What is this Privacy Policy for?

This policy explains how Telephone Systems Installations Limited, trading as TSI, handles personal information in connection with our website, business relationships and services. It includes specific information about the Cross Connect Softphone app for Android and Apple iOS, and AI Connect.

1 Who we are and how to contact us

TSI is the trading name of Telephone Systems Installations Limited, registered in England and Wales under company number 03406791. Our registered office is 151 Business Design Centre, 52 Upper Street, London N1 0QH. Cross Connect Softphone is published on Google Play under the developer name T S I and on the Apple App Store under Telephone Systems Installations Ltd.

For privacy enquiries, requests about your personal information or data protection complaints, contact:

Email: hello@tsicomms.co.uk, marked for the attention of the Data Protection Contact.

Telephone: 0333 015 3333.

Post: Data Protection Contact, TSI, 151 Business Design Centre, 52 Upper Street, London N1 0QH.

We handle personal information under the UK General Data Protection Regulation, the Data Protection Act 2018, as amended, and other applicable privacy and electronic communications laws.

2 When TSI is responsible for your information

TSI is a data controller where we decide why and how personal information is used. This includes administering our website, responding to enquiries, managing customer, partner and supplier relationships, billing, marketing, and handling our own business communications.

When an organisation uses our services to process its employees’ or customers’ communications, that organisation will usually be the controller for the content and purposes of those communications. TSI may act as a processor or sub-processor, using the information on the controller’s documented instructions. A channel partner may also act as a controller or processor, depending on its activities.

If you use a service supplied by your employer, another business or a channel partner, read its privacy information as well. It explains its reasons for processing, service settings, retention choices and relevant lawful bases. TSI may separately be a controller for records we need for our own billing, security or legal obligations.

Where we operate AI Connect for TSI’s own enquiries or demonstrations, TSI is the controller for that use. This policy does not replace our agreements governing processing on behalf of customers or any separate employee or recruitment privacy notice.

3 Information we process and where it comes from

The information involved depends on your relationship with us and the services and features used. It may include:

• Identity and business contact information, such as names, roles, employers, addresses, email addresses and telephone numbers.
• Account, commercial and financial information, including user identifiers, service settings, orders, contracts, billing details, payments and correspondence.
• Communications information, including calling numbers, call times and duration, routing details, voicemail, messages and, where enabled, recordings, transcripts and summaries.
• Support and technical information, such as support tickets, IP addresses, device and software information, registration and connection records, diagnostic logs and security events.
• Website usage and marketing preferences, and information about interactions with our communications where permitted.
• Information supplied to AI Connect or accessed through an authorised integration, as described in section 6.

We obtain information directly from you, through your use of our services, and from organisations involved in providing them, including your employer, service administrator, channel partner, telecommunications providers and integrations you or your organisation authorise. We may also receive business contact information from public business sources or introductions.

If information is needed to provide a requested service, fulfil a contract or meet a legal requirement, we will explain that where relevant. Without it, we may be unable to provide the service or complete the request. Optional permissions and marketing choices are explained separately.

4 How we use information and our lawful bases

Where TSI acts as controller, we identify a lawful basis for each purpose:

• Enquiries, quotations, orders and service delivery: taking steps at your request before entering a contract, or performing a contract with you. Where you act for a company or another person, we generally rely on our legitimate interests in managing that business relationship.
• Account administration, support, billing and operational communications: performing our contract with you where applicable, or our legitimate interests in administering and supporting services and resolving queries.
• Service reliability, security, fraud prevention and proportionate troubleshooting: our legitimate interests in protecting people, systems and services, and legal obligations where applicable.
• Accounting, regulatory compliance and lawful disclosures: compliance with our legal obligations. Establishing, exercising or defending legal claims may also involve our legitimate interests.
• Marketing and understanding demand for our services: consent where required, or our legitimate interests in promoting relevant business services where the law permits. Section 8 explains your choices.
• Optional cookies or similar technologies: consent where required by law. Necessary technologies and any permitted exemptions are explained through our cookie information.

When relying on legitimate interests, we consider whether the processing is necessary and whether your interests, rights or freedoms override those interests. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Reading this policy or accepting service terms does not itself give blanket consent.

Where TSI is a processor, the controller determines the purposes and lawful bases, and we process information under its documented instructions.

5 Cross Connect Softphone for Android and iOS

This section applies to both versions of Cross Connect Softphone:

• Android: available on Google Play, with package identifier uk.co.crossconnect.crossconnect.android.
• Apple iOS: available on the Apple App Store, with App Store ID 6470291290.

Both versions connect to an existing supported service-provider account and enable Cross Connect communications and account features. The information below applies to both versions unless a platform-specific practice is identified.

Optional access to device contacts

The app can access your device’s contacts list to support contact lookup and calling. Contacts permission is optional and is granted through your device’s permission controls.

Contact access is triggered by your action and checks existing contacts; the app does not iterate through your contacts in the background.

Contact information accessed through this permission is not stored outside Cross Connect or supplied to an external service or third party.

You can revoke Contacts permission at any time through your device’s app permission settings. Contact-dependent features will then be limited.

These statements concern access to your device’s address book. They do not mean that calls, account information or other service records require no processing. Contact details that you separately provide in a call, message or authorised integration are handled for that separate purpose.

Communications and device permissions

The app uses your microphone for voice communications. Account credentials, telephone numbers, call information, voicemail and service settings are processed as needed to provide the features you use. Technical and diagnostic information may be processed to establish connections, deliver the service, investigate faults and protect accounts.

The iOS app may collect crash diagnostics to support app functionality and stability. These crash diagnostics are not linked to your identity.

On Android and iOS, you can change or revoke device permissions through the app permission or privacy controls in your device’s settings. The available controls depend on the operating-system version. Withholding or withdrawing a permission may prevent the corresponding feature from working. Authorised account administrators and service providers may access relevant service records to administer and support your account, subject to their responsibilities and access controls.

Account and data deletion

To request deletion of your Cross Connect Softphone account or associated personal information, contact the organisation that provides or administers your account, or email hello@tsicomms.co.uk and identify the app, your account and the information concerned. Please do not send your password.

We will handle requests for information we control and assist the relevant controller with requests relating to managed accounts. Deleting the app or revoking a device permission does not automatically delete service-side records or terminate a service contract. Retention and any lawful limits on deletion are explained in sections 11 and 13.

6 AI Connect

AI Connect is an AI-assisted communications service that can handle telephone conversations and website voice or text interactions. Depending on the organisation’s configuration, it can answer enquiries, take messages, help with appointments, route enquiries and interact with connected business systems.

Information used by the AI agent

AI Connect processes the information needed to understand and respond to an interaction. This may include your voice or written messages, caller number, name, contact details, enquiry, conversation history, appointment information and relevant records returned by authorised integrations.

Live audio processing is distinct from retaining an audio recording. Recordings, transcripts, summaries, actions and reporting records may be retained according to the enabled features and the controller’s retention settings. The organisation operating the agent is responsible for explaining its use of AI and any recording or transcription when collecting your information.

Use of conversation data

AI Connect processes customer information within the scope of the customer’s implementation and agreed purposes. Customer data is not used to train or improve generic large language models. This does not prevent processing needed to answer an enquiry or produce the transcripts, summaries and reporting configured for that service.

AI Connect uses specialist platform, hosting, telecommunications and AI-processing providers. Its voice service uses Ultravox speech-to-speech technology, with voice-model processing hosted in the United States. The location of one hosting component does not determine the location of every component; see section 10.

Connected calendars and business systems

Where an authorised user connects a calendar, CRM, email or other business system, AI Connect can access and use information within the permissions granted for the configured feature. For example, an appointment feature may check availability and read, create or change relevant appointments; a CRM feature may retrieve or update a contact or record an enquiry.

Integration information may include contact details, appointment dates, times and descriptions, relevant business records, and authorisation tokens. Information necessary to perform the requested function may pass between the connected service and the providers delivering AI Connect.

Access can be withdrawn through the connected provider’s account controls or by asking the service administrator to disconnect the integration. Revoking access stops future authorised access through that connection; it does not automatically remove records already created or retained under the applicable retention arrangements.

Where information is obtained through Google APIs, its use is limited to the authorised user-facing integration features and is subject to the Google API Services User Data Policy, including the Limited Use requirements. Such information is not used for advertising or to train or improve generic language models.

Sensitive information and AI responses

Conversations may contain health information or other special category information. Please provide only information necessary for your enquiry, and do not disclose passwords, authentication codes or payment-card details through an ordinary AI conversation. The controller must identify an appropriate lawful basis and any additional legal condition required for sensitive information.

AI responses and summaries may contain errors. You can ask the organisation operating the agent to correct personal information and explain how to contact a person or use an alternative enquiry route.

AI Connect’s reception and administration functions do not, by themselves, describe every customer’s decision-making process. If an organisation uses personal information to make a solely automated decision with a legal or similarly significant effect, it must explain that use, the relevant logic and consequences, and the applicable safeguards, including how to obtain human intervention and challenge the decision.

7 Who receives personal information

We disclose information where necessary for the purposes described in this policy, including to:

• Your organisation, its authorised users and administrators, or the relevant channel partner, where needed to provide and manage the service.
• Service providers supporting telecommunications, cloud hosting, software, AI processing, authorised integrations, support, security, billing and business administration.
• Professional advisers, insurers and payment or banking providers, where relevant to the matter concerned.
• Regulators, courts, law enforcement or other recipients where disclosure is required or permitted by law and is necessary and proportionate.
• Relevant advisers or parties involved in a business reorganisation or transfer, subject to appropriate confidentiality and legal safeguards.

Processors are required to act under appropriate contractual controls, protect the information and use it only for authorised purposes. Where a recipient determines its own purposes, its privacy information also applies. Information about the providers relevant to your service is available from TSI or your service provider.

8 Marketing choices

We may send relevant information about TSI services where you have consented or where another lawful basis and the electronic-marketing rules permit it. The rules differ for corporate contacts, individuals, sole traders and certain partnerships; we do not treat every business address as exempt from consent requirements.

You can object to direct marketing at any time. Use the unsubscribe link in a marketing email or contact us. Withdrawing marketing permission does not stop necessary service, security or account communications. We may retain minimal suppression information to ensure we respect your choice.

9 Cookies and website information

Our website uses cookies and similar technologies to operate and, where enabled and permitted, understand usage and measure communications. Details of the technologies in use, their purposes and available controls are provided through our website’s cookie information and settings.

Where consent is required, you can choose whether to allow those technologies and withdraw consent through the available settings. Browser settings also provide controls, although blocking necessary technologies may affect website functionality. Third-party websites and services have their own privacy information.

10 International processing and transfers

Personal information may be processed outside the United Kingdom where our providers or their authorised personnel operate internationally. AI Connect voice-model processing currently takes place in the United States through Ultravox. Hosting options for other components do not, by themselves, mean that all AI processing remains in the selected region.

Where UK data protection law restricts a transfer, we require a permitted transfer mechanism. Depending on the destination, recipient and processing, this may be UK adequacy regulations or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, together with any required assessment and additional measures.

The UK Extension to the EU-US Data Privacy Framework can only be relied on where the relevant recipient and processing meet its requirements. We do not rely on the former EU-US Privacy Shield.

Contact us for details of the locations and transfer safeguards relevant to your service and how to obtain a copy of those safeguards. Where we process information on a customer’s instructions, the applicable processing agreement and supplier arrangements also govern transfers.

11 Retention and deletion

Retention depends on the type of information, the purpose, applicable legal obligations and, for customer-controlled service content, the controller’s instructions and configured settings. We use the following criteria:

• Enquiries and business contacts: while needed to respond, manage an active relationship or follow up a relevant enquiry, with review when the relationship or purpose ends.
• Contracts, billing and financial records: for the applicable accounting, tax and regulatory record-keeping requirements and any justified period needed to deal with disputes or legal claims.
• Support, technical and security records: for the period needed to investigate and resolve the issue, maintain service security and accountability, or meet a specific legal requirement.
• Customer communications and AI Connect records: according to the controller’s justified retention requirements and enabled service settings. AI Connect supports configurable retention and secure deletion or anonymisation.
• Marketing preferences and suppression records: for as long as needed to evidence and respect your choices.

When information is no longer required, it is deleted or anonymised. Return or deletion of customer-controlled service data on termination is governed by the applicable processing agreement, customer instructions and legal obligations. Deletion from backups follows the applicable backup lifecycle; any retained copies remain protected and restricted to their justified purpose.

The organisation operating a customer service should tell you the period or criteria applying to its recordings, transcripts and other content. You can ask us about retention of information for which TSI is controller. Uninstalling an app, disconnecting an integration or ending a contract does not override a lawful need to retain particular records.

12 How we protect information

We use technical and organisational measures appropriate to the information and risks, including access restrictions, confidentiality requirements, security monitoring and controls over service providers.

For AI Connect, controls include TLS 1.2 or higher for data in transit, AES-256 or an equivalent modern cipher for data at rest, logical separation between customers, least-privilege access, multi-factor authentication for privileged operations and administrative activity logging.

Customers are responsible for managing their own users, devices, permissions and connected systems. No system can eliminate every risk. We investigate security incidents and provide notifications where required by law and the applicable processing arrangements.

13 Your rights

Depending on the circumstances and lawful basis, you may have rights to access your personal information, correct inaccuracies, request erasure, restrict processing, receive certain information in a portable form, and object to processing. Where consent is used, you can withdraw it. Rights and safeguards also apply to qualifying solely automated significant decisions.

You have an absolute right to object to direct marketing. For processing based on legitimate interests, you can object on grounds relating to your particular situation.

Requests can be made verbally or in writing using the details in section 1; you do not need a particular form or legal wording. We may reasonably verify identity or authority to protect information. Requests are normally free. Any permitted fee, refusal, extension or restriction will be explained.

We respond without undue delay and normally within one calendar month, subject to the legal rules on identity checks, clarification and extensions. Where TSI is a processor, we will assist the controller or direct your request to the appropriate organisation.

14 Complaints

Please contact our Data Protection Contact if you are concerned about how your information is handled. We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator: ico.org.uk/make-a-complaint/ or 0303 123 1113.

15 Changes to this policy

We review this policy when our services, processing or legal requirements change. The policy was last updated on 29 October 2026. Where a change materially affects how your information is used, we will provide appropriate notice and obtain any consent required before the new use begins.