GDPR Compliance

Last updated: July 1, 2026

1. Data Controller

DeSms Ltd is the data controller for personal data collected through our platform. We are registered with the ICO and comply with the UK GDPR and EU GDPR.

2. Legal Basis for Processing

We process personal data based on consent, contractual necessity, and legitimate interests. You have the right to withdraw consent at any time.

3. Data We Collect

We collect account information (name, email), payment data, verification phone numbers, and usage analytics. We do not read or store SMS content.

4. Data Retention

Account data is retained for the duration of your account plus 12 months. Verification numbers and associated metadata are retained for 30 days.

5. Your Rights

You have the right to access, rectify, erase, restrict processing, data portability, and object to processing. Submit requests via support@desms.com.

6. Third-Party Transfers

We use EU/UK-based data processors where possible. International transfers are governed by Standard Contractual Clauses.

7. Data Security

We implement encryption at rest and in transit, regular security audits, and strict access controls. Our SOC 2 Type II report is available on request.

8. DPO Contact

Our Data Protection Officer can be reached at dpo@desms.com. Response time is within 72 hours for data subject requests.