PRIVACY POLICY

Your privacy in a nutshell

Last updated: 16 October 2026

We collect only what we need to run your Swytch numbers, bill you, keep the network safe and meet our legal duties as a UK telecoms provider. We never sell your data.

• What we collect: your account and contact details, payment details, how you use our services, and the technical and call/SMS records needed to connect your calls and texts.
• What we don't do: we don't listen to your calls. We only process SMS content where it's technically needed to deliver the message or where the law requires it.
• Who sees it: the providers who help us run Swytch (cloud hosting, payments, telecom networks, support), each bound by data protection obligations.
• Your rights: you can ask to see, correct, export or delete your data, or object to how we use it, by emailing privacy@swytch.com.
• Business customers: if your company uses Swytch, our Data Processing Agreement explains how we process your users' data on your behalf.

The full policy follows below, including our Cookie Policy.

1. Who we are and how to contact us

Swytch Mobile Ltd ("Swytch", "we", "us") provides UK mobile and landline numbers that run on your existing phone, plus the apps and online dashboard used to manage them.

• Company number: 08965691, registered in England and Wales
• Registered office: 47 Dean Street, London, W1D 5BE, United Kingdom
• ICO registration number: ZA915342
• Privacy contact: privacy@swytch.com

We have not appointed a Data Protection Officer, as UK GDPR does not require one for our activities. All privacy questions and requests go to privacy@swytch.com. We acknowledge valid requests within 5 business days and respond in full within one month.

2. Our role: controller or processor

Whether we act as controller or processor depends on who signed up.

• Individuals and sole traders: we are the controller of your personal data and this policy applies in full.
• Business customers: your company is the controller of its employees' and authorised users' data, and we process it on its behalf under our Data Processing Agreement. If you are a user on a company account, some requests (such as access to your data) may need to go through your employer.
• Our own purposes: even for business accounts, we act as an independent controller where we need data to operate, secure and bill for the service, prevent fraud and meet our legal and regulatory obligations.

This policy also covers people who contact us, visit our website or interact with our marketing without being customers.

3. What data we collect

We do not access the content of your calls. We do not knowingly collect special category data such as health, religion or ethnicity.

4. How we use your data and our legal bases

Where we rely on legitimate interests, we have checked that our interests are not overridden by your rights. Where we rely on consent, you can withdraw it at any time.

5. Automated processing and fraud prevention

We use automated systems for fraud detection, usage analysis, network routing and processing communications metadata. This can involve profiling usage patterns, for example to spot unusual call volumes or payment risk.

Some of these checks can lead to decisions with a significant effect on you, such as suspending an account or blocking a payment. Where that happens, you have the right to:

• ask for a person to review the decision;
• give your point of view; and
• challenge the decision.

Email privacy@swytch.com to request a review. If you use Swytch through a company account, we will give your employer the information it needs to handle your request.

6. Who we share your data with

We never sell your data or share it with third parties for their own advertising. We share it only with the providers below, each bound by data protection obligations, and only for the purposes described.

We may also share data with:

• law enforcement, regulators and other authorities where the law requires it, including under the Investigatory Powers Act 2016;
• professional advisers (accountants, lawyers, auditors, insurers) under confidentiality;
• a buyer or successor if we sell or merge all or part of our business, who must continue to protect your data under this policy.

An up-to-date list of providers is available from privacy@swytch.com.

7. International transfers

Some of our providers process data outside the UK and European Economic Area, mainly in the United States. When that happens, we protect your data with one of these safeguards:

• UK adequacy regulations or EU adequacy decisions (including the UK-US Data Bridge where the provider is certified);
• the UK International Data Transfer Addendum to the EU Standard Contractual Clauses;
• the EU Standard Contractual Clauses; or
• another transfer mechanism recognised under UK or EU law.

You can ask for details of the safeguard used for a specific provider at privacy@swytch.com.

8. How long we keep your data

We may keep anonymised data, which no longer identifies you, indefinitely for statistics and research.

9. How we protect your data

Our services run on Amazon Web Services, which holds ISO 27001 and SOC 2 certifications. Our main safeguards are:

• encryption of data in transit and at rest, using AWS encryption and key management;
• access limited to authorised staff on a need-to-know basis, reviewed periodically;
• network protection through Cloudflare, firewalls and monitoring of unusual activity;
• regular security patching and periodic penetration testing;
• tested backups and a documented incident response procedure;
• confidentiality obligations for all staff and contractors with access to personal data.

If a personal data breach is likely to put your rights at risk, we will notify the ICO within the deadlines required by law and tell you without undue delay where the law requires it. Please keep your own password safe and don't share it.

10. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use your data;
• object to processing based on legitimate interests, and to direct marketing at any time;
• receive your data in a portable format or have it sent to another provider;
• withdraw consent where we rely on it;
• not be subject to solely automated decisions with significant effects (see section 5).

To use any of these rights, email privacy@swytch.com. Requests are free. We may ask you to confirm your identity, and may refuse or charge a reasonable fee for requests that are clearly unfounded or excessive. We reply within one month, extendable by two months for complex requests. Some rights are limited by law, for example where we must keep billing or communications records.

If you're unhappy with how we've handled your data, please contact us first. You can also complain to the Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live or work.

11. Cookie Policy

Cookies are small files stored on your device. Strictly necessary cookies keep the site and dashboard working and don't need consent. All other cookies are off until you accept them in our cookie banner, managed by CookieScript. To change your choice later, clear the cookies for swytch.com in your browser settings and the cookie banner will appear again on your next visit. You can also block or delete cookies through your browser at any time.

Our support chat widget (Help Scout) also stores one setting in your browser's local storage, which is not a cookie, to remember whether its welcome animation has been shown.

Our mobile apps use Firebase Analytics and Crashlytics to measure usage and diagnose crashes. You can limit ad tracking in your phone's settings.

12. Marketing

If you're a customer, we may email you about similar Swytch services and offers. If you're not a customer, we only send marketing with your consent. Every marketing message has an unsubscribe link, or you can email privacy@swytch.com. Opting out doesn't affect service messages about your account.

13. Children

Our services are not intended for anyone under 18, and we don't knowingly collect their data. If you believe a child has given us personal data, contact privacy@swytch.com and we'll delete it.

14. Changes to this policy

We may update this policy when our services or the law change. We'll post the new version here with its date, and tell customers by email about significant changes.