Data Processing Terms

Effective from 10 November 2026 · Data processing agreement under Article 28 GDPR

1. Parties and subject matter

1.1. The Customer is the controller and OÜ CSC Telecom Estonia (the Processor) is the processor of personal data that the Customer processes through the Service (message recipients, contact groups, message content).

1.2. These terms form an integral part of the Terms of Service and apply for the term of the agreement.

2. Description of processing

Purpose	sending the Customer’s messages, delivery reports, contact management
Data subjects	the Customer’s message recipients and contacts
Categories of data	phone number, contact names and fields added by the Customer, message content, delivery status and time
Special categories	the Customer does not send special categories of personal data through the Service unless it has a legal basis and has implemented appropriate safeguards
Duration	term of the agreement and the periods set out in section 6

3. Processor’s obligations

The Processor:

processes personal data only on the Customer’s documented instructions (configuration and use of the Service constitute such instructions), unless required otherwise by law;
ensures that persons with access to the data are bound by confidentiality;
implements security measures under Article 32 GDPR (encrypted connections, access control, logging, backups, firewalls);
assists the Customer in responding to data subject requests and in meeting its obligations under Articles 32–36 GDPR;
notifies the Customer of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it;
makes available the information necessary to demonstrate compliance and allows audits upon reasonable notice.

4. Sub-processors

4.1. The Customer gives general authorisation to engage sub-processors in the following categories: mobile operators and SMS carriers (message delivery), server and hosting providers, e-mail service providers.

4.2. The Processor enters into written agreements with sub-processors that provide an equivalent level of protection. The Customer is notified of new sub-processor categories at least 30 days in advance and may object on reasonable grounds and, if necessary, terminate the agreement.

4.3. Where the Customer sends a message to a country outside the European Economic Area, transferring the number and message to the operator in that country is necessary to carry out the Customer’s instruction.

5. Customer’s obligations

The Customer ensures that it has a legal basis for the processing and for sending messages (including consent for direct marketing), that data subjects have been informed of the processing and that message content is lawful.

6. Deletion

6.1. Message content is deleted automatically after 12 months. Sending metadata is kept for billing for up to 3 years.

6.2. When the agreement ends, the Processor deletes the Customer’s contacts and messages within 30 days, except data that must be retained by law. The Customer can export its data from the account before the agreement ends.

7. Contact

Data protection enquiries: info@csc.ee.