Privacy notice

1. Who is responsible for your information

Telfron handles public-website enquiries and its own business administration. Its published business contact address is 2A Manurere Avenue, Auckland 0622, New Zealand. Requests can be directed to info@telfron.com with the subject ‘Privacy request’. For a purchased product or service, refer also to the supplier identified in your order and any deployment-specific privacy or processing terms.

For calls, recordings, messages and other information in a customer-controlled deployment, the customer generally determines the purpose and configuration. Telfron acts as a processor or service provider only to the extent that the agreed service involves processing that information on the customer’s behalf. Roles must be established from the actual deployment and agreement, rather than from the product label.

2. Information and sources

Website forms may receive your name, business email, organization, country, optional telephone number, requirements and enquiry text. Trial and account workflows may receive verification, request-status and activation information. Support and chat receive the information you choose to submit. Avoid sending unnecessary sensitive records, credentials or payment-card information.

Website delivery and security may involve IP addresses, request timestamps, browser information and server logs. Trial-status credentials and website preferences use browser storage as explained in the cookie and storage notice. The deployed analytics endpoint is currently unset; optional analytics must not be introduced without updating the notice and appropriate choice controls.

Information can also come from an authorized colleague, reseller, referral or customer administrator. Where New Zealand’s indirect-collection notification rule or another applicable law requires it, the required notice must be provided unless a lawful exception applies. Relevant notices may identify the source, purposes, recipients and individual rights. Product data and billing fields depend on the service and applicable agreement.

3. Purposes and legal grounds

Information is used to respond to enquiries, arrange requested evaluations, administer accounts and orders, deliver support, protect services, investigate misuse and meet applicable recordkeeping duties. Collect only information needed for the identified purpose.

Where EU or UK data-protection law applies, assess a lawful basis for each activity: requested pre-contract steps or contract performance where necessary; legal obligation for mandatory records; consent for optional analytics or communications where required; and legitimate interests for proportionate business enquiries and security, subject to a balancing assessment. Contract is not a blanket basis for every activity, and sensitive information requires additional conditions.

Marketing permissions are separate from required service communications. You may object to direct marketing or withdraw an optional permission without losing access to essential website functions. Contact info@telfron.com if you do not want marketing communications; requested service and account messages may still be necessary.

4. Recipients and suppliers

Information may be handled by authorized personnel and service providers supporting website hosting, email, support, accounts or payment workflows, and by advisers or authorities where required by law. Access should be limited to the relevant purpose. For a deployment review, ask info@telfron.com for the relevant provider and location information before submitting sensitive data or enabling an integration.

Live chat is loaded from Telfron’s licensing/support domain independently of optional analytics consent. Opening or using chat may transmit technical information and your submitted conversation to that service. Do not submit sensitive information through chat without first establishing the service’s processing arrangements. Questions about chat storage, retention and providers can be directed to info@telfron.com. We do not sell information submitted through public website enquiries.

5. International processing

Data location depends on the website service, supplier and customer deployment. An on-premises PBX does not by itself establish that every account, support or AI-related processing activity stays in the same country.

Applicable transfer rules must be assessed before information is disclosed internationally. New Zealand disclosures may require comparable safeguards or another permitted basis under Information Privacy Principle 12. Restricted EU or UK transfers may require an applicable adequacy decision or contractual transfer mechanism and, where appropriate, assessment and supplementary safeguards. The relevant mechanism must be established for the actual transfer. This page does not assert that a particular transfer agreement has been executed for every service.

6. Retention and deletion

Information is retained only as long as reasonably necessary for the purpose for which it was collected, an ongoing enquiry or support matter, account or contractual administration, proportionate security needs, and applicable legal recordkeeping or dispute obligations. These criteria apply separately to enquiries, support/chat, account and billing records and security logs; they do not create a uniform retention period for every record. Ask info@telfron.com about the retention applicable to a particular record or service, or submit a deletion request where the law permits.

Customer deployments should define their own recording, transcript and message retention. Service expiry, deletion and backup rotation must be covered by the relevant agreement and operational schedule. Browser-storage details are listed separately; a trial tracking session’s expiry does not automatically delete its underlying request record.

7. Security and incidents

Security should reflect the information, risks and service involved. Deployment responsibilities include access permissions, authentication, patching, protected transport, backup/recovery and incident escalation. Specific implemented controls and any independent assurance must be documented for the relevant service.

Where a breach triggers a legal notification duty, the responsible organization must assess the event and notify the appropriate regulator and affected individuals within the applicable requirements. For New Zealand, notification of a notifiable breach is required as soon as practicable; the Commissioner’s 72-hour expectation is guidance, not a universal deadline for every country. Processor notification duties and contact paths belong in the processing agreement.

8. Your rights and complaints

You may request access to or correction of information and raise a privacy concern. Where the law applies, additional rights can include erasure, restriction, portability, objection and withdrawal of consent. Rights have conditions and exceptions; withdrawing consent does not undo earlier lawful processing.

Send a request to info@telfron.com describing the information and service involved. Reasonable verification may be needed, but unnecessary identity documents should not be requested. For a customer-controlled PBX, contact that customer first; assistance by Telfron depends on its role. New Zealand access and correction decisions generally have a 20-working-day timeframe, subject to permitted extensions. EU/UK requests generally have a one-month timeframe, subject to applicable extensions and exceptions.

You may complain to the New Zealand Office of the Privacy Commissioner or another competent supervisory authority where applicable. You do not have to give up that right by contacting Telfron first.

9. AI and sensitive information

A customer may enable transcription, summaries, AI reception or external AI services. Determine the provider, data categories, location, retention, training restrictions, human oversight and contract terms before enabling a workflow. Provider-specific arrangements govern those activities; this page does not claim that all AI providers have the same training or retention policy.

The public business website is not intended to solicit children’s information. Education and healthcare deployments require a separate assessment of children’s or health information and applicable sector rules. Do not submit such information through ordinary sales forms. Identify and assess any decision made solely by automated processing that has legal or similarly significant effects; routine reception is not a substitute for that assessment.

10. Scope and changes

This notice is effective from 8 October 2026 and will be updated when purposes, suppliers, transfers or material data practices change. Material changes will be dated on this page and communicated appropriately. Deployment-specific processing terms and supplier notices should be supplied alongside it where applicable. This notice is not a statement of compliance with every law in every jurisdiction.

11. Recruitment applications

When you apply for a Telfron role, we receive the CV, contact details, experience, portfolio links and other information you choose to submit. We use it to assess your suitability, communicate about the role and administer recruitment. Share only role-relevant information; do not send identity numbers, banking details or sensitive personal documents in an initial application.

Application information may be reviewed by personnel involved in recruitment and relevant business communication providers. Retention is assessed against the recruitment process, follow-up, applicable recordkeeping and dispute needs. Keeping information for future opportunities requires appropriate notice and permission where required. Access, correction and other applicable requests can be sent to info@telfron.com with the subject ‘Applicant privacy’.

The employing entity, work location and employment arrangements are identified during recruitment and in any written offer. For an EU or UK applicant where the law applies, the legal basis is assessed according to the activity, including requested pre-contract steps and proportionate recruitment administration. Sensitive information needs any additional legally required conditions.