Privacy Policy
Last updated: 25 September 2026
1. Who we are
PBXGuard is a service of World SIP Ltd, a company registered in Mauritius (BRN C16143836), 4th Floor, Axis Building, 26 Bank Road, Ebene, Mauritius ("World SIP", "we", "us").
PBXGuard is provided to businesses and professional users only.
Data Protection Officer: José Esteves, Managing Director — contact@pbxguard.com
World SIP is in the process of registering as a controller and processor with the Data Protection Office of Mauritius.
This policy is drafted in English; the English version prevails over any translation.
2. Our two roles
- As controller, we process the personal data needed to run your account: who you are, who your users are, how you pay, and how the Service is used. This policy covers that processing.
- As processor, we process on your behalf the information retrieved from your 3CX PBXs, which may include personal data of your own users (for example, extension names and numbers). You decide to monitor these PBXs; we act on your instructions. This processing is governed by our Data Processing Agreement, published at pbxguard.com/dpa. You remain responsible for informing the people concerned.
3. Data we collect
| Category | Data |
|---|---|
| Account and users | Name, email address, company name, role, password (stored hashed, never readable), two-factor authentication settings |
| Billing | Company name, contact email, country, invoices and payment history. We never receive or store your card details: payments are processed by The Mauritius Commercial Bank, which returns only a payment token, the card brand, its last four digits and its expiry date |
| 3CX PBX connection | Name, FQDN and IP address of each 3CX PBX, its approximate location derived from the IP address, and the credentials of its System Owner account (stored encrypted) |
| Monitoring | Technical data about your 3CX PBXs: status, response times, versions, service states, resource usage, counts of calls, extensions and trunks, certificate and license expiry dates, backup status |
| Usage and security | Login dates, IP addresses and browser information of your users, and an audit log of actions performed in your account |
| Communications | Messages you send us by email or through the contact form |
4. What we don't collect
- We do not access, record or store the content of calls, call recordings or call detail records.
- Information from your 3CX PBXs, such as extension names and numbers, is retrieved to display it in your dashboard and is not retained: only operational metrics are stored.
- We use no advertising or analytics tools (see section 11).
5. Why we use your data, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing the Service: account, monitoring, alerts, remote actions, support | Performance of our contract with you |
| Billing, invoicing and accounting | Performance of the contract; legal obligation |
| Securing the Service: authentication, audit log, fraud and abuse prevention | Our legitimate interest in protecting the Service and our customers |
| Service communications: alerts, billing, account and security emails | Performance of the contract |
We do not sell your data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing.
6. Who receives your data
Your data is processed by World SIP and by the following providers only, each bound to protect it and to use it solely to provide its service to us:
| Provider | Role | Data received | Location |
|---|---|---|---|
| OVH SAS | Server hosting, email hosting | All data hosted by the Service | France |
| The Mauritius Commercial Bank Ltd | Payment processing | Billing and payment data | Mauritius |
| Mapbox, Inc. | Map display in the dashboard | IP address and browser information of the users viewing the map | United States |
| Kloudend, Inc. (ipapi.co) | IP geolocation | Public IP address of your 3CX PBXs | United States |
We may also disclose data where required by law or by a competent authority.
7. Where your data is stored
Your data is hosted on servers located in France (European Union). World SIP operates the Service from Mauritius. The limited data received by our map and geolocation providers (section 6) is processed in the United States.
Where the law requires it, these transfers are covered by appropriate safeguards, including the European Commission's Standard Contractual Clauses, as set out in our Data Processing Agreement.
8. How long we keep your data
| Situation | Retention |
|---|---|
| Active account | For as long as the account exists. Monitoring history is kept for the retention window of your plan |
| Subscription ended, or free trial ended without subscription | All account data is kept for 24 months after the end date, so you can subscribe again, then permanently deleted |
| Account deleted by you | Erased immediately. Residual copies remain in our encrypted backups for up to 30 days, then disappear |
| Accounting records (invoices, payment records, minimal billing identity) | For the period required by law, including after account deletion |
9. Security
- PBX credentials are encrypted at rest; all connections — between you and PBXGuard, and between PBXGuard and your 3CX PBXs — are encrypted in transit (HTTPS).
- Access to production systems is restricted to authorized personnel.
- Two-factor authentication is available for every user of your account.
- Every action performed in your account is recorded in its audit log.
- Data is backed up daily to a separate location.
10. Your rights
Under the Data Protection Act 2017 of Mauritius and, where applicable, the EU General Data Protection Regulation, you may request access to your personal data, its rectification or erasure, the restriction of its processing, its portability, or object to its processing.
Send your request to contact@pbxguard.com. We reply within one month.
You may also lodge a complaint with the Data Protection Office of Mauritius or, if you are in the European Union, with the data protection authority of your country.
11. Cookies
PBXGuard uses a small number of cookies and similar technologies, needed to operate the Service and to remember your preferences — no advertising, no analytics, no cross-site tracking. See our Cookie Policy.
12. Changes to this policy
We may update this policy from time to time. The version published on this page applies. Material changes are announced to subscribers by email before they take effect.
13. Contact
For any question about this policy or your personal data: José Esteves, Data Protection Officer — contact@pbxguard.com
World SIP Ltd — 4th Floor, Axis Building, 26 Bank Road, Ebene, Mauritius · BRN C16143836 · contact@pbxguard.com