PRIVACY POLICY

1. INTRODUCTION, SCOPE, AND IDENTITY OF THE DATA CONTROLLER

1.1. The present Privacy Policy ("Policy") sets out how personal data is collected, processed, stored, disclosed, and protected in connection with the Unitell mobile application ("Application") and the outbound voice-over-IP calling service delivered through it ("Service"). Its preparation has followed Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "General Data Protection Regulation" or "GDPR"), the Swedish Data Protection Act (Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning), Chapter 9 of the Swedish Electronic Communications Act (Lag (2022:482) om elektronisk kommunikation, the "LEK"), and Directive 2002/58/EC on privacy and electronic communications, as those instruments bear upon a provider established in Sweden.

1.2. Responsibility for determining the purposes and means of the processing described below rests with the following Data Controller:

Company: Unitell AB. Registration number (organisationsnummer): 559590-7972. Registered office: Aprilgatan 26, 415 48 Göteborg, Sweden. Telephone: +46 72-300 62 36.

Email:support@unitell.net.

Website:https://www.unitell.net.

1.3. Unitell AB is a limited liability company (aktiebolag) incorporated under the Swedish Companies Act (Aktiebolagslag (2005:551)) and entered in the register maintained by the Swedish Companies Registration Office (Bolagsverket). With effect from 5 September 2026, the company has assumed the role of Data Controller in place of the individual identified as such in the version of this Policy dated 5 February 2026. Users who registered before the transition need take no action, and the purposes, legal bases, and retention periods applicable to their personal data are those set out in the sections that follow.

1.4. Sweden constitutes the principal jurisdiction for the governance of data protection within the company. Two authorities exercise supervision over different aspects of the activity described here, and their respective competences, together with the procedure for lodging a complaint, appear in Section 13.

1.5. Reading the Policy in full before creating an Account is recommended. Registration, the purchase of Call Credits, and the placing of a call each proceed on the footing that the User has been informed of the practices described below.

1.6. The Application is an over-the-top service: it runs upon an internet connection the User already holds, and neither that connection, nor a mobile subscription, nor a telecommunications network of the company's own forms part of what is supplied, carriage beyond the company's platform being procured from wholesale voice carriers. Calls to 112, and to any other national emergency number, cannot be placed through the Application, and no caller location information is made available to an emergency service through it, so an alternative means of reaching the emergency services must be kept available at all times.

2. CATEGORIES OF PERSONAL DATA COLLECTED

2.1. Registration with the Service has been designed to require as little personal data as the delivery of a prepaid calling service permits. A mobile telephone number is the only mandatory item; neither a name nor an email address conditions access. Depending on how the User interacts with the Application, the following categories arise:

a. Registration Data: the mobile telephone number supplied at sign-up, together with its country code, which serves as the sole compulsory identifier of the Account.

b. Verification Data: the one-time password ("OTP") sent to the number under verification, the time of issue, the delivery status reported by the messaging gateway, and the result of the verification attempt, each held on the company's systems for the brief interval stated in Section 9.1(b).

c. Optional Profile Data: a display name, an email address, or comparable details, where the User chooses to provide them for convenience or in the course of contacting support. None of those fields is required, and an Account remains fully functional without them.

d. Call Data Records: for each call placed through the Service, the number dialled, the destination country and network type, the moments at which the call began and ended, its duration, the credit consumed, and the technical outcome of the connection attempt. Audio content forms no part of these records, as Section 4 explains.

e. Transaction and Billing Data: records of Call Credit purchases completed through Apple Pay, Google Pay, or the billing facility of the relevant application store, comprising the transaction reference, the amount, the currency, and the date and time of purchase. Card numbers, bank credentials, and comparable payment instruments are handled by the payment provider alone and do not reach Unitell AB.

f. Credit Transfer Data: where Call Credits are transferred from one registered Account to another, the identifiers of the sending and receiving Accounts, the quantity transferred, and the time of the transfer, recorded for accounting purposes and for the detection of fraud.

g. Technical and Connection Data: the IP address from which the Application connects, unique device identifiers, device model, operating system and version, Application version, the SIP signalling parameters needed to establish and release a call, language and time-zone settings, the diagnostic logs generated when a fault occurs, and the number of failed verification attempts recorded against a telephone number.

h. Push Notification Data: once the notification feature has been activated, the push token issued by the operating system of the User's device, held for the delivery of service messages such as low-balance warnings and security alerts.

i. Support Correspondence: the content of messages exchanged with the support team, including attachments and the associated metadata, kept in order to resolve the matter raised and to evidence how a complaint was handled.

2.2. Access to the contact list held on the User's device stands outside the categories listed above, because nothing read from that list reaches the company. Section 5 describes the permission and its limits.

2.3. Special categories of personal data within the meaning of Article 9 of the GDPR are neither sought nor knowingly collected. Should information of that nature reach the company inadvertently, for instance through a free-text message to support, it will be erased promptly upon identification unless a lawful basis for keeping it exists.

2.4. Should further digital connectivity products be introduced at a later stage, such as eSIM profiles or mobile data packages, additional categories may become necessary, among them device EID identifiers, activation records, and data-volume counters. No collection of that kind will begin before the Policy has been amended under Section 14 to describe the categories, the purposes, and the legal bases involved.

3. HOW PERSONAL DATA IS OBTAINED

3.1. Most of the data described above originates with the User: the telephone number is typed at registration, the credit is bought through a deliberate act, and a call is placed by choice.

3.2. A second stream is generated automatically by the operation of the Application and of the network that carries the traffic. Signalling parameters, connection records, and diagnostic logs arise as a technical consequence of establishing a call and cannot be suppressed without suppressing the Service itself.

3.3. A third and narrow stream reaches the company from its suppliers: a messaging gateway reports whether an OTP was delivered, the payment provider confirms whether a transaction succeeded, and a carrier may report the technical cause of a failed call. No supplier furnishes personal data for any purpose beyond the one for which it was engaged.

4. CONFIDENTIALITY OF COMMUNICATIONS AND ABSENCE OF CALL RECORDING

4.1. Unitell AB does not record, listen to, transcribe, or store the audio content of any call placed through the Service. Media streams travel under the Secure Real-time Transport Protocol (SRTP) and signalling under Transport Layer Security (TLS), with the consequence that the substance of a conversation is not available to the company at any point, whether during the call or afterwards.

4.2. Confidentiality of that kind is not merely a matter of policy. Article 5 of Directive 2002/58/EC and Chapter 9, Section 27 of the LEK prohibit listening to, intercepting, storing, or otherwise placing under surveillance the communications of others without the consent of the users concerned or another lawful ground. The prohibition binds the company's own personnel as it binds any third party, and access to production systems is granted accordingly.

4.3. What the company does process is the metadata described in Section 2.1(d), being the information required to route a call, to bill it correctly, and to investigate faults or abuse. Metadata of that nature is not the content of a communication, yet it remains personal data and receives the protection that this Policy describes.

5. ACCESS TO THE CONTACT LIST STORED ON THE USER'S DEVICE

5.1. The Application may ask for permission to read the phonebook held locally on the User's device. Its object is confined to display: contacts appear inside the Application so that a number can be selected rather than typed.

5.2. No copy of the contact list is uploaded to, transmitted to, or stored on any server operated by or for Unitell AB. Reading takes place on the device, the result stays on the device, and the names and numbers of third parties held in the phonebook are therefore not processed by the company at all. No entry taken from the phonebook is messaged, invited, matched against other Users, or put to any promotional use.

5.3. Reading information held on a User's terminal equipment is regulated by Chapter 9, Section 28 of the LEK, and the permission is accordingly sought through the dialogue presented by the operating system. Refusal is available at the outset, withdrawal is available afterwards through the privacy settings of the device, and the only consequence of either is that numbers must be entered by hand.

6. PURPOSES AND LEGAL BASES FOR PROCESSING

6.1. Every operation described in this Policy is confined to a specified, explicit, and legitimate purpose, as Article 5(1)(b) of the GDPR requires, and each rests on one of the lawful bases enumerated in Article 6(1):

a. Performance of a contract (Article 6(1)(b) GDPR): registration and OTP verification, the establishment and routing of calls, the calculation and deduction of Call Credits, the execution of transfers between registered Accounts, and the handling of purchases all constitute the service the User has asked for, and none of them can be delivered without the corresponding data.

b. Compliance with a legal obligation (Article 6(1)(c) GDPR): accounting material is retained under the Swedish Bookkeeping Act (Bokföringslag (1999:1078)); obligations arising under the LEK are met on the same footing, as are duties concerning the prevention of fraud and, where applicable to the company, measures against money laundering; and requests from competent authorities are answered where a binding duty to answer exists.

c. Legitimate interests (Article 6(1)(f) GDPR): protection of the network and of Users' Accounts against fraudulent registration, credit theft, artificial inflation of traffic, and unauthorised access serves interests that the company may properly pursue, as does the diagnosis of technical faults and the improvement of call quality. A balancing exercise has been carried out for each such purpose, and the conclusion reached is that the interests pursued are not overridden by the rights and freedoms of the persons concerned, in particular because the data relied upon is limited to what the operation of a telephony service ordinarily generates and is never enriched from external sources.

d. Consent (Article 6(1)(a) GDPR): access to the device phonebook, the delivery of push notifications once that feature is enabled, and any analytics or promotional processing introduced later depend upon consent, given freely and withdrawable at any moment without effect on the lawfulness of what preceded the withdrawal.

6.2. Where a call is placed to a destination outside the European Economic Area, transmission of the dialled number to the carriers who complete it forms part of the very service requested. Section 8 addresses the consequences of that transmission under Chapter V of the GDPR.

6.3. Personal data collected for one of the purposes above is not repurposed. Should the company ever contemplate processing for a purpose other than that for which the data was obtained, Article 6(4) of the GDPR will be applied and the User informed beforehand.

7. RECIPIENTS AND CATEGORIES OF RECIPIENT

7.1. Disclosure occurs only where the delivery of the Service or a legal duty requires it. Personal data is not sold, rented, or traded, and no marketing, advertising, or behavioural profiling tool operates within the Application or on the Website at the date of this Policy.

7.2. Recipients fall into the categories set out below. Suppliers are identified by function rather than by name, so that a supplier may be replaced without the Policy becoming inaccurate; replacement never reduces the level of protection afforded to personal data, and the identity of a current supplier will be disclosed on request:

a. Messaging gateways: delivery of an OTP to the number under verification is carried out by one or more third-party providers of text messaging, each engaged as a processor upon the company's documented instructions. Nothing beyond the destination number and the code itself passes to such a provider, and the records a provider generates in the course of delivery are kept under the terms of the processing agreement concluded with it.

b. Hosting and database infrastructure: the servers and databases supporting the Service are operated by an enterprise cloud infrastructure provider whose facilities used for this purpose are located in Germany, within the European Union. The provider acts as a processor.

c. Wholesale telecommunications carriers: carriers engaged to complete outbound calls receive the calling and dialled numbers together with the signalling data needed to set up the connection. Carriers determine for themselves the records they must keep under the law of their own jurisdiction and act, in that respect, as independent controllers.

d. Payment providers: Apple Pay, Google Pay, and the billing services of the application stores process purchase transactions as independent controllers, subject to Directive (EU) 2015/2366 on payment services and to their own published privacy terms.

e. Push notification providers: upon activation of the feature, a third-party notification service will transmit service messages to registered devices, acting as a processor.

f. Professional advisers: legal, accounting, and audit advisers obtain access to limited data where it is needed to establish, exercise, or defend a legal claim, or to satisfy a regulatory requirement.

g. Competent authorities: courts, supervisory authorities, and law enforcement bodies receive data where a binding order or an obligation under Swedish or Union law compels disclosure. Each request is examined for validity and proportionality before any data is released.

7.3. Every processor is bound by a written agreement satisfying Article 28(3) of the GDPR, which restricts processing to the company's instructions, imposes confidentiality on authorised personnel, requires appropriate security measures, and governs the return or deletion of data at the end of the engagement.

8. INTERNATIONAL TRANSFERS OF PERSONAL DATA

8.1. Storage of personal data takes place within the European Economic Area ("EEA"), on infrastructure located in Germany. Three situations nevertheless give rise to processing beyond that territory, and each is described here rather than left to inference.

8.2. Remote technical support. Maintenance and technical support may on occasion be performed by personnel connecting from outside the EEA. Access of that kind is limited to what the intervention requires, is granted for the duration of the intervention alone, is logged, and falls under the safeguards listed in Section 8.5.

8.3. Call routing. A call to a destination outside the EEA cannot be completed without passing the dialled number and the associated signalling data to the carriers who handle transit and termination. Transfers of that nature are necessary for the performance of a contract concluded at the User's own request, and where the safeguards in Section 8.5 cannot be applied to a particular route, the company relies upon Article 49(1)(b) of the GDPR. A User who prefers that no such transfer occur may refrain from dialling destinations outside the EEA.

8.4. Delivery of verification messages. A one-time password addressed to a mobile number allocated outside the EEA reaches its destination through the networks serving that number, and the number together with the code passes to the operators concerned as an unavoidable incident of delivery. Transmission of that kind implements a pre-contractual measure taken at the User's own request, and Article 49(1)(b) of the GDPR is relied upon where the safeguards in Section 8.5 do not extend to a particular route.

8.5. Where an appropriate safeguard is available, the company relies upon one of the following:

a. Adequacy: transfer to a country or territory in respect of which the European Commission has adopted an adequacy decision under Article 45 of the GDPR.

b. Standard Contractual Clauses: the clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, supplemented, where a transfer impact assessment so indicates, by additional technical and organisational measures.

c. Binding corporate rules: rules approved under Article 47 of the GDPR, where the recipient operates under such rules.

8.6. Information about the safeguard applicable to a particular recipient, and a copy of the relevant clauses with commercially confidential terms redacted, may be requested atsupport@unitell.net.

9. RETENTION PERIODS

9.1. Personal data is kept no longer than the purpose that justified its collection requires, or than the law demands. The periods applied are as follows:

a. Registration and Optional Profile Data: kept while the Account remains open and for twelve (12) months after its closure, so that a dispute arising from the final period of use can still be resolved.

b. Verification Data: the one-time password and the verification log associated with it are held on the company's servers for thirty (30) minutes from the moment the code is issued, and are erased once that interval has elapsed. Delivery of the message itself rests with the providers identified in Section 7.2(a), and a record generated in their systems falls under the arrangements described there rather than under the period stated in this point.

c. Call Data Records: kept for six (6) months from the date of the call, for billing, fraud prevention, and the resolution of disputes, and deleted once that period has run.

d. Transaction, Billing, and Credit Transfer Data: kept as accounting material until the end of the seventh year following the end of the calendar year in which the financial year concerned was closed, as Chapter 7, Section 2 of the Swedish Bookkeeping Act requires.

e. Technical and Connection Data: kept for twelve (12) months from collection, unless a security investigation, a pending dispute, or a legal obligation requires a longer period in the individual case.

f. Push Tokens: kept until the User disables notifications, uninstalls the Application, or the token is invalidated by the operating system.

g. Support Correspondence: kept for twenty-four (24) months from the last message in the relevant exchange.

h. Device Contact Lists: not retained at any point, since no copy of a contact list reaches the company's systems.

9.2. Expiry of a period is followed by secure erasure or by irreversible anonymisation carried out in a manner that prevents reconstruction or re-identification. Because no recording of call audio is ever made, no retention period arises for the content of a conversation.

9.3. Where deletion is technically deferred by a backup cycle, the data concerned is isolated from active processing until the cycle completes and the deletion becomes effective throughout.

10. SECURITY OF PROCESSING AND PERSONAL DATA BREACHES

10.1. Technical and organisational measures appropriate to the risk are implemented under Article 32 of the GDPR. Among them:

a. Encryption of communications: signalling protected by TLS and media by SRTP, with traffic between the Application and the company's servers encrypted in transit.

b. Access control: access to production data restricted on a need-to-know basis, granted to identified individuals, and subject to authentication controls.

c. Logging and separation: administrative access recorded, and production environments kept separate from development and test environments.

d. Review: periodic reassessment of the measures in force, having regard to the nature, scope, context, and purposes of the processing and to the risks presented.

10.2. A personal data breach likely to result in a risk to the rights and freedoms of natural persons will be notified to the competent supervisory authority under Article 33 of the GDPR without undue delay and, where feasible, within seventy-two (72) hours of the company becoming aware of it. Where the breach is likely to result in a high risk, the Users concerned will be informed under Article 34. To the extent the company qualifies as a provider of publicly available electronic communications services, Commission Regulation (EU) No 611/2013 of 24 June 2013 applies in addition and shortens that deadline to twenty-four (24) hours from detection where compliance within that time is feasible.

10.3. No method of transmission over the internet and no system of electronic storage is wholly invulnerable. Users are accordingly asked to protect the device on which the Application is installed, to keep the mobile subscription associated with the verified number under their own control, and never to disclose an OTP to another person, including to anyone claiming to represent the company.

11. RIGHTS OF THE DATA SUBJECT

11.1. The GDPR confers the following rights, each exercisable by a request addressed to support@unitell.net. from, or in a manner that allows verification against, the telephone number registered to the Account:

a. Right of access (Article 15 GDPR): confirmation of whether personal data concerning the User is being processed and, where it is, access to that data together with information on the purposes, the categories concerned, the recipients, and the envisaged retention period.

b. Right to rectification (Article 16 GDPR): correction of inaccurate data without undue delay, and completion of incomplete data by means of a supplementary statement.

c. Right to erasure (Article 17 GDPR): deletion where the data is no longer necessary for the purposes pursued, where consent has been withdrawn and no other basis applies, or where the processing has been unlawful, subject always to the retention obligations described in Section 9.

d. Right to restriction (Article 18 GDPR): restriction of processing where accuracy is contested, where processing is unlawful but erasure is not desired, or where the data is needed for a legal claim.

e. Right to data portability (Article 20 GDPR): receipt of data provided to the company, in a structured, commonly used, and machine-readable format, and transmission of it to another controller without hindrance.

f. Right to object (Article 21 GDPR): objection, on grounds relating to the User's particular situation, to processing founded on legitimate interests, whereupon processing ceases unless compelling legitimate grounds are demonstrated that override the interests, rights, and freedoms of the User.

g. Right to withdraw consent: withdrawal of any consent given, at any time, without effect on the lawfulness of processing carried out before the withdrawal.

h. Right not to be subject to automated decision-making (Article 22 GDPR): freedom from decisions based solely on automated processing that produce legal or similarly significant effects. Automated checks are used to detect fraud, yet a decision to suspend an Account is reviewed by a person before it becomes final, and the User may contest it.

11.2. Requests are handled free of charge and answered without undue delay, in any event within one (1) month of receipt, as Article 12(3) of the GDPR requires. Where a request is complex, or where several requests have been received, the period may be extended by a further two (2) months, provided the User is told of the extension and of the reasons for it within the first month.

11.3. Where reasonable doubt exists as to the identity of the person making a request, additional information may be sought under Article 12(6) of the GDPR. Any such measure will be proportionate, and it will not be used to obstruct the exercise of a right.

12. USERS BELOW THE AGE OF EIGHTEEN

12.1. The Application carries an age rating of 9+ in the application stores through which it is distributed. Access by a young person is nevertheless conditional: a User who has not reached the age of eighteen (18) may use the Service, and may purchase Call Credits, only with the consent of a parent or legal guardian and under that person's supervision.

12.2. The condition follows from Chapter 9, Section 1 of the Swedish Children and Parents Code (Föräldrabalk (1949:381)), under which a person below the age of majority may not, as a general rule, incur obligations without the approval of the guardian. A purchase made in disregard of that rule may be set aside in accordance with the same Code, and a request to that effect will be handled under the refund provisions of the Terms and Conditions.

12.3. Where processing of a minor's personal data rests on consent within the meaning of Article 8 of the GDPR, in relation to information society services offered directly to a child, Chapter 2, Section 4 of the Swedish Data Protection Act fixes the relevant age at thirteen (13) years; below that age, consent must be given or authorised by the holder of parental responsibility. Processing necessary for the performance of the contract does not depend on that provision and rests instead on Article 6(1)(b) of the GDPR together with the guardian's approval of the contract itself.

12.4. A parent or legal guardian who learns that a minor has used the Service without the approval required above may write to support@unitell.net. The Account will be suspended and the associated personal data erased, save where a retention obligation identified in Section 9 prevents erasure of a particular record.

13. SUPERVISORY AUTHORITIES AND COMPLAINTS

13.1. Without prejudice to any other administrative or judicial remedy, every User has the right under Article 77 of the GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of habitual residence, of place of work, or of the alleged infringement.

13.2. In Sweden, questions concerning the processing of personal data fall to:

Integritetsskyddsmyndigheten (IMY): Box 8114, 104 20 Stockholm, Sweden; telephone +46 8 657 61 00; email imy@imy.se; website https://www.imy.se.

13.3. Questions concerning the confidentiality of electronic communications, the processing of traffic data, and the storing of or access to information in terminal equipment fall to:

Post- och telestyrelsen (PTS): Box 6101, 102 32 Stockholm, Sweden; telephone +46 8 678 55 00; email pts@pts.se; website https://www.pts.se.

13.4. A User resident in another EEA Member State may equally address the national data protection authority of that State, which will act as the point of contact irrespective of where the matter is subsequently handled.

13.5. Recourse to a supervisory authority leaves intact the right to an effective judicial remedy against a supervisory authority under Article 78 of the GDPR and against a controller or processor under Article 79.

14. AMENDMENTS TO THIS POLICY

14.1. The present version replaces the version dated 5 September 2026 in its entirety. Further amendments may be made from time to time to reflect changes in processing activities, in the technical arrangements supporting the Service, or in the applicable law.

14.2. A material amendment will be notified through the Application, or by message to the telephone number registered to the Account, no fewer than thirty (30) calendar days before it takes effect. Where an amendment introduces processing that depends on consent, that consent will be sought before the processing begins.

14.3. The current version is published at https://www.unitell.net,14.3. The current version is published at

15. CONTACT

Enquiries, requests concerning the rights described in Section 11, and complaints relating to the processing of personal data may be addressed to:

Company: Unitell AB. Registration number (organisationsnummer): 559590-7972. Registered office: Aprilgatan 26, 415 48 Göteborg, Sweden. Telephone: +46 72-300 62 36.

Email: support@unitell.net.

Website: https://www.unitell.net.

The present Privacy Policy was last updated on 11 September 2026.