terms and conditions

Privacy Policy

Wholesale

1. Scope

  • 1.1This section explains how Plan Communications Limited (“Plan”, “we”, “us”) processes personal data when we provide connectivity and platform services under our Wholesale model to business partners (“Wholesale Partners”) who then supply services to their own customers and end users.
  • 1.2
    It applies to personal data about:
    • (a)a Wholesale Partner’s personnel and contacts; and
    • (b)that Wholesale Partner’s customers and end users provisioned on Plan’s network or platforms (including my.plan).

It should be read with the rest of this Privacy Policy and our Data Processing terms applicable to Wholesale.

2. Roles and how we decide them

  • 2.1For End Customer Data (i.e., data about a Wholesale Partner’s customers and end users), the Wholesale Partner is the controller and Plan is the processor. We process End Customer Data only on the Wholesale Partner’s documented instructions to deliver the contracted services (for example, provisioning, platform access, usage presentation, billing data publication, and required roaming notifications).
  • 2.2We may also provide outputs (for example, rated CDRs/billing data) for the Wholesale Partner’s billing and reconciliation. Where the contract specifies that certain outputs are provided on a controller-to-controller basis, that sharing follows the contract terms.
  • 2.3For personal data about the Wholesale Partner’s own staff and contacts (e.g., account admins using my.plan (Reseller)), Plan acts as an independent controller to run our business (account administration, fraud/security, compliance, finance).
  • 2.4If a specific activity requires joint determination with a Wholesale Partner, we will document the essence of any joint controller arrangement.

3. What we collect

  • 3.1Identity and contact data (Partner personnel and, where provided under instructions, customer/end-user identifiers).
  • 3.2Service and device data: MSISDN, IMSI, ICCID, IMEI, SIM/eSIM profile identifiers, device type, IP addresses, and network/cell identifiers.
  • 3.3Usage data including call/SMS/data records and metadata (dates/times, durations, volumes, destinations, roaming zones); platform activity and audit logs; and rated usage outputs as configured.
  • 3.4Account and commercial data including orders, tickets, tariffs, bolt-ons, spend caps, configuration settings, and service notes.
  • 3.5Security and abuse signals including authentication and event logs, fraud/misuse indicators, and gateway/AIT flags.
  • 3.6Cookies and online identifiers for my.plan and related portals (see Cookie Policy).

4. Where we get it

  • 4.1From Wholesale Partners (provisioning files, API calls, portal entries).
  • 4.2From end-user devices and our network/platforms as services are used.
  • 4.3From upstream carriers/roaming partners and other service providers needed to deliver the services.
  • 4.4From fraud-prevention/security systems and from lawful requests where required.

5. Why we use it (purposes) and legal bases

  • 5.1We use personal data to provide and operate the services for Wholesale Partners, including provisioning, routing, interconnect, roaming, support and access to portals.
  • 5.2We use personal data to generate and publish usage and rated outputs (for example, CDR extracts and rated usage files) so that Wholesale Partners can administer their services and handle their own downstream invoicing and reconciliations. We do not bill Customers and we do not process customer payments.
  • 5.3We use personal data to administer our relationship with Wholesale Partners, including account setup, user management for the platforms, service communications and operational reporting to the Partner.
  • 5.4We use personal data to protect the security and integrity of the services, including preventing and investigating fraud, misuse and artificially inflated traffic, managing access controls and audit logs, and responding to incidents.
  • 5.5We use personal data to maintain and improve the services and to produce operational analytics, using aggregated or de-identified information where feasible.
  • 5.6We use personal data to meet legal and regulatory requirements, including sending required roaming notifications and responding to lawful requests from competent authorities.

6. Who we share data with

  • 6.1We share personal data with upstream and downstream carriers and roaming partners to deliver connectivity and to settle interconnect and roaming traffic.
  • 6.2We share personal data with technology and platform suppliers engaged by Plan under contract, including rating and provisioning systems and other providers who host or support our services.
  • 6.3We share personal data with Wholesale Partners, acting as controller for the customers and end users they manage, including usage data, rated outputs and supporting reports needed for administration and support.
  • 6.4We share personal data with our professional advisers and auditors who support our business.
  • 6.5We share personal data with competent authorities and regulators where required by law.

7. International transfers

  • 7.1If personal data is transferred outside the UK/EEA, we use appropriate safeguards (for example, the UK International Data Transfer Agreement or adequacy decisions) and assess local laws and practices as required.

8. Retention

  • 8.1We keep personal data only for as long as needed for the purposes described in this section, including to meet legal, tax, accounting and telecoms requirements and to resolve disputes. Some usage data, rated outputs and portal exports are available for limited windows; Wholesale Partners should download and retain any copies needed for their own records.

9. Security

  • 9.1We use appropriate technical and organisational measures to protect personal data, including role-based access controls, encryption where appropriate, network and application monitoring, and regular testing. my.plan and related portals use enforced role-based access control and audit logging.

10. Your rights and how to exercise them

  • 10.1Where Plan acts as controller (for example, for Partner personnel data), individuals can exercise their UK GDPR rights by contacting us via the “Contact us” section of this Privacy Policy.
  • 10.2Where Plan acts as processor for a Wholesale Partner (End Customer Data), requests should be sent to that Wholesale Partner as the controller. We will support the Wholesale Partner in responding, in line with our contract.

11. Partner responsibilities

  • 11.1Wholesale Partners must provide a transparent privacy notice to their customers and end users, identify Plan’s role(s) and the lawful bases for sharing personal data with Plan, and obtain any permissions required by law.
  • 11.2Wholesale Partners manage user access and permissions (including any my.plan white-label enablement), configure and enforce spend caps, and must keep configuration, zone and tariff data accurate for messaging and controls.
  • 11.3Wholesale Partners remain responsible for their downstream billing to customers and for ensuring that any third-party billing provider they engage meets data-protection requirements.

12. Cookies and portals

  • 12.1See our Cookie Policy for my.plan and related portals. Where marketing cookies are disabled in Wholesale deployments, essential cookies for login, security and preferences still apply. my.plan (white-label) exposes usage views by default and does not expose billing views unless explicitly enabled.

13. Contact, complaints and updates

  • 13.1Contact details for our Data Protection Officer and how to complain to the UK Information Commissioner’s Office are set out in the “Contact us” and “Your rights” sections of this Privacy Policy.
  • 13.2We may update this Wholesale section from time to time; material changes will be communicated through our usual channels and reflected in the version history.