This policy explains how Telebase handles personal data. The data controller for the processing described in section 3 is:
Telebase has not appointed a Data Protection Officer. Privacy enquiries are handled by the contact address above and are the responsibility of the company's director.
Telebase processes personal data in two distinct roles, and the rules that apply are different in each case. This distinction matters, so it is set out first.
If you are an individual whose phone number has been submitted to Telebase by a business, that business is the controller. Please contact that business to exercise your rights. If you contact us and identify the business concerned, we will forward your request to them.
In our own right, we process the following.
Each purpose relies on a specific legal basis under Article 6 GDPR.
Where we rely on legitimate interest, we have considered whether that interest is overridden by your rights and freedoms. You may object to processing based on legitimate interest at any time using the contact details in section 1.
We do not send bulk marketing email to individuals who have not asked to hear from us, and we do not sell or rent contact data.
This section describes processing carried out on behalf of our customers. In this processing, our customer is the controller and Telebase is the processor.
In short: when a customer sends us a phone number, we use it for one purpose, which is helping that customer protect its users from account takeover and fraud. The number is passed through our telecom data providers to the mobile network operator that serves it, and that operator confirms whether the SIM card linked to the number has recently changed. We receive only that result, together with basic carrier and line information, and we return it to the customer. We do not receive call, message or location data.
Our customers are businesses, such as banks, fintechs and other online services, that use Telebase to protect their own users' accounts and transactions from fraud. A customer submits a phone number that one of its users has registered with it, and asks whether the SIM card linked to that number has recently changed (a "SIM swap"), together with basic information about the line. A recent SIM change is a common sign that someone other than the subscriber has taken control of a phone number, for example to intercept one-time passcodes. The customer then decides for itself whether to ask its user for additional verification. Telebase does not make that decision, and our Terms of Service prohibit customers from using a result as the sole basis for a decision that has a legal or similarly significant effect on an individual.
When a customer submits a phone number to the Telebase API, we pass that number to one or more upstream telecom data providers. The provider checks the number with the mobile network operator that serves it, so a phone number may be verified with the individual's own mobile network, and that operator will receive the request. The operator, or the provider acting under its agreement with the operator, confirms whether the SIM changed within the period requested and returns carrier and line information, which we return to the customer. The signals we return are: validity, carrier name, country, line type, line status, and SIM swap status with, where the operator makes it available, the date of the most recent SIM change.
The check takes place between systems. We do not send a message to or call the individual, we do not access their handset, and we do not receive their name, address, contacts, message content, call records or location.
Telebase has no direct relationship with the individuals whose numbers are checked. Our customers, as controllers, are responsible for telling those individuals that their phone number may be checked with their mobile network, and for obtaining any consent that the law or a mobile network operator requires, before the check is made. Our Terms of Service require this, including any wording that an operator requires in a particular country.
This applies in every country we support. For individuals in Germany, the customer must make sure that, before a check is made, it has given the notice and obtained the consent or established the other lawful basis that German law and the operator require, and that its privacy notice explains that the individual's phone number may be verified with their mobile network.
The signals returned by the Telebase API originate from mobile network operators and are accessed through licensed telecom aggregators under their agreements with those operators. Telebase does not obtain this data from public sources, scraped sources or leaked datasets.
Where a lookup is performed, the subscriber's wireless carrier is authorised to use or disclose information about the account and the wireless device, where available, to Telebase or its service provider for the duration of the business relationship, solely to help identify the subscriber or the device and to prevent fraud. That authorisation may extend to details such as name and address. Telebase does not request name or address data, and the Telebase API does not return it.
Businesses using Telebase are responsible for establishing a lawful basis for each lookup and for providing any notice or disclosure required of them as controller. Our Terms of Service set out those obligations.
These are commitments, not aspirations. They apply to all data handled by Telebase, in either role.
We share personal data only with the following categories of recipient, and only to the extent needed.
Each recipient acting as a processor is engaged under a written contract that meets the requirements of Article 28 GDPR. A current list of sub-processors is available on request from hello@telebase.io.
Telebase is established in the Republic of Serbia. Serbia is not currently the subject of an adequacy decision by the European Commission under Article 45 GDPR, and is not covered by UK adequacy regulations.
This means that where a customer established in the European Economic Area or the United Kingdom sends personal data to Telebase, that is a restricted transfer under Chapter V GDPR. Telebase addresses this as follows.
Serbian data protection law, the Law on Personal Data Protection, is closely modelled on the GDPR and Serbia is a party to Council of Europe Convention 108. A copy of our Data Processing Agreement, including the completed transfer annexes, is available to customers on request.
We maintain technical and organisational measures appropriate to the risk, including:
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach affects a customer's data, we will notify that customer without undue delay in accordance with our Data Processing Agreement.
Where Telebase is the controller of your personal data, you have the following rights under Articles 15 to 22 GDPR.
To exercise any of these rights, contact hello@telebase.io. We will respond within one month of receiving the request. Where a request is complex, we may extend that period by up to two further months and will tell you if we do.
If your phone number was submitted to Telebase by a business, that business is the controller and you should direct your request to them. See section 2.
If you are not satisfied with how we have handled your personal data, you may lodge a complaint with a supervisory authority.
We would prefer the chance to resolve the matter first, so please contact us before or alongside any complaint.
Telebase is a business-to-business service. It is not directed at children, and we do not knowingly collect personal data from anyone under 18 as a controller. Customers must not use the Telebase API in a manner directed at children, and must not use it to profile or target minors.
We may update this policy. When we do, we will change the date at the top of this page. Where a change materially affects how we process personal data, we will notify account holders by email at least 30 days before it takes effect.
Changes to our sub-processors are notified separately under our Data Processing Agreement, which gives customers a period to object before a change takes effect.