Snapshot 131720
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Addendum
Introduction
1. Definitions
2. Applicability of DPA
3. Roles and Responsibilities
4. GDPR Obligations
5. Miscellaneous
ANNEX A
Details Of The Processing
Nature and Purposes of Processing
Categories of Data Subjects
Special Categories of Data
Duration of Processing
Disclosures to Law Enforcement
ANNEX B – LIST OF SUB-PROCESSORS AND CONDITIONS FOR SUB-PROCESSING
General Requirements for Sub-processors
Written Contract
Same Level of Protection
International Transfers
Transfer Impact Assessments
Sub-processor Categories
Service Sub-processors
Corporate/Marketing Processors (no processing of Customer Personal Data)
Customer Notification and Right to Object
Advance Notice.
Right to Object.
Emergency Replacement.
Current List of Service Sub-processors
Sub-processors
3CX Services
3CX Communications System
3CX Video Conferencing & AI Transcription
3CX Websites
Corporate/Marketing Processors (No Processing under the DPA)
Access by Support Providers
Standard Contractual Clauses
ANNEX C – TECHNICAL AND ORGANISATIONAL MEASURES
See Also
Introduction
This Data Processing Addendum ("DPA") is made as from the Effective Date by and between the 3CX legal entity identified as the seller or contracting party in the applicable Agreement, order, invoice or checkout record ("3CX") and Customer (each a "party", together the "parties"), pursuant to the Agreement for the provision of 3CX Services to Customer. If no 3CX legal entity is identified, 3CX Limited is 3CX for purposes of this DPA. This DPA is incorporated into the Agreement and applies when 3CX processes Customer Personal Data on behalf of Customer. Other capitalised terms used but not defined in this DPA have the meanings given in the Agreement.
3CX main establishment address:
3CX Ltd 4, Markou Drakou, Engomi, 2409 Nicosia, Cyprus
1. Definitions
For the purposes of this DPA:
(a) “Agreement” means the electronic agreement or end-user license agreement (EULA) between the Customer and 3CX for the provision of any 3CX services (“Services”) to the Customer.
(b) "Affiliate" means an entity that directly or indirectly controls, is controlled by or is under common control with an entity.
(c) "Data Protection Laws" means all data protection, privacy and data-security laws and regulations applicable to a party's processing under the Agreement, including, where applicable, Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC and national implementations, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and applicable United States state privacy laws.
(d) “EEA” means the European Economic Area.
(e) “Controller” shall mean the entity which, alone or jointly with others, determines the purposes and means of the processing of Personal Data;
(f) “Processor” shall mean the entity which processes Personal Data on behalf of the Controller;
(g) "Personal Data" means information relating to an identified or identifiable natural person, and includes "personal information" or an equivalent term protected under applicable Data Protection Laws.
(h) “Security Incident” means accidental or unlawful destruction, loss, alteration and unauthorised disclosure of and/or access to Personal Data;
(i) “Standard Contractual Clauses” means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council issued by the Commission Implementing Decision (EU) 2021/914.
(j) "Customer Personal Data" means Personal Data processed by 3CX on behalf of Customer in connection with the Services. It excludes Personal Data for which 3CX acts as an independent Controller.
(k) "Sub-processor" means a 3CX Affiliate or third party engaged by 3CX to process Customer Personal Data on behalf of Customer.
2. Applicability of DPA
This DPA applies to the extent 3CX processes Customer Personal Data as a Processor or Sub-processor under the Agreement, irrespective of the nationality or location of the relevant individual. References to Data Protection Laws include the EEA, UK, Swiss and other privacy laws that apply to the relevant processing. Transfer-specific provisions apply only where the relevant law governs the transfer.
3. Roles and Responsibilities
3.1 Parties' Roles: Where Data Protection Laws apply, Customer is the Controller or, where Customer processes Personal Data on behalf of another Controller, a Processor. 3CX is the corresponding Processor or Sub-processor. Each party shall comply with the obligations imposed on it in that role. Nothing in this DPA changes a party's role where Data Protection Laws determine otherwise.
3.2 Purpose Limitation: 3CX shall process Customer Personal Data only for the purposes described in Annex A and on Customer's documented instructions, including instructions concerning international transfers. The Agreement, this DPA, Customer's lawful configuration and use of the Services, and documented instructions consistent with them constitute Customer's instructions. If applicable law requires other processing, 3CX shall inform Customer before processing unless that law prohibits notice.
3.3 Security: 3CX will maintain appropriate technical and organizational measures to safeguard the security of Personal Data. 3CX will maintain an information security and risk management program based on commercial best practices to preserve the confidentiality, integrity and accessibility of Personal Data with administrative, technical and physical measures conforming to generally recognised industry standards and practices. 3CX shall implement appropriate technical and organisational measures to protect the Personal Data from an accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The categories of technical and organisational measures form Annex C. Product-specific implementation details and data-location options shall be described in current security or Product documentation made available to Customer.
3.4 Updates to Security: Customer is responsible for reviewing the information made available by 3CX relating to data security and making an independent determination as to whether the Service meets Customer’s requirements and legal obligations under Data Protection Laws. Customer acknowledges that Security is subject to technical progress and development and that 3CX may update or modify Security from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Service provided to Customer. 3CX shall notify Customer of any material reductions in security measures.
3.5 Transferring Personal Data Outside the EEA, UK or Switzerland: Where 3CX transfers Customer Personal Data to a country not recognised as providing adequate protection, 3CX shall implement a lawful transfer mechanism and any supplementary measures required by applicable Data Protection Laws. Where the Standard Contractual Clauses are required, Module Two applies when Customer is a Controller and 3CX is a Processor, and Module Three applies when Customer is a Processor and 3CX is a Sub-processor. For UK transfers, the applicable UK International Data Transfer Addendum or IDTA applies. For Swiss transfers, the Standard Contractual Clauses apply with adaptations recognised by the FDPIC. 3CX shall conduct transfer impact assessments where required and make relevant information available to Customer, subject to appropriate confidentiality, security and legal restrictions.
Compliance
Customer, as Controller, shall be responsible for ensuring that:
(a) it has complied, and will continue to comply, with all Data Protection Laws, including in any instructions it issued to 3CX under this Agreement and DPA; and
(b) it has, and will continue to have, the right to transfer or provide access to the Personal Data to 3CX for processing under the Agreement and this DPA. Where Customer acts as a Processor, Customer represents that its instructions are authorised by the relevant Controller.
3CX shall immediately inform Customer if, in its opinion, an instruction infringes Data Protection Laws and may suspend the affected processing until the parties resolve the issue.
4. GDPR Obligations
4.1 Applicability of Section: This Section 4 applies to processing of Customer Personal Data within the scope of the GDPR, UK GDPR or corresponding Swiss processor requirements.
4.2 Confidentiality of processing: 3CX shall ensure that any person with the authorisation to process Personal Data, shall be subject to a duty of confidentiality (whether a contractual or statutory duty).
4.3 Sub-processors. The Customer agrees that 3CX may engage 3CX affiliates and third-party sub-processors (collectively, “Sub-processors”) to process the Personal Data on 3CX’s behalf. 3CX shall impose on such Sub-processors data protection terms that protect the Personal Data to the same standard provided for by this DPA and shall remain liable for any breach of the DPA caused by a Sub-processor. The Sub-Processors engaged by 3CX are listed on the 3CX Sub-processor List and are available in Annex B. 3CX shall notify Customer at least 30 days before adding a Sub-processor.
4.4 Changes to Sub-processors. 3CX may add or make changes to the Sub-processors. If the Customer objects to the appointment of an additional Sub-processor, then the Customer will be entitled to suspend or terminate the affected 3CX service in accordance with the termination provisions of the Agreement. An objection must be made within the notice period and be based on reasonable data-protection grounds. The parties shall work in good faith to resolve it. If no reasonable solution is available, Customer may terminate the affected Service and receive a pro-rated refund of prepaid, unused fees for that Service, without limiting mandatory rights.
4.5 Security Incidents. Upon becoming aware of a Security Incident, 3CX shall notify the Customer without undue delay and make every effort to notify the Customer within 48 hours of becoming aware of a Security Incident, at the contact information that the Customer has provided in the Customer Portal and shall provide such timely information as the Customer may reasonably require, including to enable the Customer to fulfil any data breach reporting obligations under Data Protection Laws. As information becomes available, the notification shall describe the nature of the Security Incident, affected data and individuals, likely consequences, mitigation taken or proposed, and a contact point. 3CX may provide information in phases and shall reasonably cooperate with Customer's investigation, notification and remediation obligations.
4.6 Cooperation and data subjects’ rights. 3CX, taking into account the nature of the processing, shall provide reasonable assistance and tools, where available, to the Customer insofar as this is possible, to enable the Customer to respond to requests from a data subject seeking to exercise their rights under the Data Protection Laws. In the event that such a request is made directly to 3CX, 3CX shall promptly inform the data subject to contact the Customer of the same. It is the Customer’s sole responsibility to ensure that any administrator identified for the Customer’s 3CX account to manage and carry out data subject requests has appropriate authority to fulfill the data subject requests. 3CX shall not substantively respond to a request concerning Customer Personal Data except on Customer's documented instructions or where required by law. Customer is responsible for ensuring that an administrator identified for its 3CX account has appropriate authority to fulfil data-subject requests.
4.7 Data Protection Impact Assessments: To the extent required by Data Protection Laws and upon Customer's request, 3CX shall provide reasonable assistance with data protection impact assessments or prior consultations that Customer is required to carry out. 3CX may charge reasonable fees for assistance materially beyond standard Service functionality, unless the assistance is required because of 3CX's breach of this DPA.
4.8 Deletion or return of data: Upon termination or expiration of the Agreement, 3CX shall (at Customer's election) delete or return to Customer all Personal Data (including copies) in its possession or control, except that this requirement shall not apply to the extent 3CX is required by applicable law to retain some or all of the Personal Data, or to Personal Data it has archived on back-up systems, which Personal Data 3CX shall securely isolate, protect from any further processing and eventually delete in accordance with 3CX’s deletion policies, except to the extent required by applicable law. Customer may export available Customer Personal Data during the Agreement and any applicable retrieval or transition period. On request, 3CX shall provide reasonable confirmation of deletion. Product-specific retrieval, backup-retention and deletion periods shall be stated in the Agreement, Product Terms or current documentation. Data retained in backups shall be isolated from ordinary processing and deleted on the applicable backup cycle unless law requires retention.
4.9 Audits / inspections: 3CX shall make available to the Customer all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer. This obligation is limited to one audit per Customer per year provided a reasonable notice of 30 days is provided by the Customer in advance. The annual frequency and advance-notice limits do not apply following a material Security Incident, where Customer has reasonable evidence of material non-compliance, or where a competent authority or Data Protection Laws require otherwise. Customer shall first review available independent reports, certifications or security documentation. Audits must protect other customers' data, confidentiality and Service security and must not unreasonably disrupt 3CX operations. Standard Contractual Clause and regulator audit rights are not restricted by this paragraph.
5. Miscellaneous
5.1 Except as amended by this DPA, the Agreement will remain in full force and effect.
5.2 If there is a conflict between the Agreement and this DPA, the terms of this DPA shall prevail.
5.3 Claims brought under this DPA are subject to the terms, exclusions and limitations in the Agreement. Nothing in the Agreement or this DPA limits liability, regulatory powers or data-subject rights where limitation is prohibited by law. Nothing limits liability under the Standard Contractual Clauses contrary to their terms.
5.4 Any clarifications on this DPA or other enquiries relating to data protection shall be addressed to the main establishment addresses referred to above or via email to [email protected]
ANNEX A
Details Of The Processing
Nature and Purposes of Processing
3CX is an open standards communications solution that offers complete Unified Communications. 3CX provides software, instance hosting, and cloud services.
Only processing performed by 3CX on Customer's documented instructions is governed by this DPA. Where 3CX determines the purposes and essential means of processing for account and commercial relationship management, ordering, billing, licensing administration, legal compliance, fraud prevention, corporate communications, lead management or service security, 3CX acts as an independent Controller and that processing is governed by the applicable 3CX Privacy Notice.
Purposes of the Processing are:
Accounts registration and management through the 3CX Customer Portal.
For 3CX's own account administration, this is independent-Controller processing.
Identification of the customer for ordering, licensing, and email communication.
Processing for 3CX's own ordering, licensing administration and commercial communications is independent-Controller processing.
Identification of the Communications System administrator for email communication.
Identification of the Communications System machine for licensing.
Identification of the Communications System users for personalized experience in Video Conferencing.
Issuance of 3CX academy certificates.
Where 3CX determines the certification purpose and records, this is independent-Controller processing.
Lead processing of end-users with free licenses for potential sales.
Lead processing for 3CX's own sales purposes is independent-Controller processing and is outside this DPA.
Review of usage data for general quality control, reporting and troubleshooting of the 3CX Services.
This is Processor activity only to the extent performed on Customer's instructions; otherwise it is governed by the applicable Privacy Notice.
Sending email notifications to Communications System users when the 3CX SMTP is used.
Troubleshooting and assistance by 3CX staff.
Where enabled by Customer: processing call, meeting and message content; recordings; voicemail; transcripts; summaries; prompts; AI inputs and outputs; and customer-selected knowledge sources for transcription, summarisation, assistance, analytics or other configured AI-enabled functions. Product documentation should identify the relevant provider, location, retention and opt-in controls.
Categories of Data Subjects
Customer and End Users who use the Services, and any data subject who uses the 3CX Services at the request of and in connection with the business of the Customer.
Categories may also include Customer's administrators, employees, contractors, agents, contacts, callers, called parties, meeting participants, message participants, website visitors interacting with Customer-controlled communications features, and other individuals whose data Customer submits to or processes through the Services.
Type(s) of Personal Data Processed:
The personal data transfer concerns the following categories of data for the data subjects:
Identification information for Customer, contact information (address, telephone number, email address, fax number), company name.
Identification information for each Extension of the 3CX Communications System as part of the Video Conferencing feature, including extension number, first and last names, email address, meeting friendly names in Click2Meet URL.
Identification information for each Participant of a Video Conferencing including name, email address and IP address. Participant’s telephone number will also be processed for those joining through the Video Conferencing Dial-In audio bridge.
Any other personal data that the Customer or users choose to include in the content of the communications that are sent and received using the 3CX Services including but not limited to support bundles, logs, crash reports, through emails, tickets, calls or any other means.
Call, meeting and message metadata and content; recordings; voicemail; transcripts; AI prompts, inputs and outputs; customer-selected knowledge sources; device and authentication data; configuration data; logs; diagnostic files; and support materials, in each case to the extent submitted to or generated through enabled Services.
The personal data transferred to 3CX for processing is determined and controlled by the Customer in its sole discretion. As such, 3CX has no control over the volume and sensitivity of personal data processed through its Services by the Customer or users. 3CX does not monitor or access the Customer’s content unless required for support and such processing is on-demand, limited, and logged.
Special Categories of Data
3CX does not intentionally require special categories of Personal Data to provide the Services. Customer acknowledges that special-category or similarly sensitive data may nevertheless appear in customer-controlled communications, recordings, transcripts, prompts, uploaded knowledge sources, support materials or other content. Customer is responsible for having a lawful basis and satisfying any additional conditions for that processing; 3CX shall process such data only in accordance with this DPA and Customer's documented instructions.
Duration of Processing
The personal data will be processed for the term of the Agreement, or as otherwise required by law or agreed between the parties.
Customer-accessible retrieval and transition periods, production deletion periods and backup-retention periods shall be identified in applicable Product Terms or current product documentation. Any legally retained data remains protected and is not used for other purposes.
Disclosures to Law Enforcement
The Processor shall not disclose Personal Data to any law-enforcement or governmental authority unless required to do so under applicable law binding upon the Processor. Where a request is received directly by the Processor, the Processor shall:
(a) verify whether the request is legally valid and properly addressed to the relevant 3CX entity;
(b) notify the Controller (unless prohibited by law); and
(c) disclose only the minimum Personal Data required by law.
The Processor is not obliged to act upon informal notifications or unsubstantiated allegations from third parties and may request that such parties redirect their concerns to the appropriate law-enforcement channels.
Where legally permitted and reasonably practicable, 3CX shall challenge a request that is unlawful, overbroad or disproportionate and document its response.
ANNEX B – LIST OF SUB-PROCESSORS AND CONDITIONS FOR SUB-PROCESSING
General Requirements for Sub-processors
Written Contract
3CX shall only engage Sub-processors under a written agreement imposing data protection obligations no less protective than those set out in this DPA, as required by Article 28 GDPR.
Same Level of Protection
3CX remains fully liable for the acts and omissions of its Sub-processors and shall ensure that each Sub-processor implements appropriate technical and organisational measures in accordance with Article 28 and 32 GDPR.
International Transfers
Where a Sub-processor is located outside the EEA, UK or Switzerland, 3CX shall ensure that a lawful transfer mechanism is implemented, including:
EU Standard Contractual Clauses
UK Addendum or IDTA
Swiss-adapted SCCs
or any successor or alternative mechanism recognised by the competent authority.
Transfer Impact Assessments
For non-EEA/UK transfers, 3CX shall conduct transfer impact assessments (where required by law) and make a summary available to Customer upon request.
Sub-processor Categories
For transparency, 3CX distinguishes between the following categories of Sub-processors:
Service Sub-processors
Sub-processors that process Customer Personal Data strictly for the provision of the 3CX Services (e.g., hosting, push notifications, email delivery).
Corporate/Marketing Processors (no processing of Customer Personal Data)
Processors used for analytics and marketing on 3CX websites (e.g., Google Analytics, Facebook Pixel) do not process any Customer Personal Data under this DPA.
They are listed for transparency only and do not form part of the Customer’s supply chain for the provision of Services. Customer Personal Data, as defined in this DPA, is never shared with Corporate/Marketing Processors.
Customer Notification and Right to Object
Advance Notice.
3CX shall notify Customer at least 30 days in advance of adding or replacing a Service Sub-processor. Notification shall be made via the Customer Portal or by email.
Right to Object.
Customers may object to a new Service Sub-processor on reasonable data protection grounds within 30 days of notification.
3CX will work with Customers in good faith to address such objections. If the parties cannot reach a mutually acceptable solution, Customer may suspend or terminate the affected Service and receive a pro-rated refund for prepaid, unused fees.
Emergency Replacement.
In urgent circumstances (e.g., service failure), 3CX may temporarily appoint a replacement Sub-processor. 3CX will notify Customer as soon as reasonably practicable.
Current List of Service Sub-processors
The following entities are authorised Service Sub-processors engaged by 3CX to support the provision of the Services.
Each listed Sub-processor processes Customer Personal Data only for the purposes described and subject to the transfer mechanisms indicated.
Before publication and on each update, 3CX shall verify each provider's exact legal name, country or countries of processing and remote access, Service function, data involvement, current transfer mechanism, and whether the provider processes Customer Personal Data. AI, transcription, CRM/ERP, support and replacement providers must be included where they process Customer Personal Data.
3CX Ltd
3CX Development Ltd
3CX GmbH
3CX USA Corp
Sub-processors
3CX Services
Sub-processor
Country of Processing
Service Description
Google Cloud (Alphabet Inc.)
EU / USA
Cloud hosting services
Google GSuite (Alphabet Inc.)
EU / USA
Email provider
Checkout.com LLC
EU / UK / USA
Payment processor
Cloudflare, Inc.
EU / USA
CDN & security protection
Freshworks, Inc. – Freshdesk
EU / USA / IN
Ticketing system for support
Microsoft Azure (Microsoft Corp.)
EU / USA
Cloud hosting services
Microsoft Power BI
EU
Reporting & analytics
PayPal Holdings – Braintree
EU / USA
Payment processor
TeamViewer Germany GmbH
EU
Remote assistance sessions
Twilio Inc. – SendGrid
EU / USA
Email delivery services
Odoo S.A
EU
CRM
DigitalOcean LLC
EU / USA
Cloud hosting services
Amazon Web Services (AWS)
EU / UK / USA
Cloud hosting services
Hetzner
EU / USA / SG
Cloud hosting services
3CX Communications System
Sub-processor
Country of Processing
Service Description
Google Cloud
EU / USA
Cloud hosting
Google FCM (Firebase Cloud Messaging)
EU / USA
Push notifications and Crash Reporting (Android)
Cloudflare, Inc.
EU / USA
CDN & security protection
Apple APNS
EU / USA
Push notifications (iOS)
DigitalOcean LLC
EU / USA
Cloud hosting services
Twilio Inc. – SendGrid
EU / USA
Email provider
3CX Video Conferencing & AI Transcription
Sub-processor
Country of Processing
Service Description
Google Cloud
EU / USA / ASIA
Cloud hosting
DigitalOcean LLC
EU / USA / ASIA
Cloud hosting
3CX Websites
Sub-processor
Country of Processing
Service Description
Google Cloud (Alphabet Inc.)
EU / USA
Cloud hosting & user sync
Cloudflare, Inc.
EU / USA / ASIA
CDN & security protection
OpenAI
Multiple countries / Global
Self-service AI support agent
Twilio Inc. - SendGrid
EU / USA
Email delivery services
Alibaba
CHINA
Cloud Hosting for 3CX.CN
Odoo S.A
EU
CRM
Corporate/Marketing Processors (No Processing under the DPA)
The following providers are used exclusively for 3CX website analytics, advertising optimisation or corporate marketing purposes.
They do not process Customer Personal Data provided under this DPA. Their inclusion is for transparency only.
Provider
Purpose
Nature of Activity
Customer Data Processed
Google Analytics
Website analytics
Tracks website usage
None under this DPA
Google Ads
Advertising optimisation
Conversion and campaign tracking
None under this DPA
Meta Pixel
Advertising optimisation
Tracks website activity
None under this DPA
X Pixel
Advertising optimisation
Tracks website conversions and ad performance
None under this DPA
LinkedIn Analytics
Marketing analytics
Website interaction tracking
None under this DPA
Reddit Analytics
Marketing analytics
Campaign tracking
None under this DPA
Access by Support Providers
Where a Support Sub-processor (e.g., TeamViewer) has potential access to Personal Data:
Access is occasional, limited, and logged.
Access occurs only when Customer requests support.
The Sub-processor is bound by confidentiality and processor-level data protection obligations.
Sub-processor may only access data strictly necessary to fulfil the support function.
Standard Contractual Clauses
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914
For purposes of the Standard Contractual Clauses: Annex A of this DPA supplies the parties, processing description and competent supervisory authority information; Annex B supplies the Sub-processor list; Annex C supplies the technical and organisational measures. Module Two applies to Controller-to-Processor transfers and Module Three to Processor-to-Processor transfers. The docking clause applies; the optional independent dispute-resolution language does not apply unless expressly agreed; and the governing-law and forum selections shall be an eligible EEA Member State identified in the applicable order or, absent such identification, Cyprus. The parties shall complete any additional selections required for UK or Swiss transfers.
ANNEX C – TECHNICAL AND ORGANISATIONAL MEASURES
3CX shall maintain the following categories of technical and organisational measures, taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and risks to individuals. Product-specific implementation may vary, provided the overall level of protection is not materially reduced.
Control area
Minimum contractual measure
Governance and risk
Documented security policies, assigned responsibilities, periodic risk assessment, personnel screening where lawful, confidentiality commitments and security awareness training.
Access control
Role-based and least-privilege access; unique user identities; strong authentication and MFA for privileged or remote access where appropriate; prompt access revocation; periodic access review.
Encryption
Encryption in transit using current industry-standard protocols and encryption at rest where appropriate to the Service and risk; managed key-access controls.
System security
Secure configuration, vulnerability management, malware protection where appropriate, patch management, logging and monitoring, change controls and segregation of production environments.
Availability and resilience
Redundancy, backups, restoration procedures, business-continuity and disaster-recovery measures proportionate to the Service; periodic testing.
Incident response
Documented detection, escalation, containment, investigation, remediation and notification procedures; preservation of relevant evidence.
Data lifecycle
Data minimisation, purpose limitation, configurable retention where available, secure deletion or anonymisation, backup expiry and controls against unauthorised copying or export.
Sub-processors and transfers
Due diligence, written data-protection obligations, security oversight, lawful transfer mechanisms and transfer-risk assessment where required.
Assurance
Periodic testing and evaluation of controls; independent reports or certifications where maintained; remediation tracking; controlled customer assurance and audit processes.
See Also
https://www.3cx.com/company/eula/
https://www.3cx.com/company/ai-transcription-services/
https://www.3cx.com/company/gdpr-statement/
https://www.3cx.com/company/privacy/
https://www.3cx.com/company/privacy-policy/
https://www.3cx.com/company/terms-and-conditions/
https://www.3cx.com/company/hipaa-policy/
https://www.3cx.com/company/refund-cancellation-policy/
Last Updated
This document was last updated 14 October 2026
https://www.3cx.com/company/data-processing/
Browse Categories
Product ReleasesCall Flow ScriptsEvents & WebinarsDocs and FAQNewsVlogsPartners
Latest Tech Articles
Run Your Queues From Anywhere: 3CX Android V5.8 Now in Production
Speak Your Caller’s Language: 3CX iOS V5.8 Now in Production
Call Scripts to Bring Your Preferred AI Voice Provider Into 3CX
What Can Call Transcriptions Do for Your Business?
V20 Update 10 RC: AI Call Transcription Server for Mac, Pop Out Dia...
Get Started - Admin
Install 3CX
Setup your team
Easy SIP trunk setup
Call routing, IVR, office hours
Call queues, ring groups
Configure IP Phones
Install website Live Chat
Integrate WhatsApp & Facebook
Get Started - Users
Get to know the Web Client
Get the apps: iOS or Android
How to use your deskphone
Schedule a video call / conference
Manage Live Chat & SMS
20 Years of VoIP
Industry Leadership
Founded in 2005, when VoIP was an emerging technology, 3CX has gone on to establish itself as a global leader in business communications.
Learn more
Company
About 3CX
Careers
Partners
Awards
Case Studies
Testimonials
Global Sites
Contact Us
Solutions
Enterprise PBX
Small Business
Contact Center
Multi-tenant PBX
Hotel PBX
Education
Healthcare
Automotive
Useful Links
3CX AI
Virtual PBX
Build Voice Apps
SIP Server
Free Softphone
Call Reporting
WordPress Chat Plugin
SIP Trunks
Learn More
Blog
Licensing
VOIP FAQs
Configuration Guides
Alcatel Alternative
Avaya Alternative
Mitel Alternative
Security
Copyright © 2026 Sitemap Privacy
20 Years of VoIP
Industry Leadership
Founded in 2005, when VoIP was an emerging technology, 3CX has gone on to establish itself as a global leader in business communications.
Learn more
Company
About 3CX
Careers
Partners
Awards
Case Studies
Testimonials
Global Sites
Contact Us
Solutions
Enterprise PBX
Small Business
Contact Center
Multi-tenant PBX
Hotel PBX
Education
Healthcare
Automotive
Useful Links
3CX AI
Virtual PBX
Build Voice Apps
SIP Server
Free Softphone
Call Reporting
WordPress Chat Plugin
SIP Trunks
Learn More
Blog
VOIP FAQs
Configuration Guides
Alcatel Alternative
Avaya Alternative
Mitel Alternative
Security
Copyright © 2026 Sitemap Privacy
Cookie Preferences
Functional Cookies (required)
These cookies allow you to navigate the site and use our features.
Analytics Cookies
These cookies allow us to measure and analyse how our customers use the site, to improve its functionality and the user experience.
Advertising Cookies
These cookies may be used to deliver ads relevant and personalized to our users. Google also uses personal information it receives from sites or apps that use their advertising services. You can find more information about this on Google’s business safety & privacy terms site.
Personalisation Cookies
Personalisation cookies allow us to remember your preferences and tailor website content and ads to your interests. This may involve cookies or mobile identifiers used for ads personalisation.