Notel – Unlimited Communication
Notel is a service product of Solbridge Holdings (Pty) Ltd
Introduction
This Privacy Policy explains how Solbridge Holdings (Pty) Ltd (“Solbridge”, “we”, “us” or “our”), acting through its service product Notel – Unlimited Communication (“Notel”), collects, uses, stores, shares and protects personal information.
We are committed to processing personal information lawfully, responsibly and transparently, in accordance with the Protection of Personal Information Act, 4 of 2013 (“POPIA”), the Regulation of Interception of Communications and Provision of Communication-related Information Act, 70 of 2002 (“RICA”), the Electronic Communications Act, 36 of 2005 (“ECA”), and all other applicable South African law.
This policy applies to our website, our client portals, our mobile and desktop applications, and all communication services we provide. It should be read together with our Cookie Policy, our Acceptable Use Policy and any service-specific terms you have agreed to.
Who We Are
Notel – Unlimited Communication is a service product of Solbridge Holdings (Pty) Ltd, a company incorporated in the Republic of South Africa.
We provide Voice over Internet Protocol (“VoIP”) telephony, hosted Cloud PBX solutions, business telephone numbers, number porting, and related communication services to businesses and residential customers in South Africa and, where applicable, across other jurisdictions.
In respect of most personal information processed in the course of providing our services, Solbridge Holdings (Pty) Ltd is the Responsible Party as defined in POPIA, because we determine the purpose and means of processing. In limited circumstances, we may act as an Operator on behalf of a customer — for example, where we host a Cloud PBX on behalf of a business that determines how its own employees’ and clients’ information is used. Where we act as an Operator, we process personal information only on the documented instructions of that customer.
Scope of This Policy
This policy applies to personal information relating to:
- customers who subscribe to our services, including the individuals who represent or are authorised by those customers;
- end users and subscribers who make use of numbers and services we provision;
- individuals who contact us through our website, by telephone, by email, by WhatsApp, or through any other channel;
- visitors to our website and users of our applications;
- suppliers, contractors and service providers; and
- any other person whose personal information comes into our possession in the course of our business.
This policy does not apply to the practices of third parties whose services you may access through us, or to information that is not personal information as defined in POPIA.
What Personal Information We Collect
The personal information we collect depends on the nature of your relationship with us, but may include the following categories.
Identity and verification information. Your full names, identity number or passport number, date of birth, nationality, and copies of identity documents, passports, permits or other documents required for verification purposes.
Contact information. Your physical and postal address, email address, telephone and mobile numbers, and WhatsApp number.
Business and account information. The name, registration number, VAT number, address and authorised representatives of any business customer; your account number; your service address; and the extensions, numbers and services allocated to you.
Billing and payment information. Bank account details, debit order mandates, payment history, invoicing records, credit information obtained from registered credit bureaus where you have consented or where we have a lawful basis, and records of any disputes.
Service usage and communication data. Call detail records, including the originating and terminating numbers, call duration, timestamps, and routing information; data usage; login records; IP addresses; device and software identifiers; and records of your interactions with our support team.
Recorded communications. Where call recording is enabled, either by us for quality, training or compliance purposes, or by a business customer through its Cloud PBX configuration, the content of those recorded calls.
Voice and authentication data. Where you interact with our services by voice, information necessary to authenticate you and to provide the service, which may include voice samples where voice authentication is used.
Website and application data. Information collected through cookies, pixels, local storage and similar technologies, as described in our Cookie Policy, including device type, browser type, referring URL, pages visited and approximate location derived from IP address.
Correspondence. The content of emails, messages, WhatsApp communications, support tickets and other correspondence you send to us.
We do not intentionally collect special personal information — such as information about your health, religious beliefs, political persuasion, trade union membership, biometric data or criminal behaviour — unless it is necessary for a specific purpose and we have a lawful basis to do so. Where special personal information is required, we will obtain your consent or rely on another lawful basis recognised by POPIA.
How We Collect Personal Information
We may collect personal information directly from you, when you complete an application or order form, contact us by telephone, email or WhatsApp, register on our website or client portal, download or use our applications, or communicate with our support team.
We may also collect personal information from third parties, including credit bureaus where you have consented; fibre network operators and other upstream providers involved in provisioning your service; resellers and channel partners who introduce you to us; identity verification and fraud prevention services; and publicly available sources where lawful to do so.
We may collect personal information automatically through your use of our website, platforms and applications, as described in our Cookie Policy.
Where you provide us with personal information about another person, for example, the details of an employee who will use an extension, or a director whose identity must be verified, you confirm that you are authorised to do so and that you have provided that person with the information in this policy, or will do so within a reasonable time.
Why We Process Personal Information
We process personal information for the following purposes, each of which is linked to a lawful basis recognised by POPIA.
To provide our services. To onboard you, verify your identity, provision numbers and extensions, configure your Cloud PBX, port existing numbers, enable inbound and outbound calling, and deliver the features you have subscribed to. The lawful basis is the performance of our contract with you.
To comply with RICA and other legal obligations. To collect, verify and retain the documentation required by RICA before activating any service, and to comply with our obligations under the ECA, ICASA regulations, tax law, and other applicable legislation. The lawful basis is compliance with a legal obligation.
To bill and collect payment. To generate invoices, process payments, recover outstanding amounts, and manage credit risk where applicable. The lawful basis is the performance of our contract, and where credit checks are involved, your consent or our legitimate interest in managing credit risk.
To provide support and resolve faults. To investigate service issues, respond to queries, log and track support tickets, and improve our service quality. The lawful basis is the performance of our contract and our legitimate interest in improving our services.
To secure our platforms and prevent fraud. To monitor for unauthorised access, detect fraudulent applications and usage, investigate suspected abuse, and protect our network and customers. The lawful basis is our legitimate interest in protecting our business and our customers, and compliance with legal obligations.
To improve our products and services. To analyse usage patterns, test and develop new features, and conduct research. Where possible, we use aggregated or de-identified information for these purposes. The lawful basis is our legitimate interest in improving our services.
To communicate with you. To send service notifications, updates to terms and policies, and important information about your account. The lawful basis is the performance of our contract and, where relevant, compliance with a legal obligation.
To market to you. To send you information about our products and services, where you have consented to receive direct marketing, or where you are an existing customer and the marketing relates to similar products and you have not opted out. The lawful basis is your consent or our legitimate interest as permitted by section 69 of POPIA.
RICA Compliance and Identity Verification
Because we provide electronic communications services and telephone numbers, RICA requires us to collect and verify certain information before activating any service.
Before we activate a service, we must obtain and verify your full names, identity number or passport or permit number, and your residential, business or postal address. We must obtain a copy or scan of your identity document, passport, permit or other qualifying document, verify that document against the original presented, and retain the copy on record.
Where the service is provided to a juristic person, we must additionally obtain the business name, business address, registration number where applicable, the identity of the representative, a copy of that representative’s identity document, and a copy of the business letterhead or similar document.
We are required to retain this information for the duration of the service and for a period of not less than five years after the service is terminated. This retention is mandatory and overrides any request for earlier deletion.
Failure to provide the required RICA information will prevent us from activating or continuing to provide the service.
Call Records, Recordings and Monitoring
We generate and retain call detail records for every call carried over our network. These records include the originating and terminating numbers, the date, time and duration of the call, the routing path, and the applicable charges. We use these records to bill you, to investigate faults and disputes, to detect fraud and abuse, and to comply with our regulatory obligations.
We may record calls between you and our support, sales or provisioning teams for quality assurance, training, dispute resolution and compliance purposes. Where we record calls, we will notify you at the start of the call and provide you with the opportunity to object or to request that the recording be discontinued.
Where a business customer enables call recording through its Cloud PBX, the business customer is responsible for ensuring that recording is lawful, for notifying its own staff and clients as required, and for determining how long recordings are retained. In that scenario, the business customer acts as the Responsible Party in respect of the recorded content, and we act as its Operator. Recordings of this nature are stored on our infrastructure and are accessible to the business customer through its administrative portal.
We do not intercept or monitor the content of calls except where we are legally obliged to do so, where we have your consent, or where it is necessary for the legitimate purposes described above and permitted by RICA.
Number Porting
Where you port an existing number to us, we must share certain personal information with your current service provider and with the relevant number portability administrators and regulators in order to process the port. This information typically includes your identity details, the number being ported, your account details with the current provider, and the service address. We share only the information necessary to complete the port.
Similarly, if you port a number away from us to another provider, we will share the necessary information with that provider and the relevant porting authorities as required.
Cookies and Website Analytics
Our website and applications use cookies and similar technologies to operate correctly, remember your preferences, measure how our site is used, and where you consent support marketing.
Full details of the cookies we use, their purposes, and how to manage them are set out in our Cookie Policy, which forms part of this Privacy Policy.
Direct Marketing
We will only send you electronic direct marketing, by email, SMS, WhatsApp, automated telephone call or similar means — where you have consented to receive it, or where you are an existing customer and the marketing relates to similar products or services and you have not opted out.
You may opt out of direct marketing at any time by clicking the unsubscribe link in any marketing email, replying “STOP” to any marketing message, or contacting our Information Officer. Opting out of marketing does not affect service notifications, billing communications or other essential messages relating to your account, which we will continue to send.
We do not sell, rent or trade personal information to third parties for their own marketing purposes.
Sharing of Personal Information
We share personal information only where it is necessary for the purposes described in this policy, and only with parties who are subject to appropriate confidentiality and data protection obligations.
We share information with fibre network operators and upstream providers in order to provision, install, maintain and support the services you have ordered, and to resolve faults.
We share information with technology and platform providers who supply the systems we use to operate our business, which may include billing and subscriber management platforms, customer relationship management systems, email and collaboration tools, and cloud hosting providers. Where these providers process personal information on our behalf, they do so as our Operators under written agreements that require them to protect the information and to process it only on our instructions.
We share information with credit bureaus and fraud prevention services where you have consented or where we have a lawful basis, in order to assess creditworthiness and to prevent fraud.
We share information with professional advisers, including our auditors, attorneys and insurers, where necessary for the conduct of our business and subject to professional confidentiality obligations.
We share information with regulators and law enforcement where we are required to do so by law, by court order, by a lawful direction from ICASA, the Information Regulator or another competent authority, or where it is necessary to investigate or prevent a crime. Where we are permitted to do so, we will notify you before making such a disclosure.
We may share information with actual or prospective acquirers, investors or merger partners in connection with a corporate transaction, subject to appropriate confidentiality undertakings.
We do not sell personal information.
Cross-Border Transfers of Personal Information
Some of our technology providers process personal information outside the Republic of South Africa. Where we transfer personal information outside South Africa, we do so only in accordance with section 72 of POPIA.
Before making a cross-border transfer, we satisfy ourselves that the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA; or that the data subject has consented to the transfer after being informed of the potential risks; or that the transfer is necessary for the performance of a contract between us and the data subject; or that another ground recognised by section 72 applies.
Where a transfer is made to a provider on the basis of a binding agreement, we require that agreement to impose appropriate technical and organisational safeguards, confidentiality obligations, and restrictions on further transfer.
You may request information about the countries to which your personal information is transferred, and the safeguards in place, by contacting our Information Officer.
Security of Personal Information
We take appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information in our possession or under our control, and to prevent loss, damage, unauthorised destruction, and unauthorised access or disclosure.
These measures include restricting access to personal information to authorised personnel on a need-to-know basis; requiring personnel, contractors and service providers to observe confidentiality; implementing logical access controls, authentication and encryption where appropriate; maintaining audit trails and monitoring for unauthorised activity; securing the physical environments in which information is stored; maintaining back-up and disaster recovery capabilities; and training our personnel on information security and privacy.
Where we use Operators to process personal information on our behalf, we require them by written agreement to establish and maintain appropriate security safeguards, to process the information only on our instructions, and to notify us without undue delay if they become aware of a compromise.
If we become aware that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and any affected data subjects as soon as reasonably possible after discovering the compromise, in accordance with section 22 of POPIA, unless a lawful exception applies.
Retention of Personal Information
We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.
RICA documentation must be retained for the duration of the service and for at least five years after termination. Call detail records are retained for the periods required by applicable law and, where no statutory period applies, for as long as is reasonably necessary to resolve billing disputes and investigate fraud. Billing and financial records are retained for at least five years in accordance with tax and company law. Recordings of calls between you and our support teams are retained for a limited period determined by our quality assurance and dispute resolution needs, unless a longer period is required for a specific dispute or legal matter.
When personal information is no longer required, we destroy or delete it, or de-identify it, in a manner that prevents reconstruction, unless we are required by law to retain it or unless it is necessary to keep it for historical, statistical or research purposes with appropriate safeguards.
Your Rights Under POPIA
Subject to the exceptions and limitations set out in POPIA and other applicable law, you have the right to be notified that your personal information is being collected and, where the information has been obtained from another source, to be notified of that source.
You have the right to request access to the personal information we hold about you, and to be informed of the identity of all third parties who have or have had access to that information.
You have the right to request the correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, and to request the destruction or deletion of personal information that we are no longer authorised to retain.
You have the right to object, on reasonable grounds, to the processing of your personal information, and to object to processing for the purposes of direct marketing at any time.
You have the right not to be subject to a decision based solely on automated processing where that decision has legal consequences for you or significantly affects you, unless the decision is permitted by law and appropriate safeguards are in place.
You have the right to lodge a complaint with the Information Regulator of South Africa in respect of an alleged interference with the protection of your personal information.
To exercise any of these rights, please contact our Information Officer. We will respond to requests within a reasonable time and in any event within the periods prescribed by POPIA. We may require you to verify your identity before processing a request, and we may charge a fee where permitted by law for providing access to records.
Please note that some requests cannot be fulfilled, for example, where we are legally obliged to retain RICA documentation, where deletion would prevent us from providing a service you have asked us to continue providing, or where the information is subject to legal privilege or another recognised ground for refusal.
Children's Personal Information
Our services are intended for use by businesses and adults. We do not knowingly collect personal information from children without the consent of a competent person, except where this is necessary in the course of providing a service that has been lawfully requested.
Where a residential service may be used by a minor in a household, the account holder is responsible for that use. If you believe that we have collected personal information about a child without the required consent, please contact our Information Officer so that we can investigate and take appropriate steps.
Third-Party Websites and Services
Our website and platforms may contain links to, or integrations with, third-party websites, applications and services. We are not responsible for the privacy practices of those third parties.
Where we integrate with a third-party service, for example, where you choose to connect our Cloud PBX to a customer relationship management platform, the personal information that passes to that third party is governed by that third party’s privacy policy. We encourage you to review the privacy policies of any third-party services you use in connection with our services.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, changes in technology, or changes in applicable law. The updated policy will be published on our website with a revised “Last Updated” date.
Where a change materially affects the way we process your personal information, we will take reasonable steps to notify you before the change takes effect, either by email, through a notice on our website or client portal, or by another appropriate means.
Your continued use of our services after a change takes effect constitutes your acknowledgement of the updated policy, to the extent that acknowledgement is required by law.
Complaints
If you believe that we have interfered with the protection of your personal information, or that we have failed to comply with POPIA or this Privacy Policy, please contact our Information Officer first so that we can investigate and attempt to resolve the matter.
If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa.
Information Regulator (South Africa)
Website: inforeg.org.za
Email: complaints.IR@justice.gov.za
Telephone: 010 023 5200
Contact Us
If you have any questions about this Privacy Policy, or if you wish to exercise any of your rights in respect of your personal information, please contact us.
Notel – Unlimited Communication, a service product of Solbridge Holdings (Pty) Ltd.
Information Officer: [Insert Name]
Email: contact@notel.co.za
Telephone: 010 746 8925
WhatsApp: 068 630 7743
Address: 284 Oak Avenue, Ferndale, Randburg – Johannesburg, 2094
For information about how we use cookies and similar technologies, please see our Cookie Policy. For information about the acceptable use of our services, please see our Acceptable Use Policy.