Data Processing Agreement

This is a translation. The French version prevails in case of discrepancy.

Purpose and scope

This agreement forms part of the Terms of Service. It applies as soon as a customer uses the Service to send or receive SMS. It sets out the conditions under which GetSMS (the “Processor”) processes personal data on behalf of the customer (the “Controller”), in accordance with Law No. 09-08, in particular its Articles 23 and 24 on security of processing and use of a processor.

In case of conflict, this agreement prevails over the Terms as regards personal data protection.

Description of the processing

Customer obligations

The customer, as controller:

• ensures its processing is lawful, including completing its own CNDP formalities where required;
• informs its recipients and obtains their consent where required, in accordance with the Acceptable Use Policy;
• only includes sensitive data in its messages if it has a legal basis;
• responds to its recipients’ requests regarding their rights;
• gives its instructions through its use of the Service (API, dashboard, settings) or in writing.

Instructions

GetSMS processes message data only on the customer’s documented instructions. Use of the Service, the settings chosen (for example the retention period for content) and this agreement constitute those instructions.

GetSMS may nevertheless process this data where required by law, in particular on a request from a competent authority; it informs the customer unless the law prohibits it. If an instruction appears unlawful, it informs the customer and may suspend its execution.

GetSMS does not use message data for its own purposes, except for the security of the Service and fighting abuse (automated filtering, handling reports, aggregated non-identifying statistics).

Confidentiality

GetSMS ensures that persons authorised to process the data are bound by confidentiality. Staff access to message content is limited to support requested by the customer, compliance and security; it requires two-factor authentication and is logged, with a mandatory reason for read access to a customer’s account.

Security measures

GetSMS implements technical and organisational measures appropriate to the risk, including:

• hosting in Morocco, encryption of disks and backups, daily backups stored off the main server;
• encryption in transit (HTTPS) with the API, the dashboard and the fleet phones;
• hashed API keys, a separate key for each fleet phone, revocable remotely;
• permission checks on every request, two-factor authentication for sensitive roles and staff;
• an audit log of sensitive actions;
• notifications sent to fleet phones containing only a technical identifier, with no content or number;
• signed webhooks;
• no secrets or full phone numbers in technical logs;
• an incident management procedure.

GetSMS may change these measures provided the level of protection is not reduced.

Sub-processors

The customer authorises GetSMS to use the sub-processors listed on the Sub-processors page. GetSMS imposes on each, by contract, data protection obligations at least equivalent to those of this agreement and remains liable to the customer for their performance.

GetSMS notifies the customer of any addition or replacement of a sub-processor at least 30 days in advance, by e-mail to the organisation owner and on the Sub-processors page. The customer may object on reasonable data protection grounds, in writing to privacy@getsms.tech, within that period. If no solution is found, the customer may terminate the contract free of charge, with a refund of remaining credits.

In an emergency (security, sub-processor failure), the period may be shortened; the customer is informed as early as possible.

Mobile operators carrying SMS to recipients act under their legal obligations as telecommunications operators.

Transfers outside Morocco

Message data is hosted and processed in Morocco. GetSMS does not transfer it outside Morocco without informing the customer beforehand and complying with Articles 43 and 44 of Law 09-08, including obtaining the CNDP’s authorisation where required.

Assistance to the customer

As far as possible and taking into account the nature of the processing, GetSMS helps the customer:

• respond to its recipients’ requests (access, rectification, objection, deletion), in particular by viewing, exporting and deleting messages from the dashboard or the API;
• ensure the security of processing;
• carry out a risk assessment or respond to the CNDP, by providing the relevant information.

If a recipient contacts GetSMS directly, GetSMS forwards the request to the customer without delay and does not answer it itself, unless instructed by the customer or required by law.

Data breach

GetSMS informs the customer by e-mail within 72 hours of becoming aware of a data breach affecting its message data. The notification describes, as far as the information is available: the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences and the measures taken or planned. Information may be provided in stages.

GetSMS promptly takes the necessary steps to contain the breach and limit its effects, and cooperates with the customer on any notification to authorities and individuals concerned. Where applicable, GetSMS makes the incident reports required by Law No. 05-20 on cybersecurity.

End of processing

At the end of the contract, GetSMS stops all processing of message data, except for legal retention. Before closure, the customer can export its messages from the dashboard or the API. Data is then deleted according to the periods in the Privacy Policy, and for message content at the latest within 90 days of closure, unless a legal retention obligation applies. Copies in backups disappear at the end of their rotation cycle.

On written request, GetSMS confirms the deletion.

Audits

GetSMS makes available to the customer the information necessary to demonstrate compliance with this agreement, in particular a completed security questionnaire and a description of its measures.

The customer may, at its own expense, once a year and for serious reasons, have an audit performed by an independent auditor bound by confidentiality, on 30 days’ written notice, during business hours and without disrupting the Service or compromising other customers’ confidentiality. An audit may also be performed at the CNDP’s request.

Liability and term

Each party’s liability under this agreement is governed by the Terms of Service. The agreement takes effect on acceptance of the Terms and remains in force as long as GetSMS processes data on the customer’s behalf.