3CX Video Conference Privacy Policy
This privacy policy will explain how our organization uses the personal data we collect from you while using 3CX Video Conference. 3CX ensures it manages your personal data in line with the principles of Regulation (EU) 679/2016 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (known as “GDPR”), the applicable local legislation as amended from time to time and any other legal and/or regulatory obligations and as such we are committed to using the minimal amount of data needed in order to provide reasonable functionality in 3CX Video Conference.
Our company collects the following personally identifiable data: Participants Names and IP Addresses, 3CX System information such as FQDN, IP Address and ID.
We collect information from the use of 3CX Video Conference.
3CX System Identification Data
After activating your 3CX System, an activation request via 3CX Video Conference API is sent. This request contains the 3CX System’s public IP / FQDN, and an ID which is a unique identifier for your installation and is required to be stored in the 3CX Video Conference portal for the purpose of allowing the 3CX System to use the full set of 3CX Video Conference API’s and hence the full use of the 3CX Video Conference platform’s features and capabilities.
3CX Video Conference Use / Runtime
Before and during the usage of the 3CX Video Conference certain data is required in order to deliver a full set of 3CX Video Conference features to all users.
List of personally identifiable data collected for this purpose and for what exact reasons:
Meeting Participant Names
When a meeting is started, your 3CX System will send the list of invited participant names to the meeting MCU server where that meeting will take place. This operation is done to be able to show participants names in the UI.
Meeting Participant IPs
Participant IP’s are logged and stored for information purposes.
Uploaded files or Documents & Names Of
Files shared using the 3CX Video Conference File Share functionality are temporarily stored on a server in a regional Google data centre. File names are anonymized on upload and given a random name instead of their original name. They are deleted automatically after 7 days. Text and file uploads in the chat are deleted when the meeting is closed.
3CX securely stores your data in data centres through Vultr, Google, Amazon AWS, Amazon Lightsail, DigitalOcean, Host Africa for hosting its platform and services . User data is securely stored in a regional Google Cloud (GCP) Datacenter accessible only via secure communication channels by authorized 3CX relevant systems and networks. Data processing occurs throughout all the above data centres. 3CX also ensures that all unnecessary user data is completely deleted from its active production service logs and databases within these timelines for each data type:
Recordings
User video and audio recordings are deleted after 7 days of the creation date of the recording. Recordings are converted in the cloud so that users can playback the WebRTC streams via common players.
PDF Share &
File Share
Files uploaded via the PDF sharing or Chat File Share feature are available for 7 days from the day of upload.
Meeting participant IPs are logged and stored
Participant IP’s are logged and stored for information purposes for up to 7 days after a meeting occurs after which point they are deleted via automatic cleanup both from databases & logs. On occasion, temporary debug log backups are taken to facilitate troubleshooting purposes for platform bugs. These temporary log backups are deleted within 6 months of their use for troubleshooting purposes.
Chats
Chats are not logged and not saved anywhere in any capacity and exist only for the duration of transit.
Meeting quality survey
Meeting quality surveys are gathered at the meeting end. This data is stored on 3CX servers, is anonymous and is used for identifying issues with 3CX infrastructure.
3CX System Sync Data
All 3CX Systems synchronize data such as 3CX System IP, FQDN and ID. Those are stored only for the purpose of providing the features of the 3CX Video Conference. This data is stored and kept only as long as the 3CX System transmitting this data is activated and while this 3CX System can be resolved by the 3CX Video Conference platform.
3CX Video Conference Server Logs
System logs for the MCU, File Share, Converter servers are retained for 7 days after which they are automatically deleted. In specific cases, the log retention period will be increased up to 6 months for general platform debugging, testing and performance tuning purposes.
Cookies
3CX Video Conference does not use cookies but browser local storage variables which are stored in your browser and include your participant name and settings values as configured from the meeting options tab during your previous sessions.
Statistical Information
3CX undertakes to apply discretion and caution when disclosing information for statistical purposes so as to guard against disclosing information by which users can be identified personally by any means whatsoever. Platform usage statistic data is anonymous.
3CX employees associated with the 3CX Video Conference platform are given access to information on a need to know basis. 3CX undertakes to not disclose personal data where not reasonably necessary or reasoned. 3CX will take all appropriate legal, organizational and technical measures to protect the personal data of users. Employees with access to personal data will be held responsible for any privacy violations in terms of this Policy and, where appropriate, institute terminations of contracts and employment.
Notwithstanding the terms of this policy set out above, you submit that 3CX may share public information and anonymized aggregated data when involved in a merger, acquisition or sale of a company. You further submit by consenting to our data processing, that 3CX may retain personal information in back-ups for up to a year even after termination of the relationship between the latter party and the User.
MCUs
3CX has proprietary software (MCU) running in the data centres it uses to forward video, audio, chat and other signalling to and from users of 3CX Video Conference. All data is secured using standard methods of encryption that are constantly kept up to date as necessary. Transmitted data are only available within the relevant meeting session and accessible only to meeting participants i.e. Platform admins and/or others do not have access to this data. Platform admins do have access to identifiable signalling data to troubleshoot platform issues on-demand, monitor and ensure the smooth operation of the platform.
Recordings created during a meeting session are stored temporarily on the MCU and then transferred to a converter in the same region.
3CX System - MCU Geolocation
Customers located* in the EEA will always create meetings on a server in the EEA as long as they selected Europe as the region within the 3CX System. All users joining this meeting will be processed in the EEA and all data storage is also located within the EEA. We cannot guarantee that the server/s are located in a specific country. This is required for load balancing and redundancy reasons.
For transparency, if a user joins a meeting that is not created by their organization, then they may join a meeting server that is not located in the EEA but in the region complying with the host's regulatory needs (e.g Australia). One can always check in the meeting to which server they are connected to.
*Customer location is determined by the Video Conferencing region which was pre-selected from 3CX System Settings / Conferencing / Select Your Region field. You can change it at any time.
Recording Converters
3CX has proprietary software running in the data centres it uses to convert raw meeting recordings to MPEG4 video format on the fly. Recording converters receive raw recordings from the MCU and convert them. After this the recording is uploaded to Google Storage, given a complex public link and then consequently deleted from the recording converter. In rare cases where recording conversions can fail, the 3CX Video Conference project team is automatically notified of the conversion failure and manual work is undertaken by a developer to identify the reason for the failure, perform a fix on the converter itself and have the converter retry the conversion until it’s successful. Recordings will also be reviewed manually when support is requested for a specific 3CX Video Conference.
3CX reserves the right to change its privacy policy at any time in order to be compliant with the governing laws. This privacy policy was last updated on 11/04/2022.
If you have any questions about this policy, the data we hold on you or would like to exercise one of your data protection rights, please do not hesitate to contact us at: [email protected]