Privacy Policy for CM App and CM Mobile App

The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:

• CNT AG
• Ludwig-Erhard-Allee 20
• 76131 Karlsruhe
• Germany

info@cnt.com

If you have any questions about data protection or wish to exercise your rights under the GDPR, you can contact our Data Protection Officer at any time:

• Rechtsanwalt Mathias Link
• CNT AG
• Ludwig-Erhard-Allee 20
• 76131 Karlsruhe
• Germany

dsb@cnt.com

The apps can only be used within an existing contractual relationship for the use of our communications services, which may exist directly with us or through one of our partners. Public registration or use without such a contractual relationship is not provided for. User accounts are created, managed, and removed by the respective responsible party; we do not create accounts on our own initiative.

The functions available are determined by the respective customer through the services ordered and the settings they select. The nature, scope, purpose, retention periods, and instructions are agreed separately, in particular in the contract covering the services ordered and in a data processing agreement in accordance with Article 28 GDPR. This Privacy Policy does not replace those agreements. The allocation of data protection roles follows from the respective processing activity, not from the agreement alone.

For questions about processing we carry out for our own purposes, we are your point of contact. For processing we carry out on behalf of a customer, please contact your employer or the party that provided you with access. We forward any requests we cannot answer ourselves.

Depending on the functions ordered and enabled for your access, the following may be processed:

• User and login data as well as the assignment to the respective customer
• Business contact details and phone numbers
• Device and connection data, IP addresses, and timestamps
• Technical log data for provision, security, and error analysis
• Usage and presence information
• Content transmitted or stored through the apps, in particular contacts, chat messages, voicemails, call content, and files

This processing serves authentication, the technical provision, administration, and security of the communications services, the transmission and synchronization of communications and settings, error analysis, prevention of misuse, and the provision of support services.

Source of the Data

We do not collect your user and login data, your business contact details, your phone number, or the assignment to the respective customer from you directly. This information comes from the customer who provided you with access, usually your employer. The remaining data arises when you use the apps, for example through your entries, through the communications you conduct, or technically through the operation of the services.

The following applies to data we process for our own purposes:

• User and login data and the assignment to the customer are deleted once the customer has removed your access, provided no statutory retention obligations apply.
• Technical log and diagnostic data is deleted as soon as it is no longer required for the respective purpose. Data relating to a specific fault or security incident is retained until that incident has been conclusively resolved.
• Data we process to provide support services is deleted once the respective request has been resolved, unless it is still required for documentation purposes or under statutory retention obligations.

For content transmitted or stored through the apps, and for usage and presence information, the respective customer determines the retention period through the services ordered and the settings they select. In this respect we process the data on their instructions. For the periods that apply to you, please contact the party that provided you with access.

Data stored locally on your device is covered separately; see Section 8.

The apps access the following functions of your device, in each case only within the permissions you have granted and only to the extent required for the function being used:

• Microphone – for voice and video calls and conferences
• Camera – for video calls and conferences
• Notifications – for alerts about incoming calls and messages
• Contacts – to display names for phone numbers and to allow dialing from your address book
• Local files – to send, receive, and store files

You can change the permissions you have granted in your device settings. Individual functions will then be unavailable or only partially available.

The apps do not access location data on your device and do not determine your location.

Notifications are delivered through the services of the respective operating system providers, the Apple Push Notification service (APNs) from Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA, and Firebase Cloud Messaging (FCM) from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. A device identifier (push token) is transmitted, together with the information required to display the respective notification. For incoming calls, this includes the caller’s phone number and, where available, the associated name. The information transmitted is limited to what is required for delivery and display.

Both providers are based in the United States, so this transmission is a transfer to a third country. It takes place only under the conditions set out in Articles 44 et seq. GDPR, in particular on the basis of an adequacy decision of the European Commission or the standard contractual clauses approved by it. You can request a copy of the applicable safeguards using the contact details given in Section 2.

In your device settings, you can determine whether and how notifications from the apps are displayed. Incoming calls are signaled to you regardless of these settings for as long as the apps are set up for use; otherwise, reachability could not be ensured. If you do not want this, please sign out of the apps or remove them from your device.

The apps also store data locally on your device, such as cached content, settings, and downloaded files. Deletion on the server side generally does not cover this local data; this applies in particular to exports, operating system backups, and copies you have saved elsewhere. Local data should be removed before passing on the device or when leaving the company. The functions provided for this purpose are described in the apps’ documentation.

Depending on the functions used, the following recipients or categories of recipients receive personal data:

• the customer who provided you with access, including the administrators they have designated
• sales partners through whom the contractual relationship exists, where they perform administrative or support tasks
• your communication partners, where you transmit content to them
• the providers of push notification services named in Section 7
• processors we engage to operate the platforms, bound in accordance with Article 28 GDPR
• authorities, courts, and other public bodies, where we are legally obligated or entitled to disclose data

Data is not shared for advertising purposes or with data brokers.

• We do not place advertising in the apps.
• We do not track your behavior across other providers’ apps or websites.
• We do not share data with third parties for advertising purposes and we do not sell it.
• We do not integrate any third-party analytics or crash reporting services into the apps.
• We do not use content or the results derived from it to train or generally improve our own or third-party artificial intelligence models. This restriction also applies to the processors we engage.

The central operation of the platforms and the server-side storage of the data processed, including backup copies, take place exclusively in data centers within the European Union. This also applies to the processors engaged for this purpose.

This does not cover the delivery of push notifications through the services named in Section 7, your own device, or transmissions that you initiate yourself to communication partners or to separately integrated third-party services.

Where a contract for the use of the services exists directly between you and us, processing necessary for its performance is carried out on the basis of Article 6(1)(b) GDPR.

If you use the apps as an employee of one of our customers, the contract is not with you. Where we process data for our own purposes in this case, the processing is based on Article 6(1)(f) GDPR; our legitimate interest lies in providing the services as agreed and in their secure and uninterrupted operation. Where we are legally obligated to process data, the processing is based on Article 6(1)(c) GDPR. Where individual functions require consent, the processing is based on Article 6(1)(a) GDPR.

Where processing is carried out on behalf of a controller, that controller determines the legal basis for its processing.

Where you use telecommunications services through the apps, the information on confidentiality of communications, traffic data, and requests from authorities set out in our Privacy Policy applies in addition: www.cnt.com/en/privacy/

Under the GDPR, you have various rights vis-à-vis the respective controller, in particular the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and objection (Article 21), as well as the right to withdraw consent at any time (Article 7(3)). Withdrawal takes effect for the future; the lawfulness of processing carried out before the withdrawal remains unaffected. A detailed description can be found in our Privacy Policy at www.cnt.com/en/privacy/

Where we carry out processing for our own purposes, please address your request to the contact details given in Section 2. Where we process data on behalf of a controller, please contact that controller.

Notice of Your Right to Object under Article 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(f) GDPR. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves to establish, exercise, or defend legal claims.

If you believe that we are unlawfully processing your data, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is named in our Privacy Policy.

We reserve the right to update this Privacy Policy to reflect changes in legal requirements or new functions in the apps.

Effective date of this Privacy Policy: October 26, 2026