Business Privacy Policy

Who we are, and how to reach us

TISA Business is the business division of TISA, operated by 9Eons Limited, registered in England and Wales, company number 06393882, VAT number GB 920 145 856. Registered address: Luminous House, 300 South Row, Milton Keynes, MK9 2FR, United Kingdom.

For the services described in this notice, 9Eons Limited is the data controller except where clause 2 says otherwise.

We comply with UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and applicable Ofcom and ICO guidance.

When you are the controller, not us

This is the part a business buyer needs first, and it is the part a general privacy policy does not cover. Your contract with us already sets it out; this states it plainly.

Where we are your processor

A Data Processing Agreement governs that processing. It forms part of your business terms and is available on request. It includes audit rights, so you or your representative can verify our compliance, subject to reasonable notice and confidentiality. We may engage sub-processors to deliver the service. We keep an up to date list, available on request, and we impose equivalent data protection obligations on all of them.

What we collect

What we hold depends on which services you take and how your team uses them.

We do not process the personal data of people outside your organisation beyond what is technically necessary to set up and route a call.

Why we process it, and on what basis

Where we rely on consent you may withdraw it at any time, and that does not affect processing lawfully carried out before you withdrew it.

Call recordings and voicemail

Cloud PBX includes 1 GB of call recording storage on every account, kept for 30 days. Larger retention tiers are available if you need recordings kept longer, and they are priced in the schedule of charges.

Recordings and voicemail are stored in the UK region only and are encrypted at rest using AES-256-GCM.

Who we share it with

We share personal data only where it is necessary to deliver the service, where the law requires it, or with your own administrators.

• Your administrators. The people you designate can see account level data relevant to administration and billing.
• Infrastructure providers. Amazon Web Services, in UK regions, hosts the platform. Data is stored and processed in the United Kingdom.
• Network and delivery partners. Mobile services run on the EE network. Message delivery partners carry business messages to the recipient network.
• Payment providers. Card and direct debit processing is carried out by regulated payment providers, who hold the payment details rather than us.
• Law enforcement and regulators. Where we are required by law to disclose, including under the Investigatory Powers Act 2016. We are prohibited from disclosing the existence of a specific warrant or notice.

We do not sell personal data, and we do not share it for anyone else to market to you.

Where it is held, and transfers

Data is held primarily in the United Kingdom and the EEA, and the platform runs in UK regions. We do not routinely transfer personal data outside the United Kingdom.

Where a transfer outside the UK becomes necessary, we use UK Standard Contractual Clauses or the UK International Data Transfer Agreement, an adequacy decision, or binding corporate rules, and we will tell you where we are required to.

How long we keep it

Call detail records and business account data are different categories with different periods. After the relevant period expires, data is securely deleted or anonymised.

How we protect it

• In transit. TLS for signalling, and SRTP is compulsory for audio and media.
• At rest. AES-256-GCM for stored data, including recordings and voicemail held in the UK region.
• Access. Least privilege, separation between customers, and logging of administrative access.
• The network. The measures required by the Telecommunications (Security) Act 2021 and the Electronic Communications (Security Measures) Regulations 2022, described in clause 22 of the business terms.

No system is completely secure. Keep your credentials confidential and tell us promptly if you suspect unauthorised access.

If something goes wrong

There are two clocks, and they are different.

Where a breach is high risk to you, we notify you directly and without undue delay, whichever role we are in.

Profiling and automated decisions

We do not make decisions about you by automated means that produce legal effects or similarly significant effects. We do not profile you for advertising, and we do not use your calling, messaging or account data to build a marketing profile.

Marketing

In compliance with PECR we send marketing only where you have opted in. Every message carries a way out: reply STOP to a text, or use the unsubscribe link in an email. You can also opt out by contacting Business Support. Opting out does not stop the essential service messages we have to send you, such as a notice about your bill or an outage.

Your rights

Under UK GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict how we process it, to object to processing, to portability, and to withdraw consent where processing relies on consent.

To exercise any of them, write to [email protected], copying [email protected]. We respond within 30 days. We may need to verify your identity, and where the request concerns data held under a business account we may need to confirm it with your Account Administrator.

Complaints

If you are unhappy with how we have handled your personal data, tell us first at [email protected] so we have the chance to put it right.

You also have the right to complain to the Information Commissioner at ico.org.uk, or on 0303 123 1113. Complaining to us first does not affect that right.

A complaint about the service itself, rather than about data, follows a different route, with free alternative dispute resolution for qualifying businesses. That is set out in clause 11 of the business terms.

Changes to this policy

We may update this policy. Where a change is material we will tell you, and the date at the top of this page always shows the version in force. This version is effective from 8 September 2026.

TISA Business is a service of 9Eons Limited, registered in England and Wales, company 06393882, VAT GB 920 145 856, at Luminous House, 300 South Row, Milton Keynes, MK9 2FR. See also the business terms and conditions and the business cookie policy.