Privacy Policy

PRIVACY NOTICE YOLLA CALLS

Version 4.0

01.03.2026

Yolla Calls International OÜ works to protect the privacy of our clients and visitors of our site.

Our mission: to uphold privacy rights for the people in the digital age.

Our strategic goals:

• to increase the public’s trust and confidence in how we use data;
• to provide excellent digital telecommunication service with high standards of information security and privacy;
• stay relevant and keep abreast of evolving technology.

We are working to earn the trust of our data subjects every day by focusing on six key privacy principles:

1. lawfulness, fairness, and transparency;
2. purpose limitation;
3. data minimization;
4. accuracy;
5. storage limitation;
6. integrity and confidentiality.

The structure of this document (search the text for the information you need and navigate through the document using active links)

Purpose and scope

This Privacy notice applies to you if you:

• interact with our websites https://yollacalls.com/\
• use our digital service - YollaCalls and mobile application Yolla Calls;
• receive our marketing communications;
• interact with our social media pages.

We want to be as secure as possible for your personal data, so your privacy is one of the priorities for us.

Please carefully read this document.

Terms to know

Some terms that can be seen in this document:

Automated decision-making is a decision that our system makes automatically due to its specific algorithm and without human participation.

We don’t use any algorithms to make any decisions that would significantly affect you.

Personal data means any information that is linked or reasonably linkable to an identified or identifiable individual, and does not include de-identified data or publicly available information.

Profiling is any form of automatic processing (i.e. using technical means) of personal data aimed at using this data to assess certain personal aspects of a person (for example, to analyze his personal preferences, interests, reliability, behavior and movements).

Processor means the company that we attract to perform on our behalf certain actions necessary for our business operation and related to the processing of your personal data (for example, a payment system, accounting services, etc.).

About us and our contacts

Yolla Calls International OÜ is the controller of personal data processed in accordance with this Privacy notice.

Our address: Rävala pst 6-404A, Tallinn city, Harju county, Estonia.

If you have any questions about this policy or questions about our processing of your personal data, we hope that you contact us, and we will be able to resolve your issue. You can contact us using:

1. email privacy@yollacalls.com or
2. by writing us to: Harju maakond, Tallinn, Kesklinna linnaosa, Rävala pst 6-404a, 10143
3. Contact us form

We will send responses to your requests to the e-mail address or in any other form, at your wish.

Your rights and how to exercise them

Your rights in relation to your personal data:

The right to access

We give you access to your personal data that is processed by the Service. Upon request*, we will tell you what personal data we process for you and how much we do so.

Right to rectification

If you want to edit (clarify / supplement) certain personal data you should contact us*.

The right to erasure (the "right to be forgotten")

In certain cases, you can request* the deletion of your personal data and the termination of their processing, e.g., when the personal data is no longer needed for the purposes of specific processing, or when you withdraw your consent or object to the processing of your personal data, or when in your opinion the processing of personal data does not comply with the law.

The right to restrict processing

You may request* that we temporarily or permanently stop processing all or some of your personal data if:

• You dispute the accuracy of your personal data;
• If you believe that the processing is illegal and, instead of deleting personal data, you want to restrict their usage by us;
• You believe that they are relevant for you to declare, implement or challenge legal claims.

The right to object to processing

If there was a legitimate interest to process your personal data or the processing was necessary to perform a task in the public interest or within the framework of exercising state power entrusted to us, you have the right to object at any time (the basis for their processing is described in the annex). You can also object to profiling based on this basis.

The right to data portability

You have the right to receive your personal data available to us, which we received with your consent, or they were provided to us for the rendering of the YollaCalls service (perform our obligations under the terms and conditions), from us in electronic format and then you can transfer such data to another person. We may, at your direction, transfer such data directly to another person, if this is technically feasible.

The right not to be subjected to automated decision-making

You have the right not to be subjected to a decision that is based solely on the automated processing of your personal data, including profiling, if such actions entail legal consequences (e.g., some of your legal rights will be infringed, limited) or similarly significantly affect you.

The right to withdraw consent

If we process your personal data based on your consent, then you can contact us to notify us that you withdraw your consent. However, if you withdraw your consent, it does not affect the legitimacy of the data processing that occurred before your withdrawal.

You can send us a request if you have any questions about your privacy rights or how you can exercise them. Our goal is to respond to your request as soon as possible, and in any event within one month of receipt if we need more time to prepare a response. Taking into account the complexity and number of requests, this period may be extended by a further two months. If a delay occurs, we will notify you within the first month and explain the reasons for it.

If the request is unclear, we may contact you to clarify the content.

As a general rule, you will not have to pay a fee to access your personal data or to exercise any of your other rights. However, we may charge a reasonable fee based on administrative costs if your request is clearly unfounded, repetitive, or excessive.

Requests may also be refused if they are clearly unfounded or excessive (repetitive).

If we have doubts whether you have really contacted us (and not someone impersonating you), we have the right to ask you to confirm your identity (e.g., to confirm some data known to you and us or to provide a copy of your identity card). This will allow us to make sure that the satisfaction of your request does not violate the rights of third parties.

If you are not completely satisfied with our response, you can also complain about our processing of your personal data to the appropriate data protection authority.

How we receive your personal data

We may receive your personal data:

• directly from you when you interact with our services and site
• we collect automatically from your device when you use the services or the website.
• from third parties or services (where this has been authorized by you or is legally permitted, or where it is necessary for us to provide the Services to you in certain scenarios)
• assigned or generated by us (e.g., we may assign you an unique service ID)

We require certain personal data to enter into and perform our contract with you for communications services. If you do not provide this data, we will be unable to enter into the contract or provide the relevant services.

We obtain personal data directly from you, automatically when you use our services and website, and from providers of services we use for service delivery, analytics and marketing. We also generate or assign certain data ourselves when providing our services.

Who we can share your data with

Third-party service providers we work with might handle your data on our behalf. You can view the list of such providers in the List of Sub-processors.

We may also share your information with third parties, such as:

• Mobile Operators: Service providers located in the appropriate jurisdiction which carry out communication;
• Law enforcement agencies, government bodies, regulatory organisations (in particular in the electronic communications sector), courts or other public authorities if we have to, or are authorised to by law;
• External and internal lawyers and/or specialist advisors - to protect our legitimate interest.

International Data Transfers

We may transfer your personal data to service providers outside the EEA, including in the United States, to perform the functions described in this Privacy Policy.

These countries may provide a lower level of data protection than the EEA. Transfers are based on a European Commission adequacy decision where it covers the relevant recipient and transfer. Otherwise, we apply appropriate safeguards, including the Standard Contractual Clauses approved by the European Commission, and additional protective measures where necessary.

You may request information about the applicable safeguards and copies of the relevant documents using the contact details provided in this Privacy Policy.

Data Retention

We retain some of your communication data during the period specified in the Electronic Communications Act. As a rule, this period does not exceed 1 year and applies only to some of your data.

Other data we may store for the period necessary to provide you with services and the validity of your account.

Also we can store some personal data for as long as necessary to protect our legitimate and significant business goals and interests.

We will store the required personal data only if necessary for:

• fulfillment of our tax and legal obligations,
• to resolve claims or disputes,
• ensuring our security,
• prevention of fraud and money laundering.

As a rule, this period does not exceed 3 years.

How we ensure the security of your data?

Our goal is to protect user data, and we take all reasonable and appropriate measures to protect our users’ data from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction.

We maintain a comprehensive information security program designed to ensure the security of your personal data by implementing physical, technical, and administrative measures and safeguards.

• To protect your personal data, we:
• Partner with reliable third parties who meet Personal data protection standards.
• Have established a comprehensive set of security policies across various areas.
• Control and differentiate access levels to your Personal data for our employees and third parties, and monitor data access and usage.
• Limit data access to only authorized employees who require it to fulfill their roles.
• Use encryption.

If you have any questions about our security measures, please contact us via privacy@yollacalls.com.

Personal data breach

Please note that no security system is perfect, and therefore we cannot guarantee the absolute security of the service or that unauthorized third parties will not gain access to personal data. In case of occurrence of such circumstances (events) we will take all reasonable measures to eliminate these circumstances (events) and their consequences.

If necessary, we will notify you of any violations related to your personal data breach and report such breach to the relevant authority for the supervision of compliance under the law.

Here are some key rules to prevent data theft on personal devices:

• use strong passwords: set strong, unique passwords for all your accounts and devices. Strong password should be at least 12–16 characters long and include a combination of uppercase and lowercase letters, numbers, and special symbols. Avoid using personal information, common words, or predictable patterns. Never reuse the same password across different services; if one account is compromised, others should remain secure. For better protection and convenience, consider using a trusted password manager to store and generate passwords securely;
• keep software updated: regularly update your operating system, antivirus software, and applications to patch security vulnerabilities and protect against potential threats;
• encrypt your data: encrypt sensitive files and folders to make them unreadable without the appropriate decryption key. Most modern operating systems offer built-in encryption features;
• use secure wi-fi networks: avoid connecting to public Wi-Fi networks for sensitive activities. If you must use public Wi-Fi, consider using a virtual private network (VPN) to encrypt your internet traffic;
• be wary of phishing: be cautious of unsolicited emails, messages, or phone calls asking for personal or financial information. Verify the sender’s identity before responding or clicking on any links;
• secure physical access: keep your devices physically secure by using locks or biometric authentication methods. Avoid leaving your devices unattended in public places;
• practice safe browsing habits: avoid visiting suspicious websites or clicking on unfamiliar links. Install ad-blockers and browser security plugins to mitigate potential risks.

Changes to the Privacy notice

We may update this Privacy notice from time to time in response to changing legal, technical or business developments.

However, you can always review the latest version of our Privacy notice and all previous versions on our [website](https://yollacalls.com/) and in the service. Periodically reviewing our website is a good idea to keep up to date on our privacy notices relating to your personal data.

The invalidation of certain provisions of the Privacy notice for any reason does not entail the invalidity of the Privacy notice as a whole and its other provisions.

Supervisory authority

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that our processing of your personal data violates applicable data protection laws. You may contact the supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.

Here is the contact information of the authority that controls the use of your personal data by us:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

Väike-Ameerika 19, 10129 Tallinn

Tel. +372 6274 135

Fax +372 6274 137

e-mail: info@aki.ee

Website: https://www.aki.ee/en\

You can find the complete list of supervisory authorities at https://www.edpb.europa.eu/about-edpb/our-members_en#fr

List of processing

* Contract: Processing is required to fulfill a contract with You or to take steps at your request prior to entering one.

List of Sub-processors