This is a translation. The French version prevails in case of discrepancy.
Who we are
GetSMS is published by GetSMS, a company incorporated in Morocco whose registered office is at Technopark, Casablanca (“GetSMS”, “we”).
This policy explains how we process personal data through the getsms.tech website, the documentation, the dashboard, the API and the MCP server (the “Service”), in accordance with Law No. 09-08 on the protection of individuals with regard to the processing of personal data and its implementing texts.
GetSMS’s processing operations are subject to the prior formalities with the National Commission for the Control of Personal Data Protection (CNDP) required by law 09-08.
Contact for any question about personal data: privacy@getsms.tech.
Two distinct roles
GetSMS as controller. For the data of our customers and their members (account, company verification, billing, support, security), we decide the purposes and means: we are the controller.
GetSMS as processor. For message data (recipients’ numbers, content of SMS sent and received, statuses), we act on behalf of our customer and on its instructions. The customer is the controller with respect to its recipients: it must inform them, obtain their consent where required and respond to their requests. Our commitments as processor are set out in the Data Processing Agreement.
If you received an SMS sent through GetSMS, please contact the sender first. You can also reply “STOP” to the message, or write to us: we will forward your request to the customer concerned. To report an abusive message, see Report abuse.
Data processed
| Category | Examples | Data subjects |
|---|---|---|
| Account | Name, e-mail, owner’s mobile number, role, preferences, login identifiers | Members of customer organisations |
| Security | IP addresses, login logs, devices, two-factor secret (encrypted), audit log | Members, GetSMS staff |
| Company verification | Trade register extract, ICE, tax identifier, legal representative’s ID document, declared use | Customers’ legal representatives |
| Billing | Company name, address, ICE, payments, invoices, transfer references; never the card number | Customers |
| Support | E-mail exchanges and attachments | Customers, members |
| Messages (processing on behalf) | Recipient number, content, segments, statuses, timestamps, replies received, opt-out (STOP) list | Customers’ recipients |
| Reports | Reporter’s contact details, reported message | Recipients, third parties |
| Website and documentation | Technical connection data needed to display pages | Visitors |
We do not request any sensitive data within the meaning of Law 09-08. Customers undertake not to include such data in their messages without a legal basis.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage the account, provide the Service, route messages and replies | Performance of the contract |
| Verify the customer company’s identity and declared use | Performance of the contract; legitimate interest in fraud prevention; operators’ requirements |
| Invoice and keep accounts | Legal obligation |
| Secure the Service, detect abuse, fraud and phishing, handle reports | Legitimate interest; legal obligations |
| Answer support requests | Performance of the contract |
| Inform customers of changes to the Service and the terms | Performance of the contract; legitimate interest |
| Respond to requests from competent authorities | Legal obligation |
We do not use message content for any purpose other than routing it, fighting abuse and support requested by the customer. We neither sell nor rent any data.
Retention periods
| Data | Period |
|---|---|
| Content of messages sent and received | 12 months after sending or receipt, then deleted; at the latest 90 days after the account is closed. The customer may choose a shorter period. |
| Message technical data (number, status, segments, timestamps) | 24 months after sending, then deleted or anonymised; at the latest 90 days after the account is closed, except data required for accounting |
| Opt-out (STOP) list | As long as the organisation exists, to honour the opt-out |
| Account and members | Term of the contract, then 3 years after the account is closed |
| Company verification file | Term of the contract, then 5 years after the account is closed |
| Login and security logs | 12 months |
| Audit log of sensitive actions | 3 years |
| Invoices, payments, credit ledger | 10 years, in line with accounting obligations (Law No. 9-88) |
| Support exchanges and reports | 3 years after the request is closed |
| Backups | Rotation over 30 days at most; deleted data disappears from backups at the end of this cycle |
When these periods expire, data is deleted or anonymised, unless a legal retention obligation or pending dispute applies.
Recipients of the data
Data is accessible only to those who need it:
- members of the customer organisation, according to their role;
- authorised GetSMS staff (support, compliance, finance, operations), with two-factor authentication; every sensitive access is logged;
- our technical sub-processors, within the limits of their task, listed on the Sub-processors page;
- Moroccan mobile operators, which carry SMS to recipients;
- competent judicial or administrative authorities, on a lawful request.
Transfers outside Morocco
Our servers, databases and backups are hosted in Morocco, in Oracle Cloud’s Casablanca region. Message content and recipients’ numbers do not leave Morocco, apart from their carriage by Moroccan mobile operators.
Some services used to authenticate members and to wake up the fleet phones are located outside Morocco (see Sub-processors). The data concerned is limited: members’ login identifiers (e-mail, name, IP address) and technical message identifiers, with no content or recipient number. In accordance with Articles 43 and 44 of Law 09-08, these transfers are made to countries ensuring an adequate level of protection or, failing that, with the CNDP’s authorisation.
Security
Our measures include:
- encryption in transit (HTTPS), encryption of disks and backups;
- API keys stored hashed and displayed only once;
- mandatory two-factor authentication for owners, admins and GetSMS staff;
- permission checks on every request, according to role;
- an audit log of sensitive actions;
- signed webhooks, so the customer can verify their origin;
- card payments made on the CMI page, without GetSMS seeing the card number;
- no keys, tokens, codes or full phone numbers in technical logs.
In the event of a data breach likely to affect individuals, we take the necessary steps to contain it, inform the customers concerned under the Data Processing Agreement and make the notifications required by law.
Your rights
Under Law 09-08, you have:
- the right to be informed about processing concerning you;
- the right of access to your data;
- the right to rectification, updating or deletion of data that is inaccurate, incomplete or processed without authorisation;
- the right to object, on legitimate grounds, to the processing of your data, and to object free of charge to its use for direct marketing.
To exercise these rights, write to privacy@getsms.tech or to the postal address Technopark, Casablanca, stating your request and, where necessary, information to identify you. We reply within thirty days at most. Where the request concerns messages sent by a GetSMS customer, we forward it to that customer, as controller, and let you know.
If you believe your rights have not been respected, you may refer the matter to the CNDP (www.cndp.ma).
Cookies
The Service uses only cookies and local storage needed for it to work. See the Cookie Policy.
Changes
We may update this policy. The effective date appears at the top of the page. Customers are informed by e-mail of any significant change.