TINKLE TELECOM LTD

PRIVACY AND COOKIE POLICY

Last updated: 8 September 2026
Version 3.0

Your privacy matters

Tinkle Telecom Ltd is committed to protecting personal information and using it responsibly.

This Privacy & Cookies Policy explains how Tinkle collects, uses, shares, stores and protects personal information when you:

• visit our websites;

• create or use a Tinkle account;

• use our communications, telephony, software, AI or related Services;

• contact our sales, support or other teams;

• interact with us as a customer, prospective customer, supplier or business contact; or

• otherwise interact with Tinkle.

It also explains your rights under UK data protection law.

This Policy is a privacy notice. It does not form part of any contract and does not create contractual rights.

1. Who we are

Tinkle Telecom Ltd is a company registered in England and Wales under company number 11117564, with its registered office at:

Carrwood Park
Selby Road
Swillington Common
Leeds
West Yorkshire
England
LS15 4LG

In this Policy, “Tinkle”, “we”, “us” and “our” mean Tinkle Telecom Ltd.

For privacy enquiries or to exercise your data protection rights, contact:

Email: hello@tinkle.co

Please use “Data Protection” or “Privacy” in the subject line where possible.

2. When Tinkle is a Controller and when Tinkle is a Processor

Data protection law distinguishes between a Controller, which decides why and how Personal Data is processed, and a Processor, which processes Personal Data on behalf of a Controller.

Tinkle can act in both capacities depending on the processing activity.

2.1 When Tinkle acts as Controller

Tinkle will normally act as Controller where we determine why Personal Data is processed.

This includes activities such as:

• administering customer and prospective customer relationships;

• managing Tinkle accounts;

• billing and payment administration;

• fraud prevention;

• credit control;

• network and information security;

• managing our websites;

• sales and marketing;

• providing customer support;

• maintaining our business records;

• telecommunications administration;

• numbering and call routing administration;

• emergency-service requirements;

• complying with legal and regulatory obligations; and

• improving and securing our own products, systems and business operations.

This Policy primarily explains those activities.

2.2 When Tinkle acts as Processor

Where a business customer uses Tinkle to process information for its own purposes, the customer will normally determine why that information is being processed.

For example, a customer may use Tinkle to:

• store contacts;

• make and receive calls;

• record calls;

• store voicemail;

• send or receive messages;

• generate call transcripts;

• generate AI summaries;

• analyse conversations;

• connect Tinkle with its CRM or other business applications; or

• store other Customer Content.

In those circumstances, the Customer will normally be the Controller and Tinkle will normally act as its Processor.

Our processing in that capacity is governed by our Terms of Service, applicable Order and data processing provisions.

If you are an employee, customer, caller or other individual whose Personal Data has been processed through Tinkle by one of our customers, you should normally contact that customer first about your Personal Data.

3. The Personal Data we collect

The information we process depends on your relationship with Tinkle and the Services being used.

3.1 Identity and contact information

This may include:

• name;

• business name;

• job title;

• telephone number;

• email address;

• postal address;

• username; and

• other contact information.

3.2 Account and User information

This may include:

• account identifiers;

• User IDs;

• account permissions and roles;

• authentication information;

• account configuration;

• Services assigned to a User;

• telephone Numbers;

• service addresses;

• preferences; and

• account activity.

We do not need to know your password in readable form in order to provide the Service.

3.3 Business information

This may include:

• company name;

• company number;

• organisation size;

• industry;

• business address;

• purchasing information;

• contractual contacts;

• authorised administrators; and

• information relating to Orders, quotations and Services.

3.4 Billing and payment information

This may include:

• billing name and address;

• invoice information;

• payment status;

• payment method information;

• transaction history;

• Direct Debit information;

• limited payment-card information; and

• information required for credit control or fraud prevention.

Payment information may be processed on our behalf by authorised payment providers.

3.5 Telecommunications and Service information

When Tinkle Services are used, we may process information including:

• calling and called Numbers;

• call direction;

• call date and time;

• call duration;

• call routing information;

• extension or User information;

• call status;

• device information;

• voicemail information;

• messaging metadata;

• number-porting information;

• telephone-number allocation information;

• usage information;

• Service configuration; and

• other communications metadata required to provide the Service.

This information is sometimes referred to as communications data, traffic data, usage data or call-detail records.

3.6 Call recordings, voicemail and communications content

Depending on the Services and features enabled by the Customer, Tinkle may process:

• call recordings;

• voicemail messages;

• message content;

• conversation transcripts;

• call notes;

• AI-generated summaries;

• sentiment or conversation analysis; and

• other content transmitted through or stored using the Service.

Where these features are enabled by a Customer for its own purposes, Tinkle will normally process this information as a Processor on behalf of that Customer.

3.7 Emergency calling information

Where applicable, we may process:

• User telephone Numbers;

• registered service addresses;

• location information supplied by the Customer or User; and

• information required to provide access to UK emergency services.

You and your organisation are responsible for keeping registered emergency-location information accurate.

3.8 Technical, device and security information

This may include:

• IP address;

• device type;

• browser type;

• operating system;

• application version;

• device identifiers;

• login records;

• authentication events;

• security logs;

• network information;

• diagnostic information;

• fault information;

• crash information; and

• suspected fraudulent or malicious activity.

3.9 Support information

When you contact us, we may process:

• your contact details;

• support ticket information;

• emails;

• chat messages;

• telephone conversations;

• fault examples;

• screenshots;

• diagnostic data; and

• other information you provide while seeking support.

Where necessary to resolve a support issue, authorised Tinkle personnel may access relevant Customer Content with appropriate authority.

3.10 Website information

When you visit a Tinkle website, we may process:

• IP address;

• browser and device information;

• pages viewed;

• approximate location derived from IP address;

• website interactions;

• referral information;

• marketing attribution information; and

• cookie or similar technology identifiers.

3.11 Sales and marketing information

This may include:

• business contact details;

• enquiries;

• products or Services of interest;

• marketing preferences;

• event attendance;

• responses to campaigns;

• previous communications with Tinkle; and

• information available from lawful public or commercial business sources.

3.12 Integration information

Where you connect Tinkle to another service, such as a CRM, Microsoft product or other third-party application, we may process information needed to establish and operate that connection.

This may include:

• account identifiers;

• authentication tokens;

• contact information;

• CRM records;

• call information;

• configuration information; and

• information passed between Tinkle and the connected application.

The precise data processed depends on the integration you enable.

4. How we obtain Personal Data

We may obtain Personal Data:

• directly from you;

• from the business or organisation you work for;

• from another authorised User or account administrator;

• automatically when you use the Service;

• from telecommunications carriers;

• from a connected third-party application;

• from payment providers;

• from suppliers assisting us in providing the Service;

• from business partners or resellers;

• from public business information;

• from lawful business information providers;

• from fraud-prevention or security services;

• from regulatory or public authorities; or

• from another person communicating with a Tinkle customer.

Where we obtain your Personal Data indirectly and Tinkle acts as Controller, we will provide appropriate privacy information where required by law.

5. Why we use Personal Data and our lawful bases

UK data protection law requires us to have a lawful basis for processing Personal Data where Tinkle acts as Controller.

The appropriate lawful basis depends on the particular processing activity.

5.1 Providing Tinkle Services

We use Personal Data to:

• create and administer accounts;

• activate Services;

• allocate Users and Numbers;

• route communications;

• provide software and applications;

• administer subscriptions;

• process usage;

• manage Orders;

• deliver support; and

• otherwise provide the Services you have requested.

We rely on:

Contract where processing is necessary to enter into or perform a contract with an individual.

Legitimate interests where we need to administer and provide business Services to employees and representatives of corporate customers who are not personally party to the contract.

Our legitimate interest is operating and providing our business communications Services.

5.2 Billing and payment

We process information to:

• issue invoices;

• collect payments;

• administer subscriptions;

• manage payment failures;

• reconcile transactions;

• recover debts; and

• maintain accounting records.

We may rely on:

• performance of a contract;

• compliance with legal obligations; and

• our legitimate interests in receiving payment and operating our business.

5.3 Customer support

We process information to:

• answer enquiries;

• investigate faults;

• diagnose technical issues;

• resolve Service problems; and

• maintain records of customer support.

We rely on contract and our legitimate interests in supporting our customers and maintaining reliable Services.

5.4 Security and fraud prevention

We process information to:

• authenticate Users;

• protect accounts;

• detect unusual activity;

• investigate suspected fraud;

• prevent telecommunications fraud or toll fraud;

• protect our Network;

• investigate cyber incidents;

• prevent abuse; and

• maintain the integrity of our systems.

We rely primarily on our legitimate interests in protecting Tinkle, our customers, Users, suppliers and Network.

We may also process information where necessary to comply with legal or regulatory obligations.

5.5 Telecommunications and regulatory compliance

We may process Personal Data where necessary to:

• comply with Ofcom requirements;

• administer telephone Numbers;

• facilitate number porting;

• maintain network and service records;

• respond to lawful regulatory requests;

• comply with telecommunications legislation;

• meet lawful-access obligations; and

• meet other regulatory requirements applicable to communications providers.

Our lawful basis will normally be compliance with a legal obligation, together with legitimate interests where appropriate.

5.6 Emergency calls

We process relevant Personal Data to facilitate access to emergency services and provide available caller and location information where required.

This processing is principally necessary to comply with our legal and regulatory obligations.

5.7 Improving and developing the Service

We may use appropriate Service, performance, diagnostic and usage information to:

• understand how our Services perform;

• identify faults;

• improve User experience;

• develop features;

• analyse capacity;

• improve reliability; and

• plan our products.

Where possible, we use aggregated or de-identified information for these purposes.

Where Personal Data is required, we rely on our legitimate interests in maintaining and improving our products and Services, balanced against the rights and interests of individuals.

Customer Content will not be used for unrelated purposes merely because it is stored or transmitted using Tinkle.

5.8 Sales and business development

We may process business contact information to:

• respond to enquiries;

• prepare quotations;

• follow up requested demonstrations;

• identify potential business customers;

• maintain business relationships; and

• communicate about relevant Tinkle products and Services.

We rely on our legitimate interests where appropriate.

Where consent is required by the Privacy and Electronic Communications Regulations or other Applicable Law, we will rely on consent.

5.9 Direct marketing

We may send relevant marketing communications to business contacts where permitted by law.

Depending on the recipient and type of communication, we may rely on:

• consent; or

• our legitimate interests in marketing Tinkle’s products and Services.

Where PECR requires consent, we will obtain the necessary consent.

You can opt out of direct marketing at any time.

We may retain limited suppression information after you opt out so that we can ensure we do not market to you again contrary to your preference.

5.10 Legal claims and business administration

We may process information where necessary to:

• obtain legal advice;

• establish, exercise or defend legal claims;

• manage insurance;

• conduct audits;

• manage corporate transactions;

• protect our contractual rights; or

• otherwise administer Tinkle.

We rely on our legitimate interests and, where applicable, legal obligations.

6. Customer-controlled communications, recordings and other content

Tinkle customers control how their Users communicate using the Service and which optional features they enable.

This means a Customer may decide to:

• record calls;

• store voicemail;

• monitor calls;

• use listen, whisper or barge functionality;

• create transcripts;

• generate AI summaries;

• analyse conversations;

• store contact information; or

• integrate communications with another system.

When Tinkle processes Personal Data solely to provide these functions at the Customer’s direction, the Customer is normally responsible for deciding the appropriate lawful basis and complying with transparency and other data protection obligations.

Customers are responsible for ensuring that they:

• have an appropriate lawful basis for processing;

• provide required privacy information;

• notify callers, employees or other individuals where required;

• comply with applicable call-recording and monitoring rules;

• comply with marketing rules;

• determine appropriate retention requirements; and

• use Tinkle’s features lawfully.

If you are concerned about how a Tinkle Customer has recorded or otherwise processed your communications, you should normally contact that Customer first.

7. AI, transcription and automated features

Tinkle may provide features using artificial intelligence, machine learning or other automated technologies.

Depending on the Service enabled, these may include:

• speech-to-text transcription;

• call summaries;

• sentiment analysis;

• conversation classification;

• suggested actions;

• information extraction;

• automated workflows; and

• other assistance based on communications content.

Where a Customer enables these features, relevant Customer Content may be processed by Tinkle and authorised technology providers to generate the requested output.

Where Tinkle processes this information solely on behalf of the Customer, Tinkle acts as Processor and the Customer remains responsible for determining whether and how the feature should be used.

AI-generated output may be inaccurate or incomplete and should not automatically be treated as fact.

Unless we specifically tell you otherwise in relation to a particular Service, Tinkle does not use Personal Data as Controller to make solely automated decisions about individuals which produce legal or similarly significant effects.

If this changes, we will provide the information and safeguards required by Applicable Law.

8. Special Category and sensitive information

Tinkle does not generally require Customers to provide sensitive Personal Data in order to establish a normal business communications account.

However, communications using Tinkle may contain information which is sensitive or falls within the UK GDPR definition of Special Category Personal Data, for example information relating to:

• health;

• racial or ethnic origin;

• religion;

• political opinions;

• trade union membership;

• genetics;

• biometrics; or

• sex life or sexual orientation.

Customer-controlled communications may also contain criminal offence information or other confidential information.

Where Tinkle processes such information purely because it forms part of Customer Content, Tinkle will normally act as Processor and process it in accordance with the Customer’s instructions.

Customers must ensure they have an appropriate lawful basis and, where required, an appropriate additional condition before using Tinkle to process such information.

9. Who we share Personal Data with

We do not sell Personal Data to advertisers.

We may share Personal Data with appropriate third parties where necessary to operate Tinkle, provide our Services or comply with our obligations.

These recipients may include:

9.1 Telecommunications providers

We may share information with:

• telecommunications carriers;

• network operators;

• number providers;

• porting providers;

• connectivity providers; and

• other communications suppliers

where required to route communications or provide telecommunications Services.

9.2 Cloud and technology providers

We may use authorised providers for:

• cloud hosting;

• data storage;

• infrastructure;

• software;

• email;

• messaging;

• monitoring;

• security;

• analytics;

• support; and

• other technology required to operate Tinkle.

9.3 AI and transcription providers

Where applicable AI, transcription or automated features are enabled, appropriate information may be provided to authorised technology suppliers necessary to deliver that functionality.

These suppliers are subject to appropriate contractual and data protection requirements.

9.4 Payment and financial providers

We may share relevant information with:

• payment processors;

• banks;

• Direct Debit providers;

• accountants;

• credit providers; and

• debt recovery providers

where necessary to administer payments and financial obligations.

9.5 Customer-selected integrations

If a Customer enables an integration between Tinkle and another platform, information may be exchanged with that platform at the Customer’s direction.

The third party’s own privacy terms may also apply to its processing.

9.6 Professional advisers

We may provide appropriate information to:

• lawyers;

• accountants;

• auditors;

• insurers;

• consultants; and

• other professional advisers

where reasonably necessary.

9.7 Authorities and emergency organisations

We may disclose information to:

• emergency services;

• Ofcom;

• the Information Commissioner’s Office;

• law enforcement;

• courts;

• government authorities;

• regulators; or

• other competent authorities

where required or permitted by law.

9.8 Corporate transactions

If Tinkle or part of its business is involved in a sale, acquisition, merger, financing, restructuring or similar transaction, relevant information may be disclosed to appropriate parties and advisers subject to suitable confidentiality arrangements.

10. Subprocessors

Where Tinkle acts as Processor for a Customer, Tinkle may appoint authorised subprocessors to assist in providing the Service.

Subprocessors may include providers of:

• hosting;

• telecommunications;

• data storage;

• communications infrastructure;

• software;

• support;

• AI;

• transcription;

• security;

• analytics; and

• other technology services.

Tinkle requires subprocessors processing Personal Data on its behalf to be subject to appropriate data protection obligations.

Further contractual provisions relating to subprocessors are contained in Tinkle’s Terms of Service and applicable Orders.

11. International transfers

Tinkle is a UK business, but some of the suppliers, infrastructure, technology and Services used to provide Tinkle may involve processing Personal Data outside the United Kingdom.

Where a transfer of Personal Data is subject to UK international-transfer restrictions, we will use an appropriate lawful transfer mechanism.

Depending on the circumstances, this may include:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• an applicable UK Addendum to approved contractual clauses; or

• another transfer mechanism permitted by UK data protection law.

Where required, we will also consider whether additional safeguards are appropriate.

The location from which a Customer or User chooses to access Tinkle may also affect where information is accessed.

12. How long we keep Personal Data

We do not keep Personal Data indefinitely simply because it may be useful in future.

Retention periods depend on:

• why we collected the information;

• the type of information;

• the Service purchased;

• contractual requirements;

• customer configuration;

• legal and regulatory obligations;

• security requirements;

• the possibility of legal claims; and

• whether the information can instead be anonymised.

12.1 Customer Content

Call recordings, voicemail, call logs, transcripts, messages and other Customer Content are retained according to:

• the applicable Tinkle plan;

• the relevant feature;

• the applicable Order;

• Tinkle’s current Data Retention Policy; and

• Customer configuration where supported.

Different Services may have different retention periods.

Customers are responsible for downloading or exporting information they need to retain beyond the applicable Service retention period.

Deleting a User may permanently delete recordings, messages or other information associated solely with that User.

Customers should export any required information before deleting Users.

12.2 Account information

We generally retain account information for as long as the relevant account or customer relationship remains active and afterwards where reasonably necessary for legal, regulatory, accounting, security or dispute-resolution purposes.

12.3 Contracts, invoices and financial information

Contractual, billing and accounting records may normally be retained for up to six years after the relevant relationship or transaction ends, and longer where required by law or necessary in connection with an actual or anticipated legal claim.

12.4 Support and operational information

Support tickets, correspondence, technical records and diagnostic information are retained for as long as reasonably necessary to:

• provide support;

• maintain Service history;

• investigate recurring issues;

• protect Tinkle’s legal rights; and

• meet regulatory or security requirements.

12.5 Security and fraud information

Security, authentication, fraud and system-log information is retained according to the nature of the risk, operational requirements and applicable legal or regulatory obligations.

12.6 Marketing information

Marketing information is retained while we reasonably believe there remains an appropriate business relationship or legitimate marketing purpose.

If you object or unsubscribe, we may retain limited information on a suppression list so we can respect that preference in future.

12.7 Backups

Information deleted from live systems may remain temporarily within protected backup systems until those backups are overwritten or expire under our normal backup cycle.

Information retained only in backups will not normally be restored or otherwise processed unless necessary for disaster recovery, security or legal purposes.

13. Security

Tinkle uses appropriate technical and organisational measures designed to protect Personal Data against:

• accidental loss;

• unauthorised access;

• misuse;

• alteration;

• destruction; and

• unauthorised disclosure.

Measures may include, as appropriate:

• access controls;

• authentication;

• encryption;

• monitoring;

• network security;

• backup;

• logging;

• staff confidentiality obligations;

• supplier controls; and

• incident-management procedures.

No internet or communications service can guarantee absolute security.

Customers and Users also have responsibilities for security, including protecting credentials, securing devices and networks, configuring Users appropriately and notifying Tinkle promptly of suspected compromise.

14. Data breaches and security incidents

Tinkle maintains processes for responding to actual and suspected security incidents.

Where Tinkle acts as Controller and a Personal Data Breach creates a requirement to notify the Information Commissioner’s Office or affected individuals, we will make the appropriate notification in accordance with Applicable Law.

Where Tinkle acts as Processor for a Customer, we will notify the relevant Customer of a Personal Data Breach without undue delay after becoming aware of it, in accordance with our contractual and legal obligations.

15. Direct marketing

Tinkle primarily markets its Services to businesses.

We may contact appropriate business contacts about Tinkle products, Services, events or information where permitted by Applicable Law.

The rules differ depending on:

• whether the recipient is an individual, sole trader, partnership or corporate body;

• how we obtained the contact information; and

• whether we contact the person by email, telephone, text or another method.

We comply with applicable UK GDPR and Privacy and Electronic Communications Regulations requirements.

Where consent is required, we will seek appropriate consent.

Where consent is not required, we may rely on legitimate interests where it is appropriate to do so.

You can stop receiving direct marketing from Tinkle at any time by:

• using the unsubscribe mechanism in an email;

• telling the person who contacts you; or

• contacting Tinkle using the details in this Policy.

We will not treat an opt-out from marketing as an opt-out from operational messages necessary to administer or provide an existing Service.

16. Cookies and similar technologies

Tinkle websites and applications may use cookies and other storage or access technologies.

These technologies may be used for purposes including:

• operating the website;

• maintaining sessions;

• remembering settings;

• authentication;

• fraud prevention;

• security;

• measuring website performance;

• understanding website usage;

• improving our Services; and

• marketing or attribution where permitted.

16.1 Essential technologies

Some technologies are necessary for a website or online Service to operate, provide requested functionality or maintain security.

Where Applicable Law permits those technologies to be used without consent, we may do so.

16.2 Analytics, functional and marketing technologies

Where consent is required before using a particular cookie or similar technology, we will seek that consent before using it.

You can change or withdraw your choices using the cookie controls made available on our website.

Refusing optional cookies should not prevent you from using essential website functionality, although some optional features may work differently.

16.3 Current cookie information

Details of cookies and similar technologies currently used by Tinkle, including their purposes and durations, should be made available through Tinkle’s cookie preference controls or accompanying cookie information.

Because website technology changes over time, this information may be updated as suppliers and functionality change.

17. Your data protection rights

Depending on the circumstances and the lawful basis being relied upon, UK data protection law may give you rights including:

17.1 Right of access

You may ask for confirmation that we process your Personal Data and request a copy of relevant Personal Data.

17.2 Right to rectification

You may ask us to correct inaccurate Personal Data or complete incomplete information.

17.3 Right to erasure

You may ask us to delete Personal Data in certain circumstances.

This right is not absolute and may not apply where we need to retain information for legal, contractual, regulatory or other lawful reasons.

17.4 Right to restriction

You may ask us to restrict processing in certain circumstances.

17.5 Right to data portability

Where the legal requirements are met, you may have the right to receive certain Personal Data in a structured, commonly used and machine-readable format or ask us to transfer it to another organisation.

17.6 Right to object

You may have the right to object to processing based on legitimate interests.

You have the right to object to the use of your Personal Data for direct marketing at any time.

If you object to direct marketing, we will stop using your Personal Data for that purpose.

17.7 Withdrawal of consent

Where we rely on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing which occurred before consent was withdrawn.

17.8 Automated decisions

Where applicable law gives you rights in relation to significant decisions made solely using automated processing, you may have rights to:

• receive information about the decision;

• make representations;

• request human intervention; and

• challenge the decision.

Unless we tell you otherwise in a feature-specific notice, Tinkle does not currently use Personal Data as Controller to make solely automated decisions producing legal or similarly significant effects.

18. Exercising your rights

To exercise a data protection right relating to information for which Tinkle acts as Controller, contact:

hello@tinkle.co

Please use “Data Protection Request” in the subject line where possible.

We may need to ask for information to confirm your identity before disclosing or changing Personal Data.

We will respond within the time required by Applicable Law.

Some rights are subject to exemptions or limitations, and we will explain where we cannot comply fully with a request.

18.1 Information processed for a Tinkle Customer

If Tinkle holds information solely as Processor for one of our Customers, the Customer is normally responsible for handling your request.

We may therefore direct you to the relevant Customer or pass your request to them where appropriate.

Tinkle will provide reasonable assistance to Customers in responding to valid data protection requests in accordance with our legal and contractual obligations.

19. Data protection complaints

If you have concerns about Tinkle’s use of Personal Data, please contact us first so that we can investigate.

A data protection complaint can be sent to:

hello@tinkle.co

Please use “Data Protection Complaint” in the subject line where possible.

In accordance with UK data protection law, Tinkle will:

• provide an appropriate way for individuals to raise data protection complaints;

• acknowledge receipt of a complaint within 30 days;

• take appropriate steps to investigate the complaint without undue delay;

• keep the complainant appropriately informed; and

• communicate the outcome without undue delay.

You also have the right to complain to the UK’s data protection supervisory authority, the Information Commissioner’s Office (ICO).

We would appreciate the opportunity to address your concerns first, but this does not affect your right to contact the ICO.

20. Children

Tinkle provides business communications Services and does not intentionally market its Services directly to children.

Customer communications transmitted through Tinkle may nevertheless involve children, for example where a Tinkle Customer operates in education, healthcare or another sector interacting with children.

Where Tinkle processes such information solely on behalf of a Customer, the Customer remains responsible for ensuring that its processing is lawful and appropriate.

21. Third-party websites and services

Tinkle websites and Services may contain links to third-party websites or enable integrations with third-party services.

Tinkle is not responsible for the privacy practices of independent third parties acting as Controllers.

You should review the relevant third party’s privacy information before providing Personal Data to it.

22. Business changes

If Tinkle’s ownership or business structure changes, Personal Data may be transferred as part of a:

• sale;

• acquisition;

• merger;

• reorganisation;

• financing;

• insolvency process; or

• transfer of all or part of our business or assets.

Any recipient will be required to handle Personal Data appropriately and in accordance with Applicable Law.

23. Changes to this Policy

We may update this Privacy & Cookies Policy from time to time to reflect:

• changes to our Services;

• new technology;

• changes in suppliers;

• changes to our processing;

• changes in law or regulation; or

• improvements to our privacy practices.

The latest version will be published on the Tinkle website with its updated date and version number.

Where a change materially affects how Tinkle uses Personal Data as Controller, we will take reasonable steps to bring that change to the attention of affected individuals where required by law.

You should review this Policy periodically.

24. Contact Tinkle

For questions about this Policy, data protection requests or data protection complaints, contact:

Tinkle Telecom Ltd

Email: hello@tinkle.co
Subject: Data Protection / Privacy

Registered office:
Carrwood Park
Selby Road
Swillington Common
Leeds
West Yorkshire
England
LS15 4LG

Company number: 11117564

Tinkle Telecom Ltd
Privacy & Cookies Policy
Version 3.0 — 8 September 2026