1. Controller for the Processing of Data
The controller responsible for the processing of personal data is:
NFON AG
Zielstattstraße 36
81379 Munich
Germany
(hereinafter also referred to as "NFON", "we", "us", or "our").
You may contact the Data Protection Officer of NFON AG by post at the address above, for the attention of the Data Protection Officer, or by email at: datenschutz@nfon.com.
2. What do we use your data for (purpose of processing), and what is the legal basis for the processing?
Our APIs enable automated communication and interaction between systems in connection with our services. Depending on the specific use case, both technical data (configuration data, log data) and personal data (traffic data, subscriber data) may be processed. Below, we provide information about the data processing activities carried out within the individual APIs. A complete overview of the different categories of data can be found in the interface documentation for the respective API.
The data may be stored and processed in the systems operated by the API user. NFON merely provides the API and has no influence over any subsequent processing of data within those systems. On NFON's side, the data is deleted in accordance with the applicable statutory retention periods.
2.1 CTI API
The purpose of data processing within the CTI API is to control and integrate telephony functions into third-party applications (e.g. the customer's CRM system). Among other things, the following functions can be supported:
Display of caller information
Initiating and terminating calls
Synchronization of line status
Real-time streaming of call events
This API provides the following data for real-time retrieval, which may be further processed by the API user or by customer-operated systems (e.g. CRM systems) or software:
Telephone numbers of the participants
PBX identifier and extension
Call duration and call status (ringing, answered, disconnected)
User and line status
Date and time of the call
2.2 Service Portal API
The Service Portal API processes data for the purpose of managing the configuration data of a telephone system (e.g. extensions and address book data).
Through this API, the following categories of data are transmitted between the API user and our systems:
Extension information, including names
PBX configuration data
Telephone system directory data
2.3 NIA FrontDesk API
The purpose of data processing within the NIA FrontDesk API is the transmission of NIA FrontDesk transcriptions. This API provides the following data for retrieval, which may be further processed by the API user or by customer-operated systems (e.g. CRM systems) or software:
Transcriptions of callers' audio data
Caller's telephone number
PBX identifier and extension
Call duration
Date and time of the call
2.4 Call History API
The Call History API provides data for the purpose of making call lists available to and integrating them into third-party applications, as well as for the analysis and documentation of communication activities.
The Call History API provides, in particular, the following data for retrieval, which may be further processed by the API user or by customer-operated systems:
Telephone numbers of the participants involved
PBX identifier and extension
Date and time of the call
Call duration
Connection and usage data
Information regarding the status or progress of the connection
2.5 Technical Access Data
Each API also collects technical access data (log data), including:
Full API URL including query string
IP address
Timestamp of the access
Endpoints used
Error codes, including authentication identifiers
Log data (technical logs) is processed exclusively for the purposes of security, troubleshooting and optimization of the API infrastructure.
The data is routinely deleted after 30 days.
2.6 Login with NFON
Third parties may integrate the "Login with NFON" feature into their applications. This is a Single Sign-On (SSO) functionality that enables end users of NFON customers to log in to a third-party application using their NFON credentials.
The purpose of the processing is the secure authentication of the end user vis-à-vis the third-party system and to enable access to defined resources of the NFON Cloud Business Telephony solution for transfer to a third-party system.
During login, the following data is processed:
Token data (User ID)
Authentication data
Log data (time of login, third-party application used, IP address, session ID, retrieved data)
Communication data processed within the Cloud Business Telephony system and made available by the PBX user for retrieval (e.g. call history, participating telephone numbers, timestamps, duration, call direction, call status, call summary/transcript)
2.7 Legal Basis
Processing is based on the following legal bases:
Article 6(1)(b) GDPR (performance of a contract): API usage in accordance with the applicable Terms of Use.
Article 6(1)(a) GDPR (consent): in particular for the transmission of traffic data via the CTI API.
Article 6(1)(f) GDPR (legitimate interests): for example, to ensure the stability, security and optimization of the API infrastructure.
3. Disclosure of Data
3.1 Internal Recipients and Processors at NFON
Within our company, only those persons and departments (e.g. Support) that require your personal data for the fulfilment of our contractual and legal obligations are granted access to such data.
Where external service providers are engaged to provide our services, they may process your data solely for the performance of their assigned tasks. Such service providers are carefully selected and commissioned by us. They are contractually bound by our instructions and are required to implement appropriate technical and organisational measures to protect the rights of data subjects.
Data processing by our processors takes place predominantly in Germany or within the European Economic Area (EEA).
Where a service provider processes your data outside the European Economic Area, we ensure that such service provider contractually (e.g. by concluding the Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021) or by other appropriate means guarantees a level of data protection equivalent to that required within the European Union in accordance with Chapter V GDPR.
Furthermore, data may be disclosed in connection with requests from public authorities, court orders or legal proceedings where this is necessary for the establishment, exercise or defence of legal claims.
3.2 Responsibility of the API User
Where service providers or other third parties are granted access to personal data via the APIs (e.g. through scripts or integrations), the API user, acting as the controller, is solely responsible for ensuring compliant data protection implementation, including the conclusion of any required data processing agreements pursuant to Article 28 GDPR and, where applicable, the implementation of appropriate safeguards for transfers to third countries.
4. Your Rights
As a data subject, you may exercise your rights regarding the processing of personal data through the APIs at any time by contacting NFON AG using the contact details provided in Section 1.
Subject to the applicable legal requirements, you have the following rights:
Right of access (Article 15 GDPR)
Right to rectification (Article 16 GDPR)
Right to erasure (Article 17 GDPR)
Right to restriction of processing (Article 18 GDPR)
Right to data portability (Article 20 GDPR)
You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The competent supervisory authority in Bavaria is:
Bavarian State Office for Data Protection Supervision (BayLDA), P.O. Box 1349, 91504 Ansbach, Germany
E-mail: poststelle@lda.bayern.de
Right to Object
Where we process your personal data on the basis of a balancing of interests, you have the right to object to such processing. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Right to Withdraw Consent
You may withdraw any consent you have given at any time, in whole or in part, with effect for the future by contacting NFON AG by post for the attention of the Data Protection Officer or by email using the contact details provided above.
In the event of a withdrawal, the relevant data will be deleted, anonymised or blocked without undue delay. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
5. Amendments to this Privacy Notice
We may update this Privacy Notice from time to time. This includes amendments resulting from the further development of our services, the implementation of new technologies or services, or changes required by legal or regulatory requirements.
Any updates to this Privacy Notice will be published on this page.
Version: July 2026