In short
- The password of your SIP phone is stored only on your phone, encrypted. We never receive it.
- Conversations go between your phone and your organization’s PBX. They do not pass through our servers; we do not listen to or record them.
- To manage licenses, the app tells our server a random installation ID, the SIP server address, the SIP login, the app version, the phone model and the Android version.
- The app has no ads, analytics or third-party trackers. We do not sell data or share it for advertising.
- The app does not ask for access to contacts, camera, location, SMS or the system call log.
1. Who we are
The operator of the data that the app sends to our server is Individual Entrepreneur B2BPRO.KZ (“we”), Republic of Kazakhstan, Almaty, Abisha Kekilbayuly St. 270/1, office 447. E-mail: info@b2bpro.kz, phone and WhatsApp: +7 706 401 60 57, website: b2bpro.kz.
We develop the app, release updates and run the license server. We are not a telecom operator and we do not carry the calls ourselves.
2. About the app and whose data it is
B2BPRO Phone is a SIP phone for Bitrix24: the app registers on your organization’s PBX (Bitrix24 telephony or another SIP PBX) and makes and receives calls through it. So there are two separate circles of data:
- Calls and data about them (numbers, time, duration, voice) are processed by your organization’s PBX. Your organization, as the owner of the telephony, is responsible for them. We have no access to this data.
- Data about the app installation (section 3, part B) is received by us to manage licenses and support.
3. What data is processed and where
A. Stored only on your phone and not sent to us
| Data | Why | How it is protected |
|---|---|---|
| SIP connection settings: server, port, transport, login, password, name shown in calls, name of the number, advanced settings (proxy, STUN, ICE, SRTP) | Connecting to the PBX | The password is encrypted with a key from the Android Keystore; the key never leaves the phone. Cloud backup of the app by Google is disabled |
| Organization branding (name, color, logo address) passed in the QR code or link | Showing your organization’s name and logo in the app | Stored in the app’s private storage |
| Call history (number, name, direction, time, duration), the last 100 entries | Showing the call list in the app | Stored in the app’s private storage, not sent to us. Deleted together with the app |
| App settings (theme, language, receiving calls, warnings) | App operation | The app’s private storage |
B. Sent to our license server (b2bpro.kz)
The app contacts the server when you add or change a number, at launch and then about every 6 hours, and right after the app is updated. The following is sent:
| Data | Why |
|---|---|
| A random installation ID (created by the app at first launch; not linked to IMEI, phone number, advertising ID or your Google account) | To tell one installation from another and to count seats per key |
| The SIP server address and its checksum (hash) | To determine the trial period, a support customer or a subscription |
| The SIP login of the number (for example, phone13). The password is not sent | To count how many numbers an organization has connected; support |
| The subscription key, if entered | Checking the subscription |
| The app version | Support and releasing updates |
| The phone manufacturer and model, the Android version | Support and compatibility checks |
| The IP address the request came from (technically, as with any internet request) | Abuse protection: limiting the request rate. The address is kept in a working table of the server for no longer than 24 hours. The hosting provider may keep standard access logs |
In reply the server sends the status (free for a support customer, trial period, subscription by key, expired) and the validity period. The reply is digitally signed and the connection is protected by HTTPS.
On the server we keep an event log for each installation: first installation, change of number or server, key entry, change of status and version. If your organization is a customer of our support, the SIP server address is matched with the company card in our CRM so that the app works free of charge.
C. What we do not collect
- The content of conversations and call recordings (the app does not record calls).
- The numbers you talk to and your call history.
- The password of the SIP phone.
- Contacts, photos, files, SMS, location, data of other apps.
- The advertising ID, IMEI, serial number, SIM card number.
4. Why we use the data and on what basis
- License checking: free use for support customers, trial period, subscription by key.
- Technical support and handling your requests, including when you write to us.
- Releasing updates and checking compatibility with phone models and Android versions.
- Protecting the server from abuse and forged requests.
- Complying with the legislation of the Republic of Kazakhstan.
We process data in accordance with the Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V “On Personal Data and Their Protection”. The basis for processing is your consent, which you give by installing the app, adding a number and using it, and the need to perform the license terms of the app. You can withdraw your consent at any time (section 8). After you delete the number or the app, the app stops sending data, but paid functions cannot be used without a license check.
We do not use data for advertising, profiling or automated decisions about you, we do not sell it and do not pass it to third parties, except in the cases of section 6.
5. App permissions
The app asks Android only for what the phone needs to work. None of it is used to collect data about you.
| Permission | What for |
|---|---|
| Microphone | Your voice in a conversation. Sound goes only into the call and is not recorded or saved anywhere |
| Notifications | Showing an incoming call and the app status |
| Bluetooth (connecting to devices) | Working with a Bluetooth headset during a call |
| Internet and network state | Connection to the PBX, license and update checks |
| Changing audio settings | Switching between the speakerphone and the earpiece |
| Background work (foreground service) | Keeping the registration on the PBX so that incoming calls arrive when the app is closed. A permanent notification is shown in the shade |
| Full-screen notification and display over other apps | Opening the incoming-call screen when the phone is locked or another app is open |
| Start after reboot | Turning call receiving back on after the phone restarts |
| Exclusion from battery saving | So that Android does not stop call receiving in the background. Your request is shown and you can refuse |
| Keeping the device awake and the proximity sensor | During a call, turning the screen off at your ear and keeping it on with the speakerphone. Sensor readings are not saved anywhere |
| Installing apps (only in the version downloaded from the website) | Installing app updates that you confirm yourself. The version from Google Play does not update itself |
| Vibration | Vibration on an incoming call |
Scanning the connection QR code is done by the built-in Google Play Services scanner. The app does not get access to the camera or to photos; the image is recognized on your phone and is not sent to us.
6. Sharing with third parties and third-party components
- Your organization’s PBX. You decide which PBX the app connects to. The login, password and call signaling data are sent to that server. Conversation encryption (SRTP) is turned on in “Advanced” settings if your PBX supports it.
- Linphone SDK (Belledonne Communications, GNU GPL v3 license). A library that makes SIP calls on the phone itself. The source code of the app is open and available on the app page. The app includes no advertising or analytics libraries.
- Google Play Services. Used only for the QR code scanner. Google may collect technical statistics about the operation of its services under its own rules.
- WhatsApp (Meta). In the version downloaded from the website, the “Request a key” button opens WhatsApp with a prepared message that contains the SIP server address. You send the message yourself. It reaches us as an ordinary WhatsApp enquiry: the phone number you write from and the text of the message. Processing inside WhatsApp follows WhatsApp’s rules. The version from Google Play has no such button.
- Hosting provider. Our server is hosted by the provider PS.kz (Kazakhstan), which keeps the server running.
- Our Bitrix24 CRM. We handle enquiries about keys and support in our company’s CRM.
We do not sell data and do not pass it to advertising networks. Data may be provided to authorized state bodies of the Republic of Kazakhstan on their lawful request.
7. Retention periods and protection
- On the phone. Data is kept while the app is on the phone. By deleting a number in the app you delete its settings. Deleting the app erases everything it stored.
- On our server. Installation records and the event log are kept while the installation stays in contact. Records of installations that have not been in contact for more than 24 months are deleted automatically. At your request we will delete data earlier (section 8). The trial period mark (a checksum of the SIP server address and the start date) is kept so that reinstalling does not reset the trial period.
- Protection. Exchange with the server goes over HTTPS, the license server replies are digitally signed and checked by the app. The SIP password is encrypted in the Android Keystore. Access to the server’s administration panel is protected by a password with a limit on login attempts, and only the server owner has access to the data.
8. Your rights and how to use them
You have the right to find out what data about you we keep, to get a copy of it, to demand its correction or deletion, to withdraw your consent to processing, and to contact the authorized body for the protection of personal data of the Republic of Kazakhstan.
To use your rights, write to info@b2bpro.kz or on WhatsApp +7 706 401 60 57. Give the SIP server address and the login of the number so that we can find the record. We will reply within the time set by the legislation of the Republic of Kazakhstan. If you use the app on behalf of an organization (for example, as an employee), a representative of the organization can also send a request to delete data.
You can stop the data transfer yourself: delete the number and the app. Data about calls and call history are kept on your PBX’s side; to delete them, contact the telephony administrator of your organization.
9. Children
The app is meant for work use and is not intended for persons under 18. We knowingly do not collect children’s data.
10. The website, the app page and the QR generator
The app page on the b2bpro.kz website contains a QR code generator for connecting an employee. It works entirely in the browser: the server, login and password you enter are not sent to our server or saved, and the fields are excluded from session recording in Yandex Metrica. Still, the QR code contains the password of the SIP phone, so hand it to the employee in person and do not publish it. Other questions about the website (cookies, analytics, request forms) are described in the website privacy policy.
11. Changes to the policy
We may update this policy, for example when new versions of the app are released. The current version is always on this page, and the effective date is shown at the top. For significant changes we will say so in the release notes of the app update.
12. Contacts
Individual Entrepreneur B2BPRO.KZ, Republic of Kazakhstan, Almaty, Abisha Kekilbayuly St. 270/1, office 447.
E-mail: info@b2bpro.kz
Phone and WhatsApp: +7 706 401 60 57
App page: b2bpro.kz/bitrix24-sip-telefon