Privacy Policy

SecondRing Privacy Policy

A quick guide to how we look after your information

We know your data is personal, and we treat it that way. This Privacy Policy explains how SecondRing (“we”, “us”, “our”) collects, uses and protects information about you when you use our website, apps and communication services.

We’ll only use your information where we have a lawful reason to do so and in line with UK data protection law, including the UK GDPR and Data Protection Act 2018.

This Privacy Policy provides information about our use of personal data. It is not a contract and does not replace any consent that may be required for a particular activity.

Last updated: 18 September 2026

1. Who we are

SecondRing.co.uk is responsible for the personal data described in this Privacy Policy. We act as a data controller for personal data that we collect and use for our own purposes, including account administration, billing, fraud prevention and operation of our services.

Where a business customer uses our service to handle communications concerning its own clients, staff or contacts, that customer will normally be the controller of that personal data and we may act as its processor. The precise roles depend on the circumstances and the applicable service.

If you have any questions about this policy or how we handle your data, you can contact us at:
📧 [email protected]

2. What this policy covers

This Privacy Policy applies to:

Our website secondring.co.uk and any related admin portals or web tools,
Our mobile and desktop apps used with SecondRing, and
Our VoIP, softphone and related telecom services.

It does not cover other websites or services you reach via links from our site or apps. Those have their own privacy policies – always check those before sharing data with them.

3. Key definitions

“Account” – your SecondRing account used to access our services and manage your numbers, plans, and settings.
“Site” – our website at secondring.co.uk and any associated portals.
“Cookies” – small text files placed on your device to help our site and apps work, remember preferences, and understand how they are used.

4. What data we collect

The information we collect depends on how you use SecondRing.

4.1 Information you give us

You may provide information when you:

Create or manage a SecondRing account
Subscribe to a plan or make a payment
Contact our support team
Use our apps or portals
Sign up for marketing or newsletters

This may include:

Name and contact details (email, phone number, address)
Business / company name and role
Login details (username, login history)
Billing and payment information (e.g. last 4 digits, transaction details – we do not store full card details ourselves if a third-party processor is used)
Preferences for marketing and communication
Any other information you choose to share in forms, tickets or emails

4.2 Information we collect automatically

When you use our site, apps or services we automatically collect certain data, such as:

IP address
Device type, operating system, browser type and version
Dates, times and duration of visits
Pages you view and links you click
App usage data and crash logs

4.3 Communications usage data

Because we provide telecom and VoIP services, we also process communications usage information, for example:

Numbers dialled and numbers calling you
Date, time, duration and type of call or message
Call direction (inbound / outbound / forwarded)
Call completion status
IP address and technical routing information
Amount of usage against your plan

We use this information for billing, fraud prevention, troubleshooting, compliance and to deliver the service itself.

4.4 Communications content

Depending on the features you use, we may process communications content, such as:

Voicemail recordings
Call recordings (if you enable them)
SMS / message content sent via our platform
Any other recorded or stored media transmitted using our services

We process this content to transmit, deliver, store or make it available as part of the service. Content may pass through, or be temporarily stored by, our telecommunications, application, hosting and network providers.

Standard SMS is not an end-to-end encrypted communication method. Customers should not use SMS for information requiring end-to-end encryption or for highly sensitive information unless they have independently assessed that SMS is appropriate for their use case.

Where deletion or retention settings are available, they will be described within the applicable service or account settings. Deleting content from an app or active account does not necessarily remove it immediately from security backups, disaster-recovery systems, carrier systems or records that we must retain by law.

4.5 App and device permissions

Our apps may ask for permissions on your device (you can allow or deny these):

Contacts – to show your phone contacts inside the app and let you call them easily
Microphone – for making and receiving calls
Camera – for video calls or adding images (where supported)
Storage – to store app data and voicemails/recordings locally
Phone state – to manage call behaviour
Location (optional) – for features that use position or to meet regulatory requirements in some regions

You can change these permissions in your device settings at any time. Some features may not work without certain permissions.

5. Legal bases for using your data

We only use your personal data when we have a lawful basis to do so. This will usually be one or more of the following:

Contract – to set up and deliver the services you’ve asked for (e.g. provide a phone number, process calls, bill you).
Legal obligation – to meet legal or regulatory requirements (e.g. law enforcement requests, telecom regulations, tax rules).
Legitimate interests – to run and improve our business in a way that doesn’t unfairly impact your rights (e.g. prevent fraud, improve our services, basic analytics, customer support, network security).
Consent – for certain optional things such as email marketing or specific app permissions. You can withdraw your consent at any time.

6. How we use your data

We may use your information to:

Create and manage your SecondRing account
Provide and maintain our telecom and app services
Route, connect and record calls/messages where you have enabled those features
Process payments, manage invoices and handle billing queries
Communicate with you about your account, service updates or important notices
Provide customer support and troubleshoot issues
Detect, investigate and prevent fraud, abuse or security incidents
Improve and develop our products, services and user experience
Send you marketing communications where you’ve agreed to receive them (or where allowed by law and you haven’t opted out)
Comply with regulatory and legal obligations

7. Call recording

Some interactions may be recorded, including:

Calls you make or receive using call recording features in your SecondRing service
Calls you have with our support team (for training, quality monitoring, resolving disputes or security/fraud prevention)

Where legally required, we will inform you that a call may be recorded. Recordings are stored securely, with access restricted to authorised staff only, and kept only as long as needed for the purposes described (or as required by law).

You may have certain rights to object to or access recorded calls, subject to legal limits.

8. How long we keep your data

We keep your personal data only for as long as necessary to:

Provide the services you’re using
Meet legal, accounting or reporting requirements
Resolve disputes or enforce agreements

Retention periods vary according to the type of data, the service used and the reason for processing. For example, account and billing records may need to be retained for legal, tax and dispute-management purposes, while communications content may be retained for a shorter period or according to the relevant service settings.

We do not promise that SMS or other communications content can always be automatically deleted after a customer-defined period. Where a configurable deletion feature is available, it will be identified in the relevant service or account settings.

When personal data is no longer required, we delete or anonymise it in accordance with our retention procedures. Residual copies may remain for a limited period in protected backups or disaster-recovery systems before being overwritten or securely deleted.

9. How we protect your data

We use technical and organisational measures designed to provide a level of security appropriate to the risk and to support the confidentiality, integrity, availability and resilience of our services. These measures may include:

Password protection and access controls
Encryption in transit and at rest where supported and appropriate to the service and risk
Secure data centres and hosting environments
Internal policies and staff training
Regular security and access reviews
Backup, redundancy and disaster-recovery arrangements
Incident detection, response and recovery procedures

Access to personal data and communications content is limited to authorised personnel and providers who require access for service delivery, customer support, security, fraud prevention, maintenance, legal compliance or incident investigation. Access is subject to appropriate controls and confidentiality obligations.

No system or transmission method is completely secure. In particular, standard SMS is not end-to-end encrypted and may be handled by several telecommunications networks. You should protect your devices, passwords and networks and select a communication method appropriate to the sensitivity of the information involved.

10. Sharing your data

We will not sell your personal data.

We may share personal data with:

Telecommunications and application providers, including SimpleSIP, network operators, number providers, SMS aggregators and app-platform providers involved in routing or delivering calls and messages.
Other service providers that support hosting, data centres, redundancy and disaster recovery, payments, email, customer support, security, fraud prevention and analytics.
Other companies in our group (if applicable) for internal administration and service delivery.
Regulators, law enforcement or other authorities where required by law, court order or to protect our legal rights or the safety of others.
Prospective buyers or investors as part of a business sale, merger or restructuring – in which case data would remain protected under this policy or an equivalent one.

Our providers are required to handle personal data only for authorised purposes and under appropriate contractual and security obligations. Some telecommunications providers may also act as independent controllers where they process data to meet their own legal or regulatory duties.

We may also share aggregated or anonymised information that does not identify you personally, such as usage statistics.

The providers involved can vary according to the number, network, application, feature and destination used. Customers may contact us for further information about the categories of providers and applicable international-transfer safeguards.

11. International transfers

Our primary, backup, geographically redundant or disaster-recovery infrastructure—and some of our service providers—may be located outside the UK. Calls and messages may also be routed through other countries depending on the networks, providers and destinations involved. We therefore do not represent that all personal data or communications content is stored or processed exclusively in the UK.

Where UK personal data is transferred internationally, we use an available lawful transfer mechanism. Depending on the destination and circumstances, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard permitted by UK data protection law. Where required, we also carry out an appropriate transfer-risk assessment and apply supplementary protections.

International backup and disaster-recovery copies remain subject to applicable access, security, retention and deletion controls. A copy may remain in a protected backup for a limited period after deletion from an active system.

Customers should contact us before using the service where their own professional, regulatory or contractual obligations require UK-only storage or prohibit international processing, as the standard SecondRing service may not satisfy a UK-only data-residency requirement.

12. Business customers and data processing

Business customers are responsible for determining whether their use of SecondRing is lawful and appropriate, including providing required privacy information and obtaining any necessary consent from their callers, message recipients, staff and clients.

Where SecondRing acts as a processor for a business customer, appropriate data-processing terms may be made available to cover the subject matter and duration of processing, the nature and purpose of processing, types of personal data, categories of data subjects, confidentiality, security, subprocessors, assistance with data-subject rights, deletion or return of data and audit information.

Customers must not use standard SMS as if it were an end-to-end encrypted or specialist secure-messaging service. Customers handling special-category, confidential, medical, legal, financial or other high-risk information should carry out their own data-protection and security assessment before using the service.

13. Cookies and similar technologies

Our website and apps use cookies and similar technologies to:

Help the site work properly
Keep you logged in
Remember your preferences
Measure and improve performance
Support marketing and analytics

You can control cookies through your browser settings and most cookie banners we use. If you choose to disable certain cookies, some parts of our site or services may not function correctly.

14. Your rights

Under data protection law, you have a number of rights in relation to your personal data, including:

Access – to request a copy of the personal data we hold about you.
Rectification – to correct inaccurate or incomplete data.
Erasure – in some cases, to ask us to delete your data.
Restriction – to ask us to limit how we use your data in certain circumstances.
Data portability – to receive certain data in a structured, commonly used and machine-readable format, and/or request that we transfer it to another provider.
Object – to certain types of processing (e.g. direct marketing, or processing based on legitimate interests).
Withdraw consent – where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, get in touch at [email protected]. We may need to verify your identity before responding.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you’re unhappy with how we’ve used your data. We’d appreciate the chance to resolve your concerns first, so please consider contacting us before contacting the ICO.

15. Children

Our services and website are not intended for children, and we do not knowingly collect personal data from anyone under 18 for our telecom services.

16. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal requirements. When we make changes, we’ll update the “last updated” date and, where appropriate, notify you by email or via our site.

17. Credit and payment details

If you pay for SecondRing services online, card details are processed securely by our payment provider. We do not store full card details on our own servers, and we do not share your financial details with third parties beyond what is necessary to process payments, prevent fraud and comply with the law.