Draft — pending legal review.
You may be reading this because a business used MobileValidate to check your phone number or e-mail address, or because your number appears in spam or nuisance-call report data. We did not collect this data from you directly, so this notice explains what we hold, where it comes from, what we use it for and how you can object. It follows the approach of Article 14 GDPR. The provider of the service is BroadNet Technologies Inc., 5th floor, Minkara Building, Clemenceau Street, Beirut, Lebanon.
Why would your number or e-mail address be checked?
Our customers are businesses. They send us phone numbers or e-mail addresses they already hold, usually from their own customers, sign-ups or contact forms. They do this for a few reasons:
- to prevent fraud, for example fake sign-ups or one-time passcodes sent to numbers that can't receive them;
- to improve deliverability, for example by fixing mistyped numbers and choosing the channel a message can reach;
- to verify leads.
Each check answers a narrow question. Does this number have an account on a given messaging app or online service? Does this mailbox exist? What line type and carrier does the number have? The answer is yes, no or unknown, or a small piece of network data. We never return your name, photo, profile, messages or location. We never contact you as part of a check.
Who is responsible for the data?
For most checks, we act as a processor for the customer who asked for the check. That customer is the controller, and you can also use your rights with them. For checks that show whether a number or address has an account on a platform, we may act as controller for some of the processing, for example our own caching of results (pending counsel review). For the spam-reputation data described below, we are the controller.
What data do we hold about you?
- The identifier: your phone number in international format, or your e-mail address. It is stored encrypted, with a keyed hash so it can be matched without being readable.
- Check results: registered / not registered / unknown for each service checked, and when the check happened.
- Network data about the number: line type (for example mobile or VoIP), the current carrier and the carrier originally assigned the number, and the country.
- Spam-reputation data (US, Canadian and German numbers only): a risk level and score, which classes of report exist, the most frequent report category, and the months the number first and last appeared. We don't hold report texts or anyone's name.
Where does spam-reputation data come from?
For phone numbers from the United States, Canada and Germany, we compile reputation signals from four classes of source:
- published actions by telecom regulators;
- government nuisance-call complaint data;
- community spam-report websites;
- public listings of numbers offered for sale as unassigned, which can point to a spoofed caller ID.
Our legal basis is legitimate interests: protecting people and businesses from spam and fraud calls. A reputation level is a signal and not a finding that anyone did something wrong. A number can appear in reports because someone else spoofed it. If you think this applies to your number, please object as described below.
How long do we keep it?
- Real-time lookups: 7 days.
- Bulk jobs: 30 days by default. The customer can set a shorter or longer period, up to 24 months.
- Cached results and observations used to avoid repeat checks: up to 400 days (this period is pending review).
- Spam-reputation data: while the reports are current. Older reports carry less weight. [Maximum period — pending].
What rights do you have, and how do you use them?
You can ask for access to your data, and for it to be corrected or erased. You can also object to its use. Use the opt-out form and enter the phone number or e-mail address concerned. Once your request is approved, the identifier goes on our suppression list. It will then no longer be checked for any customer, and we treat erasure requests the same way.
For privacy reasons, the form's reply is always the same and never confirms whether we hold data about an identifier. We may ask for proof that you control the number or address before we release any data. You can also contact [privacy contact — pending]. You have the right to complain to a data-protection supervisory authority, in particular in the country where you live or work.