Privacy Policy

Dollu Ltd is the data controller for personal data collected through our website, our customer portal and our sales, billing and support processes. For traffic that customers route across our network, we generally act as a processor or, where telecommunications law requires, as an independent controller for the limited purposes of routing, interconnect billing, fraud prevention and regulatory compliance. Where a customer instructs us to process end-user data on its behalf, our Data Processing Addendum sets out those responsibilities in detail.

This policy covers three groups of people: visitors to dollu.com; customers, prospective customers and their authorised users; and end users whose calls, messages or data sessions transit our voice, messaging, numbering, CPaaS and connectivity platforms. It does not cover the practices of our customers, who remain responsible for their own subscribers, nor the practices of third-party sites linked from our pages.

We collect information directly from you, automatically when you use our services, and from third parties such as identity-verification providers, credit-reference agencies, interconnect partners and public numbering registries. The categories below reflect how a carrier actually operates; not every category applies to every person, and the traffic-data categories apply only to the extent a service generates them.

• Website visitors: IP address, browser and device details, pages viewed, referring URL, approximate location derived from IP, and the cookie identifiers described in our Cookie Policy.
• Customers and users: name, business email, phone number, job title, company details, portal login credentials, API keys, billing address, tax registration numbers, payment references and support correspondence.
• KYC and numbering documents: proof of identity and address for authorised signatories, business registration certificates, local address proof required by regulators before numbers in certain countries can be activated, and letters of authorisation for porting.
• Traffic data and CDRs: calling and called numbers, sender IDs and destination MSISDNs, timestamps, duration, route and carrier identifiers, SIP signalling metadata, message status codes, IP endpoints and quality metrics such as ASR, ACD and MOS.
• Message content and voice media: only where a service such as message delivery, call recording, transcription or voicemail requires it, and only for as long as needed to deliver it or as configured by the customer.
• Fraud and security signals: number-lookup results, velocity patterns, blocklist matches, device fingerprints and authentication logs.

We use personal data to run a carrier network and to manage the commercial relationship around it. Each purpose below is specific and limited. We do not sell personal data, and we never use traffic data or message content to build advertising profiles or to market to the end users of our customers.

• Provisioning and delivering services: routing calls and messages, activating numbers, configuring SIP trunks, circuits and API access, and porting numbers between operators.
• Billing and settlement: rating CDRs against your rate deck, generating invoices, reconciling interconnect settlements with partner carriers and pursuing overdue balances.
• Fraud, security and network integrity: detecting IRSF, wangiri, spoofing, SIM-box and artificial inflation of traffic, protecting our platforms and enforcing our Acceptable Use Policy.
• Regulatory compliance: KYC and numbering obligations, DLT registration in India, 10DLC and STIR/SHAKEN attestation in the United States, lawful-intercept and data-retention duties, and responding to lawful requests from competent authorities.
• Support and quality: resolving tickets, tracing call and message failures, monitoring quality metrics and improving routing.
• Communications and marketing: service notices, maintenance advisories, rate-deck changes and, with your consent or where permitted for existing customers, information about relevant products.

Where the GDPR, the UK GDPR or India’s Digital Personal Data Protection Act applies, we rely on one or more of the lawful bases below for each processing activity. Where the CCPA or another US state privacy law applies, we act as a service provider or contractor for customer data and as a business for our own website and account data, as described in our Data Processing Addendum.

• Performance of a contract: to provide the services you or your organisation have ordered and to manage your account.
• Legal obligation: to meet telecommunications licensing, KYC, DLT, tax, data-retention and lawful-intercept requirements in the jurisdictions where we operate.
• Legitimate interests: to secure our network, prevent fraud and revenue leakage, improve routing quality, manage interconnect partners and market to business contacts, in each case balanced against your rights.
• Consent: for non-essential cookies, for marketing to individuals where required, and for optional features such as call recording or transcription that a customer chooses to enable.

Call detail records and message logs are the accounting ledger of a carrier. We generate a CDR for every attempted call and message and retain it for as long as necessary to bill, resolve disputes and meet regulatory duties. Retention periods vary by jurisdiction because Indian, European and US rules differ; the periods below are our defaults unless a longer period is required by law or a shorter period is agreed in your contract.

When a retention period expires we delete or irreversibly anonymise the data. Aggregated, non-identifying statistics such as minutes per destination or delivery rates per operator may be kept indefinitely for capacity planning and reporting, because they can no longer be linked to any individual.

• CDRs, message delivery receipts and SIP signalling metadata: 12 to 24 months for billing and dispute purposes, extended to the statutory period where a regulator or licence condition requires it.
• Interconnect settlement records and invoices: 8 years to satisfy Indian, UK and EU accounting and tax rules.
• Message content and voice media: not retained beyond delivery unless a customer enables recording, voicemail or transcription, in which case the customer sets the retention window in the portal or API.
• KYC and numbering documents: for the life of the number assignment plus the period mandated by the national numbering authority, typically 2 to 5 years.
• Fraud and security logs: 12 months, or longer where they form part of an active investigation.
• Web analytics data: 14 months, after which it is aggregated or deleted.

We share personal data only where necessary to deliver services, meet legal duties or run our business. Interconnect partners receive the signalling and traffic data needed to complete a call or deliver a message; this is inherent to how public telecommunications works and cannot be switched off. Beyond that, our sharing is limited to the categories below.

A current list of sub-processors, their locations and functions is available on request from [email protected]. Customers with a Data Processing Addendum are notified of material sub-processor changes at least 30 days in advance and may object on reasonable grounds, in which case we will work with you on an alternative or allow you to terminate the affected service.

• Carriers, operators and aggregators that terminate or originate traffic on our behalf across 600+ direct interconnects and 800+ SMS operator connections.
• Cloud infrastructure and hosting providers in India, the EU, the US and Singapore that run our switching, messaging and portal platforms.
• Identity-verification, sanctions-screening and credit-reference providers used during onboarding and KYC.
• Payment processors and banks for card, wire and prepaid top-up transactions; we do not store full card numbers on our systems.
• Support desk, CRM, email delivery and analytics tools operated on our behalf under written data-processing agreements.
• Regulators, courts, law-enforcement and national security agencies where a valid legal request or licence condition compels disclosure.
• Professional advisers, auditors and insurers, and any successor in the event of a merger, acquisition or reorganisation.

Dollu operates points of presence in Noida, Mumbai, London, Frankfurt, Amsterdam, Ashburn and Singapore, and traffic naturally crosses borders when a call or message does. Customer account data is stored in India, with replicas in the region closest to your contracted service where data residency is a requirement. Traffic data is processed in the region where the switch, SBC or SMSC handling the session sits, and CDRs are consolidated for billing in India.

Where personal data subject to the GDPR or UK GDPR leaves the EEA or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum, supported by transfer impact assessments and technical measures such as encryption in transit and at rest. Transfers within our group are covered by an intra-group agreement. Customers who require EU-only, US-only or India-only processing for a specific service can request a residency configuration when ordering.

Our information security programme is aligned to ISO 27001 controls and SOC 2 trust criteria; assessment reports and certification status are shared with customers and partners on request. Controls include role-based access to CDR and customer systems, multi-factor authentication for portal and API accounts, TLS and SRTP for signalling and media where the customer enables it, encrypted storage, network segmentation between carrier, corporate and management planes, and 24×7 monitoring by our NOC and security operations team.

No system is completely secure. If we become aware of a personal-data breach that is likely to affect you or your end users, we will notify you without undue delay and, where required, within the timeframes set by the GDPR, the DPDP Act or applicable US state law, so that you can meet your own obligations to regulators and individuals.

Depending on where you live, you may have rights to access, correct, delete, restrict or port your personal data, to object to processing based on legitimate interests, to withdraw consent, and to lodge a complaint with a supervisory authority such as the Data Protection Board of India, the UK Information Commissioner’s Office or your EU data protection authority. California residents have the rights described in the CCPA, including the right to know and to opt out of sale or sharing; we do not sell personal data.

To exercise a right, email [email protected] from the address linked to your account or provide enough detail for us to verify your identity. We respond within one month, or within 45 days for CCPA requests, and will explain any lawful reason we cannot fully comply, such as a statutory obligation to retain CDRs. If you are an end user of one of our customers, we may redirect your request to that customer as the controller.

You can opt out of marketing email at any time using the unsubscribe link or by emailing [email protected]; service notices about outages, maintenance, rate-deck changes and billing will continue because they are part of the contract. Our use of cookies and similar technologies on dollu.com is described in our Cookie Policy, which also explains how to change your choices.

Our services are designed for businesses and carriers and are not directed at children. We do not knowingly collect personal data from anyone under 18, and customers who provide numbers or messaging to consumers are responsible for age-appropriate use under their own terms and the law of the destination country.

We review this policy at least annually and whenever we launch a service or enter a market that changes how we handle personal data. Material changes will be announced on dollu.com and, for customers, by email or portal notice at least 30 days before they take effect. The date at the top of this page shows when it was last revised, and previous versions are available on request.

Questions about this policy, our data-processing practices or a rights request can be sent to our Data Protection Officer at [email protected]. General enquiries can be sent to [email protected]. You can also write to us at Dollu Ltd, 2403A, Iconic Corenthum, Sector 62, Noida 201301, India. Our EU and UK representatives for GDPR purposes can be identified on request.