This is a translation. The French version prevails in case of discrepancy.
Principle
GetSMS uses the providers below to deliver the Service. Each receives only the data needed for its task and is bound by confidentiality and security obligations. Their role is governed by the Data Processing Agreement and the Privacy Policy.
Sub-processors
| Provider | Role | Processing location | Data concerned |
|---|---|---|---|
| Oracle (Oracle Cloud Infrastructure) | Hosting of the API, dashboard, databases and backups | Morocco (Casablanca region) | All Service data: accounts, verification files, messages, numbers, billing |
| Google (Firebase Authentication) | Member sign-in to the dashboard, when this sign-in method is used | Outside Morocco (including the United States) ¹ | E-mail, name, login identifier, IP address, login timestamps |
| Google (Firebase Cloud Messaging) | Notifications that wake up the fleet phones so they fetch the messages to send | Outside Morocco (including the United States) ¹ | Technical identifier of the phone and the message, with no content or recipient number |
| Clerk | Member sign-in to the dashboard, when this sign-in method is used | United States ¹ | E-mail, name, login identifier, IP address, device, login timestamps |
| Centre Monétique Interbancaire (CMI) | Card payments (3-D Secure) | Morocco | Amount, order reference, payer’s name and e-mail; card data is entered directly on the CMI page |
| E-mail delivery provider | Sending Service e-mails (confirmation, sign-in alerts, invitations, invoices) | Available on request | Recipient’s e-mail and name, e-mail content |
| Vercel | Hosting of the public website getsms.tech and the documentation docs.getsms.tech only |
Outside Morocco ¹ | Visitors’ technical connection data (IP address, browser); no customer or message data |
¹ Transfer outside Morocco. These transfers are made in accordance with Articles 43 and 44 of Law No. 09-08: to a country ensuring an adequate level of protection or, failing that, with the authorisation of the National Commission for the Control of Personal Data Protection (CNDP).
Mobile operators
SMS are sent from the SIM cards of the GetSMS fleet over the networks of Moroccan mobile operators, which carry them to recipients and carry their replies back to the fleet.
| Operator | Role | Location | Data concerned |
|---|---|---|---|
| Maroc Telecom | SMS carriage | Morocco | Recipient number, SMS content |
| Orange Maroc | SMS carriage | Morocco | Recipient number, SMS content |
| inwi | SMS carriage | Morocco | Recipient number, SMS content |
Operators act under Law No. 24-96 on post and telecommunications and ANRT rules, not on GetSMS’s instructions for processing this data.
Changes
Any addition or replacement of a sub-processor is announced at least 30 days before it goes live:
- by e-mail to the owner of each customer organisation;
- by updating this page, with a new effective date.
A customer may object on reasonable data protection grounds by writing to privacy@getsms.tech within that period, under the Data Processing Agreement.