Privacy & Cookie Policy

Introduction

3CX ensures it manages your personal data in line with the General Data Protection Regulation (GDPR) and as such we are committed to fair information practices and we respect the privacy and security of our users. Our goal is to provide you with a personalized Internet experience that delivers the information, resources, and services that are most relevant and helpful to you. In order to achieve this goal, we sometimes collect information during your visit to understand what differentiates you from each of our millions of other users, and we may also ask you for personal information that enables us to give you access to some parts of our web site. We will not disclose your information to any person outside our organisation except as described in this Privacy Policy.

To demonstrate our commitment to your privacy, we have prepared this statement disclosing our privacy practices. This statement describes what personal identifying information is collected, how and when we might use your information, how we protect your information, who has access to your information, and how you can correct any inaccuracies in the information.

For the avoidance of doubt, this Privacy & Cookie Policy applies only to data collected through our public websites. Processing of personal data through 3CX software, PBX systems, cloud services, AI features, integrations, or customer portals is governed exclusively by the applicable Service Privacy Notices, End User Licence Agreements (EULA), and Data Processing Addenda (DPA). Where there is any conflict, the DPA or service-specific privacy notice shall prevail.

3CX does not monitor, intercept, or access the content of communications processed through its PBX, AI or cloud services unless explicitly enabled by the customer (e.g., call recording/transcription) or required by law. 3CX has no technical ability to access end-to-end encrypted communications.

Information Collected By Us

We collect certain information from and about our visitors in three ways: from our web server logs, by means of cookies, and directly from you.

We may also collect limited technical metadata (e.g., security event logs, device identifiers, browser fingerprints) for fraud prevention, abuse detection, cybersecurity incident handling, and compliance with applicable law. Such processing is strictly limited to what is necessary and carried out under GDPR Articles 6(1)(c) and 6(1)(f).

Web Server Logs

When you visit our 3CX sites, we may track information to administer the site and analyze its usage. Examples of information we may track include your internet protocol address, what kind of browser or computer you use, the number of links you click within the site, the state or country from which you accessed the site, the date and time of your visit, the name of your internet services provider, the last page you viewed before visiting our site, and the pages you viewed on the site.

Web server logs may also be used to detect security anomalies, unauthorised access attempts, automated scraping, rate-limiting breaches, DDoS patterns or fraudulent activity. Such monitoring is essential to maintain the integrity and security of the website. Logs are retained only for as long as necessary to fulfil these purposes and in accordance with our data retention schedules.

Cookies

If your browser allows it, our web sites use cookies, which are small text files which your computer creates or modifies on instruction of the page opened in your browser. These are used to save your preferences and login information. Enabling these cookies is not strictly necessary for the website to work but it will provide you with a better browsing experience. You can delete or block these cookies, but if you do that some features of this site may not work as intended. We use the following cookies:

  • Site functionality cookies – allow you to navigate the site and use our features.
  • Site analytics cookies – allow us to measure and analyse how our customers use the site, to improve its functionality and the user experience.
  • Targeting or advertising cookies – may be used to deliver ads relevant and personalized to our users.

Google also uses personal information it receives from sites or apps that use their advertising services. You can find more information about this on Google’s business safety & privacy terms site.

Where cookies involve the processing of personal data, 3CX acts as controller and ensures full compliance with GDPR and ePrivacy rules, including consent requirements where applicable.

You may withdraw your consent to non-essential cookies at any time using your browser settings or relevant cookie controls. Non-essential cookies are deployed only after the user has provided explicit consent via our cookie banner/consent tool.

Analytics and advertising cookies may result in data transfer outside the EU; in such cases, the relevant providers act as independent controllers, and their privacy terms govern the processing.

Information From You

Visitors can register to obtain access to some parts of our web site (i.e. support pages). When you register, we will ask you for some personal information. Some of the information requested will be required for registration, and some may be optional. Also, we may ask you to disclose personal information to enable us to provide assistance and information to you. In many cases we believe it is in our legitimate interests to use your data to facilitate contact (for example to provide product updates to existing customers or to deliver support services), however, when required, we will ask for your consent to use your personal information for the intended purpose. We will not use it for any other purposes without your explicit consent. If you would like your data to be deleted at any point in time please contact us by filling in this contact form.

When submitting personal data, you agree not to upload sensitive personal data (e.g., health data, biometric data, political opinions) unless explicitly requested or required for a specific service. We do not knowingly process special categories of personal data through our public websites.

Support tickets or contact forms should not include:

  • passwords,
  • PBX admin credentials,
  • access tokens,
  • security keys, or
  • call content recordings.

If provided by mistake, such data will be deleted as soon as identified.

Use of and Access to Information

Security and Confidentiality

We use technical security measures to prevent the loss, misuse and alteration of information under our control and information about our subscribers and their website usage is maintained in a secure environment. Information about our subscribers and their website usage is not shared with third parties for any marketing purposes. We do not disclose any information about any subscribers’ usage of our website except in specific cases, for example if required to do so by law, and we do not share information with any unaffiliated third parties for marketing purposes unless you expressly give us permission to do so.

Our security measures include encryption, access controls, intrusion detection, log monitoring, vulnerability management, and regular security reviews. While 3CX implements industry-standard safeguards, no online platform can guarantee absolute security.

We may process limited technical metadata (e.g., IP addresses, timestamped logs, device identifiers, anomaly indicators) for the purposes of detecting fraud, preventing abuse, identifying security threats, and ensuring the lawful and secure operation of our website. Such processing is carried out strictly under GDPR Article 6(1)(f) (legitimate interests) or Article 6(1)(c) (legal obligation).

Any disclosure of subscriber information to authorities will occur only on the basis of a valid legal request or obligation and in accordance with applicable data protection laws, including GDPR and the ePrivacy Directive. We do not sell or share subscriber data with third parties for advertising or profiling.

Identifiable Information

We will share your personal data as required by law or by the order of any competent court or governmental authority or in matters of public safety or policy. Under strict conditions of confidentiality we may share your personal data with agents and contractors who use it on our behalf or in connection with their relationship with us. We will also share your personal data as may be needed in connection with the enforcement of agreements.

Such agents and contractors act either as data processors under documented instructions or as independent controllers, depending on the nature of the processing. 3CX ensures that any processors provide adequate guarantees of data protection in accordance with Article 28 GDPR.

Where personal data is transferred outside the EU, 3CX implements appropriate safeguards such as Standard Contractual Clauses (SCCs), adequacy decisions or other mechanisms permitted under Chapter V GDPR.

We may also share identifiable data with:

  • hosting providers,
  • cybersecurity service partners,
  • legal advisors, auditors or insurers,
  • integration/platform partners (where expressly authorised by the user).

We do not disclose identifiable data to third parties for their own marketing, analytics, or profiling purposes.

Anonymous Information

We may provide summary statistics about the interests and preferences of visitors of our web site, traffic patterns and related site information. These statistics do not include personally identifiable information.

Anonymisation and aggregation techniques used by 3CX follow GDPR Recital 26, ensuring that individuals cannot be re-identified directly or indirectly.

Anonymous information may be used to:

  • improve website performance,
  • analyse usage trends,
  • detect service availability issues,
  • plan infrastructure capacity,
  • evaluate feature engagement.

Aggregated data may be shared with service providers or partners strictly for operational or analytical purposes, and never in a form that identifies individuals.

Promotional Messages

You will not receive any promotional messages from us unless you opted to allow us to do so. If you don’t want to receive promotional materials from us, you can opt out at any time. Please use our contact page to send us a message clearly stating that you wish to opt out and stop receiving promotional messages.

We process marketing communications in compliance with GDPR, ePrivacy rules, and any applicable national laws. Promotional emails are sent only on the basis of explicit opt-in consent.

You may withdraw consent at any time by using the unsubscribe link or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out prior to withdrawal.

We do not perform behavioural advertising, data-broker sharing, or marketing profiling based on browsing activity.

3CX Phone System Cloud Applications/Integrations

3CX Phone System uses cloud web applications/services to integrate with third party providers such as Google and Microsoft.

Data Accessed

Basic profile/account information is accessed in order to perform the required verifications/actions. A full list of permissions/scopes for each app is listed on their authorization screen/wizard for users to review/accept. The apps have access only to the data listed and only upon a user's approval. All apps adhere to the privacy/security requirements/guidelines of each of the providers.

Data Usage

The integration apps are using access granted by a user to make the required changes to their cloud provider account for an integration to be set up for features like SSO, calendar/contact syncing. The apps request the minimum required scopes and a user can at any time revoke the access granted to the app. No user or account data is used by the app for any other reason other than to setup an integration nor is it shared with third parties.

Data Storage

The integration applications are used only during the setup and do not collect or store user data accessed during the integration process.

For clarity, 3CX does not access:

  • email content
  • calendar invite text
  • contact notes
  • file contents
  • chat content

unless explicitly permitted by the integration and authorised by the user.

All integrations use OAuth or other secure authentication mechanisms. Users may revoke permissions at any time via the provider’s dashboard. Revocation terminates 3CX’s access immediately.

Where integration data is transferred outside the EU, such transfers are protected by Standard Contractual Clauses (SCCs) or other GDPR-compliant safeguards.

Integration logs may record technical metadata (e.g., success/failure codes, timestamps) necessary to maintain service integrity, but no user content is stored.

Data Subject Rights

You have the following rights in relation to your personal data, subject to the conditions and limitations set out in the GDPR and applicable national laws:

  • Right of access – to obtain confirmation as to whether we process your personal data and to receive a copy of such data.
  • Right to rectification – to request correction of inaccurate or incomplete personal data.
  • Right to erasure – to request deletion of your personal data where legally permitted.
  • Right to restriction – to request that we limit the processing of your personal data in certain circumstances.
  • Right to object – to object at any time to processing based on our legitimate interests or to direct marketing.
  • Right to data portability – to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.

You also have the right to withdraw your consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us via our Data Protection Contact section below. You also have the right to lodge a complaint with your local data protection authority.

Data Controller Information

3CX is the data controller responsible for processing your data.

3CX, 4 Markou Drakou, Engomi, Nicosia 2409, Cyprus

Data Protection Contact

Name Ruth Abbott

Email [email protected] 

Phone Number +357 22 060790

See Also

Last updated on 26 June 2026

https://www.3cx.com/company/privacy/