Data Protection Addendum

For recipient data — the mobile numbers you upload and the messages you send to them — you are the Data Fiduciary and nexistxt is the Data Processor under the Digital Personal Data Protection Act, 2023.

You determine why and how that data is processed. We process it only on your documented instructions, which the platform expresses as the campaigns you create and the API calls you make.

• Obtain and maintain a lawful basis for contacting every number you upload, and be able to evidence it.
• Provide the notice the DPDP Act requires to the people whose data you upload.
• Honour withdrawal of consent and act on opt-outs.
• Upload only what you need. Do not upload sensitive categories of data in message content or list metadata.
• Respond to Data Principal requests about your own lists — we will assist, but we cannot decide them for you.

• We process recipient data only to deliver, report on and bill for your messages, and to meet our own regulatory obligations.
• We do not use your recipient data for our own purposes, for other customers, or to build lists of our own.
• We match message content against your registered templates before transmission.
• We restrict access to production data, log that access, and encrypt credentials at rest.
• We assist you in responding to Data Principal requests and to the Data Protection Board.
• On termination we delete recipient data except where regulation requires retention of transmission records.

Delivering a message necessarily discloses the recipient number to a telecom operator or aggregator. We also use infrastructure and payment providers. Each is bound to process only on our instructions. We will give you notice of a new category of sub-processor before it begins handling your data.

If we become aware of a personal data breach affecting your data, we will notify you without undue delay with the facts as we know them, and will support the notifications you are required to make. We will notify the Data Protection Board of India where the DPDP Act requires us to.

Uploaded lists are retained while your account is active and are deleted when you delete them. Transmission records — the fact that a message was sent to a number, and its outcome — are retained for the period TRAI regulation requires, because we are obliged to be able to produce them.

On reasonable written notice, and no more than once a year unless a regulator requires otherwise, we will provide the information you reasonably need to verify our compliance with this addendum.

Data protection queries: