termination. As an example: if we receive a termination notice from the Tenant or a reseller on April 14 with a notice period of thirty (30) days the termination goes into effect on May 15th. At this point all access to the tenancy shall be suspended. We retain the tenancy with its data until July 14th, in case the Tenant wants to reverse cancellation or retrieve any data. After this retention period all tenancy data are deleted from the production system of Unify Phone Service. They are still available in the automatic data-base back-ups we have to ensure high service availability. Back-ups still containing data of the terminated tenancy are finally deleted after 4 weeks. After this point, tenancy data including your Personal Data are irreversibly deleted.

Notes:

a) Termination notice period and retention after termination may vary depending on the specific customer arrangements. Please inquire with your Tenant if there are different arrangements agreed with Unify;

b) Conversation and Activity Data you leave as a cross-tenancy guest in foreign tenancies are not affected by the termination of your Tenant but are still controlled by the foreign Tenant. Please inquire with the foreign Tenant on deletion of such data.

 

7.2 Data Retention Managed by Unify Phone Service

Call Journal data stored on Unify Phone Service will be retained for 24 months, counting from the day the data were entered by the You. Back-ups containing Call Journal data are automatically deleted after 4 weeks following the 24-month retention period as above. This retention mechanism affects all users of the Tenant. If the Tenant removes You as a user of Unify Phone Service, e.g. because you are leaving the company, the following will happen:

a) Your Profile Data is deleted, except for your name;

b) For 4 weeks after deletion from the production data base, deleted data will remain available in back-ups.

Notes:

a) Session Data are only stored as long as the session is active. Transient Data are not stored at all;

b) Conversation and Activity Data you leave as a cross-tenancy guest in foreign tenancies are not affected by data retention managed by your Tenant but by the foreign Tenant. Please inquire with the foreign Tenant on deletion.

 

7.3 Data Retention You Can Manage

As a user of Unify Phone Service, You can do the following:

a) You can delete most of your Profile Data. If a Data field cannot be deleted, it is because the data field was provisioned and is controlled by the Tenant. Please inquire with your Tenant about deletion;

b) You can delete Call Journal Data.

What you cannot delete:

a) Your name from the Call Journal of other users you had a call with;

b) Session Data during the session since this would destroy the session.

 

8 Your Rights as a Data Subject and How to Exercise Them

Since your Tenant grants you access to Unify Phone Service, and defines the purpose of its usage, we generally engage with the Tenant before responding to Your request . If you have specific questions or want to exercise your rights under the Applicable Data Protection Law, you should address them to your Tenant. We have reserved the right from our Tenants in the Data Processing Agreement that we may, after due consideration of the legal circumstances with the Tenant, execute some request automatically, if required.

a) Right of Access to Personal Data
Users of Unify Phone Service can see all their Personal data directly on the Unify Phone Service platform.

b) Right to Rectification of Personal Data
For rectification of Personal Data on the Unify Phone Service platform, please contact your Tenant`s IT helpdesk.

c) Right for Erasure of Personal Data

  • User Profile Data are deleted automatically upon deprovisioning of the user;
  • Call Journal Data can be deleted any time by the user;

d) Right to Restrict Processing
Under specific circumstances, e.g. if you consider processing of your Personal Data inaccurate, unlawful, or no longer required, or if there is a pending objection from your side to the processing, you have the right to request a restriction of processing. We recommend placing a request with your Tenant`s IT helpdesk, but you can also place the request with Unify, in which case we would follow up with your Tenant. In case we restrict processing upon your request the following will happen:

  • Your Profile Data will be deleted, and your name will be anonymized (service request);
  • You will lose access to your account; and
  • You can give your Tenant or us instructions on further processing.

If you decide to lift the restriction again and resume your account on Unify Phone Service, your account will be unsuspended. You and your Tenant can re-enter your Profile Data, your conversation data will appear again under your name.

e) Right to Object Processing
You have the right to object to processing of Personal data under certain circumstances related to section 3 of this document (Purpose and Legal Basis for Processing). Since establishing these criteria are with the Tenant we recommend placing a request with your Tenant, but you can also place the request with Unify, in which case we would follow up with your Tenant.

f) Right to Withdraw Your Consent
We do not collect consent from you in the sense of GDPR (6-7) as a legal basis for processing your Personal Data. Establishing that legal basis is the responsibility of your Tenant. In case your Tenant collects your consent, you would have to withdraw that consent with your Tenant.

g) Right to Data Portability
You can download your Call Journal data from the Unify Phone Service.

h) Right to lodge a complaint with a Data Protection Authority
You have the right to lodge a complaint about the processing of your Personal Data on the Unify Phone platform with the data protection authority of your country or of the Federal Republic of Germany.

 

9 Is it a Statutory or Contractual Requirement to Provide Personal Data?

Yes. As a user of Unify Phone Service you must be identifiable to Unify and the Tenant at least by your name and email address. Depending on the services, you may need to provide your business phone number. Beyond that Unify has no more requirements for you to provide your Personal data, but your Tenant might have. Please inquire with your Tenant in case of concerns.

 

10 Automated Decision Making

There is no automated individual decision making and profiling about you on Unify Phone Service.

 

11 Google API

Unify uses Google’s People Application Programming Interface (API) Services to enable the user authorization feature for accessing the user’s personal Google Contacts and the user’s organization GSuite directory (i.e., use of your Gmail account to login to the Google Contacts application to access contacts information on the platform). Unify’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Unify Phone does not share any Google user data with third-party tools, including AI models.

 

12 Changes/Updates

Unify reserves the right to update or modify this Privacy Notice at any time to reflect any changes in the way Unify handles Your Personal Data or any changes in Applicable Laws. Any nonmaterial changes will be posted without prior notice on the Unify website: https://unify.com/en/legal-information/unify-phone/privacy-policy. In case of material changes, we will notify you more directly, for example by emailing you prior to such material changes taking effect. We encourage you to review this Privacy Notice regularly to stay informed of the latest modifications.