Legal
Privacy notice
This notice explains how VoIP THUG, Ltd. handles personal data when you use voipthug.com or enquire about our telecommunications and contact-centre software. It is information about our practices, not legal advice.
VoIP THUG, Ltd.2nd Floor, Palm Grove House, Wickhams Cay, P.O. Box 3340, Road Town, Tortola, British Virgin Islands[email protected]Who is responsible
The controller is VoIP THUG, Ltd., 2nd Floor, Palm Grove House, Wickhams Cay, P.O. Box 3340, Road Town, Tortola, British Virgin Islands. Privacy contact: [email protected].
The public brand on this site is VoIPThug. The legal operator is VoIP THUG, Ltd.
The law that applies
We handle personal data under the British Virgin Islands Data Protection Act 2021, which came into force on 9 July 2021. The official text is published by the Government of the Virgin Islands at https://laws.gov.vg/Laws/data-protection-act-2021.
Categories of personal data
Depending on how you deal with us, we may process:
- Identity and contact data: name, company, role, email, Telegram handle, and whatever you type into an enquiry.
- Account and contract data: seats, markets, destinations, configuration, credentials we issue, and support history.
- Billing and payment data: invoices, amounts, payment states, and crypto-transfer references after a provider or chain confirms them. We do not store full payment-instrument secrets on this public site.
- Verification documents, only where a destination, carrier or law requires them for activation or a number order.
- Traffic and call-detail metadata (CDRs): timestamps, calling and called numbers or identifiers, duration, cause, and routing identifiers.
- Recordings, transcripts and quality artefacts, when a customer account is configured to keep them.
- Technical and security data: IP address, user-agent, coarse location derived from IP, cookie or similar identifiers on this site, and security logs.
Sources
We collect data from you (the website, Telegram if you choose to message us, email to the privacy contact, and the product once an account exists); from the service itself (CDRs, logs, recordings you enable); from payment or chain confirmations; and from carriers or numbering providers when they return status on traffic or number orders. We do not buy marketing lists for this site.
Purposes
We use personal data to answer enquiries, open and run accounts, route and bill traffic, issue numbers where we can, detect abuse, meet legal and carrier duties, and keep the public site available. Under the Data Protection Act 2021 we process only for a lawful purpose directly related to that work:
- Consent, where you choose to contact us or enable an optional processing (for example a recording period you configure).
- Performance of a contract, or steps you ask us to take before a contract, for provisioning, support and billing.
- A legal obligation, where a destination, tax, communications or court duty requires a record.
Whether you have to supply data, and what happens if you do not
You can read this site without identifying yourself. If you want an account, lines, numbers or support, some data is required to do the work: contact details, seats, markets, and, for some destinations, documents. If you do not supply what a destination or carrier requires, we cannot activate that part of the build. If you do not supply enough to identify an enquiry, we may not be able to reply.
How long we keep data
The periods below are maximum standard periods. We may delete sooner. A contract or a law can require a different period, including a longer one. We do not keep data “just in case” beyond these standards.
- Enquiries: up to 12 months after last contact.
- Customer, account, contract and support records: the relationship plus 6 years.
- Billing, invoices and payment records: 7 years, or longer only if a law requires it.
- Verification documents: only when required. Abandoned copies are deleted within 90 days unless a fraud or legal hold applies. Otherwise up to 5 years after the relationship where a compliance law requires the file.
- Traffic and CDR metadata: generally 12 months, unless a contract, law, security investigation or dispute requires otherwise.
- Recordings and transcripts: the period the customer configures, and their instructions. Deleted after that period or when the account ends. Backup copies are deleted within 90 days.
- Security logs: up to 12 months unless an incident or legal hold applies.
- Backups: up to 90 days.
- Legal hold: until the hold is resolved.
International transfers
The operator is in the British Virgin Islands. Providers and carriers sit in other countries. When personal data leaves the BVI we use the safeguards the Data Protection Act 2021 requires for cross-border disclosure, including contractual and security measures, and consent where that Act requires consent for the transfer.
Security
We apply access control, encryption in transit on this site, and least-privilege handling of credentials and recordings. No public site or network is invulnerable. If a breach is likely to affect you we will notify you and the relevant authority where the Act requires it.
Your rights
The Data Protection Act 2021 lets you ask us to confirm whether we hold your personal data, access it, and correct it. Where we rely on consent you can withdraw it. Withdrawal does not undo processing already lawfully done. Write to [email protected]. We may need to verify who is asking.
Complaints
If you are not satisfied you can complain to us at [email protected]. You may also complain to the authority that supervises the Data Protection Act 2021 in the British Virgin Islands.
Changes
If we change this notice we will update the date at the top of the page. Material changes to provider classes will be stated here.