Privacy Policy - Globfone

This agreement, together with the Terms of Use defines the terms of use of the Globfone.com website (including all services) between the website publisher and the user.

By using Globfone.com, you represent that you are at least 18 years old or have parental consent, and that you agree to this agreement (the "Service Agreement" or "Agreement").

what personal data we collect when you use Globfone (Website, subdomains, and mobile apps),
for what purposes and on what legal bases we process this data,
who we share data with, including processors and other third parties,
how long we keep data,
your rights under GDPR, CCPA and other applicable laws,
how to contact us regarding privacy matters.

User – any person using the Globfone Services (via Website, subdomain or Application).
Services – communication and related services we provide, including sending SMS, VoIP calls, video calls, file transfers, free and Premium services.
Website – the service available at https://globfone.com and related subdomains, including premium.globfone.com and auth.globfone.com.
Application – the mobile apps "Globfone" or similar, which act mainly as a shortcut/hosted shell for the mobile versions of the Websites and do not contain separate core logic.
End User / Recipient – the recipient of an SMS, call or other communication (e.g. owner of a phone number in GSM/PSTN networks).
Personal Data – any information relating to an identified or identifiable natural person (e.g. name, email, IP, phone number, identifiers).
Data Controller – the entity determining the purposes and means of processing personal data (i-Trends Sp. z o.o. for Globfone).
Data Processor – an entity processing personal data on behalf of the Controller (e.g. hosting provider, payment processor, VoIP or SMS gateway).
Cookies – small text files stored on your device to support the operation of the Website and for analytics/advertising, as described in the Cookies section.

Account registration and login: email address, first name, last name (if provided), user identifier in the identity system , password or other authentication credentials (stored and managed in the identity provider),

email address,
first name, last name (if provided),
user identifier in the identity system ,
password or other authentication credentials (stored and managed in the identity provider),
technical tokens (access/refresh tokens) stored as httpOnly cookies on our domains for authentication and security.

password or other authentication credentials (stored and managed in the identity provider),

email address,
first name, last name (if provided),
user identifier in the identity system ,
password or other authentication credentials (stored and managed in the identity provider),
technical tokens (access/refresh tokens) stored as httpOnly cookies on our domains for authentication and security.

•
creating and managing a User Account, including authentication via OAuth2/OpenID Connect,
•
providing access to free and Premium Services, including web and mobile versions,
•
billing, invoicing and payment settlement (especially for business users and Premium accounts),
•
configuring VoIP/SIP accounts and link them to your profile,
•
personalisation of interface (language, time zone),
•
support, complaint handling and communication about your account or services.

•
performance of a contract or steps prior to entering into a contract – Art. 6(1)(b) GDPR (e.g. creating and managing your account, providing services),
•
legal obligations – Art. 6(1)(c) GDPR (e.g. tax and accounting obligations related to invoices),
•
legitimate interests – Art. 6(1)(f) GDPR (e.g. securing access to the Service, preventing abuse, service improvement).

• SIP login and password generated for you,
• internal VoIP identifiers (e.g. Server VoIP user ID, tariff/group ID),
• assigned caller ID number in international format, and display name (if used),
• call metadata: dialled number, date and time, call duration, call status, technical parameters required to route the call.

setting up and operating VoIP/SIP accounts (including accounts managed via a third-party VoIP switch such as Mizu),
establishing, routing and terminating calls and other communications,
managing service limits (for Free vs Premium accounts),
ensuring quality of service, troubleshooting and complaint resolution,
fulfilling legal requirements applicable to telecom-type services, including retention of certain traffic data where required by law.

performance of a contract – Art. 6(1)(b) GDPR (provision of communication services),
legal obligations – Art. 6(1)(c) GDPR (where telecom or tax law requires certain data retention),
legitimate interests – Art. 6(1)(f) GDPR (ensuring service continuity, security and fraud prevention).

Sender information (linked to your User account or session),
recipient phone number and country/prefix,
message content, including advertising text automatically appended by the system,
meta-data: sending time, cost, free SMS balance, IP address, provider ID, gateway response, delivery status, any error codes.

•
providing a free SMS service funded by advertising,
•
ensuring messages are delivered to eligible destinations only, governed by country/prefix rules,
•
preventing abuse (spam, fraud, excessive usage) and managing limits,
•
billing and settlement with our SMS providers, and internal reporting.

performance of a contract – Art. 6(1)(b) GDPR (sending SMS requested by the User),
legitimate interests – Art. 6(1)(f) GDPR (financing free services with ads, anti-fraud, service quality).

Server-based contacts (within the Service): contact name (up to a limited number of characters), phone number (normalised numeric format), link to your User Account.
contact name (up to a limited number of characters),
phone number (normalised numeric format),
link to your User Account.
Mobile app device contacts (if you grant permission): access to your address book to allow you to pick recipients directly from contacts.
access to your address book to allow you to pick recipients directly from contacts.

contact name (up to a limited number of characters),
phone number (normalised numeric format),
link to your User Account.

consent – Art. 6(1)(a) GDPR (for accessing the address book on your device or adding third-party data),

phone number that you want to use as caller ID,
temporary verification code sent via SMS or call,
verification status (verified/unverified), default flag,
link to your User Account.

verifying that you control the phone number used as a sender/caller ID,
preventing spoofing and abuse,
using the verified number as caller ID for Free SMS and VoIP calls.

Stripe customer ID linked to your Account,

basic payment method information accessible to us (card brand, last four digits, expiration month/year),

processing payments for Premium Services and top-ups,
saving payment methods (via Stripe setup sessions) for future charges if you choose so,
handling refunds, chargebacks and complaints,
fulfilling accounting and tax obligations,
monitoring payment success/failure and preventing payment fraud.

performance of a contract – Art. 6(1)(b) GDPR (payment and subscription management),
legal obligations – Art. 6(1)(c) GDPR (tax/accounting recordkeeping),
legitimate interests – Art. 6(1)(f) GDPR (fraud prevention, dispute handling).

• User Account identifier,
• IP address and request meta-data,
• information about requested and granted free recharge (amount, limits, status),
• attempt logs (including repeated attempts) stored for audit and anti-fraud purposes.

providing promotional free credits or top-ups when available,
monitoring usage to prevent abuse of promotions,
security and auditability of free recharge decisions.

performance of a contract – Art. 6(1)(b) GDPR (where free recharge is part of the Service offering),

legitimate interests – Art. 6(1)(f) GDPR (protecting the Service from abuse).

blacklists: normalised values such as IP addresses, phone numbers, email addresses or other identifiers,

normalised values such as IP addresses, phone numbers, email addresses or other identifiers,
hash of the value, human-readable display value, scope (e.g. global, free SMS only), status, validity period,
reason, source (manual/automatic), meta-data, ID of admin who created/modified the entry.

normalised values such as IP addresses, phone numbers, email addresses or other identifiers,

normalised values such as IP addresses, phone numbers, email addresses or other identifiers, hash of the value, human-readable display value, scope (e.g. global, free SMS only), status, validity period, reason, source (manual/automatic), meta-data, ID of admin who created/modified the entry.

monitoring and protecting the security and stability of the Service,
detecting and preventing abuse, spam and attacks (e.g. DDoS, brute force, mass messaging),
enforcing rate limits and usage policies,
internal diagnostics and technical support,
keeping an audit trail required by law or good security practice.

legitimate interests – Art. 6(1)(f) GDPR (security of networks and information, fraud prevention, service quality),

country and phone prefix derived from numbers you dial or send SMS to,
approximate location inferred from IP address (country/region level),
internal configuration of supported countries and flags for free/premium calls and SMS.

•
determining whether certain services (e.g. free calls/SMS) are available for a given country,
•
calculating prices and costs,
•
complying with local legal or contractual restrictions (e.g. blocking certain destinations),
•
selecting appropriate language and localised content, where applicable.

• status of your email verification,
• status of caller ID verification (verified number),
• status of payment verification (existence of a valid payment method or successful transaction),
• a simple score or level assigned to your Account (e.g. 0–3) indicating profile credibility.

assessing the basic trust level of an Account,
deciding whether certain features are available or under which limits (e.g. raising limits after successful verification),
preventing abuse of free services and protecting other Users and Recipients from spam or fraudulent behaviour.

email address and/or phone number for notifications,
content of system or support emails,
meta-data of messages (message ID, timestamp, delivery status),
for admin/monitoring alerts: internal contact data of our administrators (phone, email),
basic data in audit logs: type of alert, channel (SMS/email), target, affected service or container, error counts, etc.

sending operational messages about your Account, payments, security alerts (e.g. password reset, verification emails),
service updates and critical notifications,
internal monitoring of the health and stability of our systems (including SMS or email alerts to admins when errors occur).

cookie identifiers and similar technologies,
IP address, browser type, operating system, device identifiers,
information about how you interact with the Website or Application (pages visited, clicks, forms, session duration),
approximate location inferred from IP (country/region),
advertising identifiers and information on interactions with ads (in the app and on the Website), where applicable.

•
ensuring the Website and App work correctly and remembering your choices (e.g. language),
•
analysing usage and improving our Services,
•
displaying advertising and measuring its effectiveness (in the app and on the Website),
•
security (e.g. detection of fraudulent or abnormal traffic).

legitimate interests – Art. 6(1)(f) GDPR (analytics, service improvement, security),
consent – Art. 6(1)(a) GDPR (for non-essential cookies and personalised advertising where required by law).

Analytics and advertising providers – e.g. Google Analytics, Google AdMob, Google Adsense and similar tools used for analytics and displaying ads.

Security and CDN providers – such as Cloudflare, which process certain technical data to improve performance and protect the Service.

transfers to countries recognised by the European Commission as providing an adequate level of protection,
standard contractual clauses approved by the European Commission,
where applicable, transfers to entities certified under recognised frameworks (e.g. EU-US Data Privacy Framework for relevant US companies).

Purpose: detect and block messages that may be spam, fraudulent, illegal, offensive, sexually explicit, degrading, threatening or containing prohibited/malicious URLs, and ensure compliance with the Terms of Use.

How it works: the system automatically classifies messages and may decide on sending in certain cases. This decision is automated within the meaning of A.

Account data: stored while your Account is active and for up to 6 years after deletion or last use where necessary to comply with legal obligations (e.g. accounting) or defend/establish legal claims.

Payment and billing information: stored for the period required by tax and accounting law — at least 5–6 years from the end of the year in which the transaction took place.

Communication metadata (calls, SMS, technical logs): stored generally up to 6 years to ensure service provision, security, settlement and legal compliance (e.g. telecom, tax and limitation periods).

Payment and billing information: stored for the period required by tax and accounting laws (often at least 5–6 years from the end of the year in which the transaction took place).

SMS content: stored up to 18 months to ensure delivery, troubleshoot issues and handle complaints, unless a longer period is required by law. After this period, content is securely deleted (e.g. overwritten).

Communication metadata (calls, SMS, technical logs): stored generally up to 6 years unless a longer period is required by law (e.g. certain logs for security or compliance reasons).

Authentication and security logs: stored for a period necessary to ensure security and investigate incidents (for example several months) and then deleted or anonymised. Some aggregated or anonymised data may be kept longer for statistics and security basis.

Account data: stored while your Account is active and for up to 6 years after de-activation or closure, where necessary to comply with legal obligations (e.g. accounting) or to handle disputes.

Right of access – to obtain confirmation whether we process your personal data and, if so, to receive a copy and information about that processing (Art. 15 GDPR).
Right to rectification – to have inaccurate or incomplete data corrected or completed (Art. 16 GDPR).
Right to erasure ("right to be forgotten") – to request deletion of data in cases foreseen by Art. 17 GDPR (e.g. data is no longer needed, processing is unlawful, or consent is withdrawn where consent was the legal basis).
Right to restriction – to request that we limit processing in certain situations (Art. 18 GDPR).
Right to data portability – to receive the personal data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible (Art. 20 GDPR).
Right to object – to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21 GDPR), including profiling. We will stop processing unless we demonstrate compelling legitimate grounds overriding your rights, or the processing is needed to establish or defend legal claims.
Right to withdraw consent – where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3) GDPR).
Right to lodge a complaint – you may lodge a complaint with the competent supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

Right of access – to obtain confirmation whether we process your personal data and, if so, to receive a copy and information about that processing (Art. 15 GDPR).
Right to rectification – to have inaccurate or incomplete data corrected or completed (Art. 16 GDPR).
Right to erasure ("right to be forgotten") – to request deletion of data in cases foreseen by Art. 17 GDPR (e.g. data is no longer needed, processing is unlawful, or consent is withdrawn where consent was the legal basis).
Right to restriction – to request that we limit processing in certain situations (Art. 18 GDPR).
Right to data portability – to receive the personal data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
Right to object – to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21 GDPR), including profiling. We will stop processing unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent – where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3) GDPR).
Right to lodge a complaint – you may lodge a complaint with the competent supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement.

Right to lodge a complaint – you may lodge a complaint with the competent supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. In Poland, the authority is the President of the Personal Data Protection Office (UODO).

To exercise any of these rights, you can contact us at support @ globfone.com or by postal mail to our registered address. We will respond without undue delay, and in any event within one month, unless the request is particularly complex (in such case, we may extend this period to three months, informing you about the reasons).

to comply with a legal obligation requiring processing under EU or Member State law (Art. 17(3)(b) GDPR) – in particular, as a company registered in Poland and providing telecommunication-like services, we are subject to legal duties (e.g. under the Polish Telecommunications Act) to retain certain transmission data for evidentiary purposes, to combat network abuse and to cooperate with competent authorities. These obligations apply irrespective of the user's nationality;
for the establishment, exercise or defence of legal claims (Art. 17(3)(e) GDPR) – for example, where data is linked to potential misuse, harassment, fraud or other illicit activities, and may be required as evidence in court or administrative proceedings;
for purposes based on our legitimate interests (Art. 6(1)(f) GDPR), such as ensuring the security and integrity of our services, preventing fraud and abuse, and protecting our platform and its users. In this context, the retention of connection and access logs is considered a necessary and proportionate measure to detect, investigate and mitigate suspicious or abusive behaviour;
for security reasons – for example, maintaining IP addresses, phone numbers or other identifiers on blacklists to prevent repeated attacks or abuse of our free and Premium services.

After logging into your User Profile, User may request deletion of Globfone Account by using the "Delete Account" option available in the account profile page. This action initiates the automated process of anonymising and deleting your personal data, subject to the exceptions and time periods described in this Privacy Policy (e.g. data required for legal compliance, to establish or defend legal claims).

•
the right to know what categories of personal data we collect, the purposes of processing and the categories of third parties with whom data is shared,
•
the right to request deletion of your personal data (subject to legal exceptions),
•
the right to request information about data sold or disclosed for business purposes (Globfone does not sell personal data to third parties),
•
the right not to be discriminated against for exercising your privacy rights.

• encryption of data in transit (e.g. TLS) and in some cases at rest,
• strict access controls and authentication for staff and systems,
• segregation of environments,
• regular security audits and monitoring of logs for suspicious activity,
• backup and recovery procedures,
• data protection and confidentiality clauses in agreements with processors.

We may update this Policy from time to time to reflect changes in our Services, technology or legal requirements. Updated versions will be published on the Website and, where appropriate, within the Application. We encourage you to review the Policy regularly. If changes are significant, we may also notify you via email or within the Service. Continued use of the Service after changes take effect means that you accept the updated Policy.