EU/UK Privacy Supplement

Effective June 1, 2026

This EU/UK Privacy Supplement applies when the EU General Data Protection Regulation ("EU GDPR"), UK GDPR, or related national data-protection law applies to MultiTEL's processing. It supplements the Privacy Policy and replaces MultiTEL's May 2018 GDPR Policy. If this Supplement and the Privacy Policy conflict for processing within its scope, this Supplement controls.

1. MultiTEL and applicable law

MultiTEL LLC is a Michigan limited liability company with its principal contact address at 4103 Oak Tree Cir, Rochester, Michigan 48306, United States. MultiTEL's United States operations are subject to applicable U.S. federal and Michigan law. This Supplement separately addresses EU and UK data-protection requirements where they apply; a contractual Michigan governing-law clause does not eliminate mandatory EU or UK privacy rights.

2. Controller and processor roles

MultiTEL generally acts as a controller when it determines why and how personal data is used for its websites, direct Personal/Consumer and Business subscriber accounts, billing, identity and account classification, fraud prevention, network security, legal compliance, service development, and its own customer relationship.

When a Communications Provider/Reseller Customer supplies downstream-subscriber data for provisioning, routing, hosted services, support, or another purpose determined by that Customer, MultiTEL may act as that Customer's processor. MultiTEL remains a controller for processing it independently determines is necessary for security, billing, fraud prevention, regulatory compliance, numbering, emergency services, or enforcement. The applicable service order or data-processing agreement further describes the parties' roles and instructions.

3. Lawful bases

Depending on the processing, MultiTEL relies on one or more of the following lawful bases:

• Contract: to create and administer an account; provision, authenticate, route, support, and bill Services; and respond to service requests;
• Legal obligation: to satisfy communications, emergency-service, tax, accounting, sanctions, lawful-process, consumer-protection, and regulatory duties;
• Legitimate interests: to secure Services, prevent fraud and abuse, maintain networks, enforce agreements, manage business operations, support Customers, and improve Services, balanced against individual rights;
• Consent: where consent is required for an optional integration, marketing activity, device permission, or other processing. Consent may be withdrawn without affecting processing already performed lawfully; and
• Vital interests or public interest: in limited circumstances involving emergency communications, immediate safety, or a legally recognized public-interest task.

Where MultiTEL acts as a processor, the Customer is responsible for identifying its lawful basis and issuing lawful documented instructions.

4. International transfers

MultiTEL is based in the United States, and information may be processed there and in other countries used to provide a communications service. Where EU GDPR restricted-transfer rules apply and no adequacy decision covers the transfer, MultiTEL uses an applicable transfer mechanism, which may include the European Commission's Standard Contractual Clauses, together with a transfer assessment and supplementary safeguards where required. Where UK restricted-transfer rules apply, MultiTEL may use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the required transfer-risk assessment.

The applicable mechanism depends on the parties, destination, processing role, and whether the recipient is already directly subject to the relevant law. Customers may request information about an applicable safeguard by contacting legal@multitel.net.

5. Individual rights

Subject to applicable conditions and exceptions, an individual may request access, correction, erasure, restriction, portability, or information about processing; object to processing based on legitimate interests or direct marketing; withdraw consent; and request safeguards relating to qualifying automated decisions. MultiTEL will respond within the period required by applicable law, ordinarily one month after receiving a verified request.

MultiTEL may request information necessary to verify identity, authority, account relationship, and the scope of a request. When MultiTEL acts only as a processor, it may refer the request to the Communications Provider/Reseller or other Customer that controls the downstream relationship and will provide reasonable assistance as required by contract and law.

Disagreement with a policy is not limited to leaving the Service. Individuals may exercise applicable statutory rights, contact MultiTEL, object or withdraw consent where available, seek restriction or deletion where the law provides it, and lodge a complaint with a competent supervisory authority. Ending an optional Service remains an additional choice but is not the exclusive remedy.

6. Complaints

Send privacy requests or complaints to legal@multitel.net or call +40 750 199 989. Please describe the relevant account, Service, processing, and requested resolution. MultiTEL may authenticate the request before disclosing or changing information.

EU individuals may complain to a supervisory authority in the Member State of habitual residence, place of work, or alleged infringement. Contact information for EU authorities is available from the European Data Protection Board. The Romanian authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro, anspdcp@dataprotection.ro.

UK individuals may complain to the Information Commissioner's Office (ICO) through ico.org.uk/make-a-complaint. Contacting MultiTEL first may allow faster resolution but does not waive the right to contact a supervisory authority.

7. EU representative

Where EU GDPR Article 27 applies, MultiTEL's designated representative in the European Union is:

Victor Paduraru - MultiTEL EU Representative
Blvd. Elisabeta 16
Constanta, Romania
Telephone: +40 750 199 989
Email: legal@multitel.net

The representative may be contacted by individuals and supervisory authorities about processing subject to EU GDPR. The designation must be maintained in writing and does not reduce MultiTEL's own responsibility or liability.

8. UK representative

The Romanian EU representative is not a UK representative. MultiTEL does not currently list a separately appointed representative established in the United Kingdom. Until that appointment is completed and published, UK privacy requests and supervisory-authority inquiries should be sent directly to legal@multitel.net or +40 750 199 989. This direct contact does not replace a UK representative where UK GDPR Article 27 requires one and does not limit the right to complain to the ICO.

9. Contact

MultiTEL LLC
4103 Oak Tree Cir
Rochester, Michigan 48306, United States
Email: legal@multitel.net
Telephone: +40 750 199 989