General Data Protection Regulation

Our Approach to Data Protection

Number Access, LLC is a United States-based wholesale telecommunications carrier providing numbering, voice, messaging, intelligence, and network infrastructure services to carriers, communications service providers, and other authorized business customers.

Our business model is fundamentally different from that of consumer-facing communications platforms, advertising networks, data brokers, and companies that collect personal information for commercial profiling.

Number Access does not sell personal information, maintain consumer marketing profiles, or collect personal information for unrelated commercial exploitation.

Information handled by Number Access is limited to what is reasonably necessary for providing and administering services, maintaining network operations, protecting infrastructure, supporting customer relationships, meeting regulatory requirements, and fulfilling other legitimate business or legal obligations.

This page explains how that business model relates to the European Union General Data Protection Regulation (GDPR) and how applicable privacy requests are evaluated.

The GDPR establishes requirements for the processing of personal data within its territorial and substantive scope.

Number Access is established in the United States and primarily operates as a wholesale telecommunications infrastructure provider.

The availability of a website or telecommunications service from outside the United States does not, by itself, establish that every processing activity undertaken by Number Access falls within the GDPR.

Whether the GDPR applies to a particular activity depends on the relevant circumstances, including the location and activities of the parties, the nature of the processing, and the territorial scope established by applicable law.

Number Access does not represent that the GDPR applies universally to its operations or to every inquiry submitted by an individual.

Where applicable data protection laws govern particular processing activities, Number Access evaluates its obligations accordingly.

2. No Consumer Data Brokerage or Commercial Profiling

Number Access does not operate a consumer data brokerage business.

We do not collect personal information for the purpose of building consumer advertising profiles, selling marketing databases, or monetizing individuals’ personal information.

We do not sell personal data obtained through our wholesale carrier relationships.

Information associated with our services is handled for legitimate telecommunications, customer-service, administrative, security, regulatory, and legal purposes.

The existence of a telephone number, carrier association, routing record, or network identifier within a telecommunications system does not mean that Number Access maintains a personal profile or subscriber account for the individual associated with that identifier.

3. Information Processed in the Course of Business

Depending on the service and business relationship, Number Access may process limited categories of information, including:

Business contact details provided by customers, prospective customers, vendors, and authorized representatives.
Information necessary for customer onboarding, account administration, billing, support, and regulatory verification.
Technical identifiers and network information necessary to provision, route, troubleshoot, secure, and maintain telecommunications services.
Operational logs and records necessary for network integrity, fraud prevention, regulatory compliance, dispute resolution, or other legitimate purposes.
Information voluntarily submitted through website forms or other authorized communications channels.

Certain technical or business records may constitute personal data under applicable law, depending on their content and context.

Number Access does not represent that all telecommunications records are anonymous or categorically outside the scope of privacy legislation.

4. Wholesale Carrier Relationships and Subscriber Information

Number Access primarily provides services to other carriers and communications providers rather than directly to retail subscribers.

Our customers generally establish and maintain their own relationships with their end users, including subscriber onboarding, identity verification, account management, and customer support.

Accordingly, Number Access generally does not maintain the same subscriber identity, billing, account, or service records held by a retail communications provider.

Requests concerning a retail subscriber account should ordinarily be directed to the communications provider maintaining that account.

A telephone number’s association with Number Access through numbering assignments, carrier identification, routing information, or toll-free administration does not necessarily establish that Number Access controls the subscriber information associated with that number.

Nor does such an association establish that Number Access originated, transported, or terminated a particular communication.

5. Data Controller and Processor Responsibilities

Under applicable data protection laws, responsibilities may differ depending on whether an organization determines the purposes and means of processing personal data or processes information on behalf of another organization.

For information relating to its own business administration, customer relationships, website operations, or legal obligations, Number Access may act as an independent controller where applicable law so provides.

For certain information handled in providing services to wholesale customers, Number Access may act as a processor or in another capacity determined by the particular processing activity and applicable law.

These roles are determined by the facts and legal requirements, not solely by the description of a service as wholesale.

Where a customer is responsible for responding to requests concerning data under its control, Number Access may direct the requester to that customer or provide appropriate assistance consistent with applicable contractual and legal obligations.

6. Purposes and Legal Bases for Processing

Where the GDPR applies, personal data is processed only where an appropriate legal basis exists.

Depending on the circumstances, relevant purposes and legal bases may include:

Performing contractual obligations and administering business relationships.
Meeting applicable legal and regulatory requirements.
Protecting network infrastructure, detecting abuse, and maintaining service security.
Supporting legitimate business operations and customer communications.
Responding to lawful requests from authorized public authorities.
Processing information with consent where consent is required and appropriate.

The applicable legal basis is determined by the specific processing activity.

Number Access does not rely on a single legal basis for every category of information or every business operation.

Number Access does not sell personal information.

Information may be shared or disclosed only where reasonably necessary and appropriate for legitimate business or legal purposes, including:

Delivering telecommunications services and supporting authorized interconnection or routing arrangements.
Working with service providers performing functions on our behalf.
Meeting applicable telecommunications, security, and regulatory obligations.
Responding to valid legal process or other legally authorized requests.
Protecting network integrity, investigating abuse, or enforcing applicable agreements.

Any disclosure remains subject to applicable legal requirements, contractual obligations, and relevant confidentiality restrictions.

Information is not disclosed merely because an individual or third party requests it.

8. Data Retention and Security

Number Access seeks to limit the retention of information to periods reasonably necessary for legitimate business, operational, contractual, regulatory, security, and legal purposes.

Retention requirements may vary by record type and applicable law.

Information may need to be retained for legal compliance, network security, billing, dispute resolution, or the establishment, exercise, or defense of legal claims.

Number Access uses administrative, technical, and organizational safeguards appropriate to the nature of the information and the risks associated with its processing.

No telecommunications or information system can be represented as entirely free from security risks.

9. Individual Data Protection Rights

Where the GDPR applies, individuals may have rights concerning personal data processed about them, subject to applicable conditions, exceptions, and limitations.

These may include rights of access, correction, erasure, restriction, portability, and objection.

Such rights are not absolute and do not necessarily apply to every category of information or processing activity.

For example:

- Number Access cannot provide personal information it does not possess or control.
- Number Access cannot modify or delete records maintained independently by another carrier.
- Erasure requests may be limited by legal retention requirements or other applicable grounds.
- Requests for information concerning other individuals, confidential network records,
    or protected customer information may be subject to legal restrictions.
- Requests involving data processed on behalf of another organization may need to be addressed through the responsible controller.

The submission of a GDPR request does not itself establish that the GDPR applies to the requested information or that the requested action is legally required.

10. Requests Concerning Telephone Numbers

Number Access may be identified in industry databases, numbering records, carrier lookup services, or telecommunications routing information.

These associations should not be interpreted as evidence that Number Access maintains a direct relationship with the person using a telephone number.

Number Access does not maintain a comprehensive consumer directory or subscriber database covering every telephone number associated with its network or numbering resources.

A request to identify the user of a telephone number, obtain subscriber records, retrieve communications content, or delete records held by an unrelated provider cannot ordinarily be fulfilled solely on the basis of a Number Access carrier association.

Individuals seeking access to their subscriber account information should generally contact the communications provider with whom they maintain their service relationship.

11. International Data Processing

Telecommunications services and supporting systems may involve communications or operational activities across jurisdictional boundaries.

Where international transfers of personal data are subject to applicable data protection requirements, Number Access evaluates the relevant legal obligations and safeguards.

The mere international routing of telecommunications traffic does not, by itself, determine the legal classification of every related data processing activity.

Individuals who believe Number Access processes their personal data and that applicable law provides a right concerning that processing may submit an inquiry through our Privacy Support page.

To help identify the relevant processing activity, a request should describe:

The nature of the request.
The individual’s relationship, if any, with Number Access.
The specific service, business interaction, or processing activity involved.
Information reasonably sufficient to locate the relevant records.

Please do not submit government identification documents, sensitive personal information, or unrelated subscriber records unless specifically requested through an appropriate secure process.

Number Access may request proportionate additional information where reasonably necessary to verify identity or identify the information involved.

Requests are assessed according to applicable law, the nature of the processing, the information available to Number Access, and the company’s role in relation to that information.

Where no responsive personal data is held, or where the requested action is not legally required, Number Access may explain that determination as appropriate under applicable law.

13. Response to Requests

Number Access evaluates privacy requests individually.

Where applicable law establishes a response deadline, verification requirement, disclosure obligation, or permitted exception, the company will handle the request in accordance with those requirements.

Submitting a request does not create a right to confidential network information, third-party subscriber records, proprietary systems, or information that Number Access is not legally authorized to disclose.

Requests that fall outside the scope of an applicable privacy law may be handled under the company’s general privacy procedures.

Nothing on this page limits rights or remedies that cannot lawfully be excluded.

14. Relationship to Other Policies

This page provides information specifically concerning GDPR applicability and related data protection matters.

For additional information, please review:

In the event of a conflict between this page and mandatory applicable law, the applicable law controls.

15. Scope of This Statement

This statement describes Number Access’s general business model and approach to privacy and data protection.

It does not constitute a representation that every telecommunications service, processing activity, or customer relationship is subject to the GDPR.

It does not establish that Number Access is the data controller for records maintained by unrelated communications providers.

Nothing in this statement creates contractual rights or obligations beyond those established by applicable law and governing agreements.

Number Access may update this statement to reflect changes in its operations, services, or applicable legal requirements.