GDPR Privacy Policy

1. Introduction

This GDPR Privacy Policy ("Policy") describes how Sendexa ("Company", "we", "us", "our") collects, uses, processes, and protects personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR").

We are committed to transparency in our data processing activities. This Policy applies to all personal data we collect from our users, customers, website visitors, and any other individuals whose personal data we process.

This Policy is an integral part of our Terms of Service and should be read together with our Privacy Policy and Acceptable Use Policy.

2. Key Definitions

Understanding these key GDPR terms will help you navigate this policy:

3. Data Controller & Processor

3.1 Data Controller

Sendexa acts as the Data Controller for personal data collected directly from you when you:

• Create an account with Sendexa
• Visit our website and use our services
• Contact us for support or inquiries
• Sign up for our newsletters or communications

3.2 Data Processor

Sendexa acts as a Data Processor when you use our Services to process the personal data of your customers, users, or other data subjects. In these cases:

• You are the Data Controller
• We process data only according to your instructions
• We have Data Processing Agreements (DPAs) in place
• We implement appropriate technical and organizational measures

4. Data We Collect

We collect the following categories of personal data:

4.1 Account Information

• Full name and email address
• Phone number and contact details
• Company name and business information
• Billing and payment information
• Account preferences and settings

4.2 Usage Data

• API call logs and usage patterns
• Message content and communication metadata
• Device and browser information
• IP addresses and geolocation data
• Performance and error logs

4.3 Communication Data

• Messages sent and received through our Services
• Call records and voice data
• Support tickets and correspondence
• Survey responses and feedback

4.4 Special Categories of Data

Our Identity Verification and Fraud Detection services process biometric data under Article 9 GDPR, on the basis of your explicit consent (Article 9(2)(a)), strictly where you or your end users choose to use those services:

• Identity documents (passports, national IDs, driver's licenses) submitted for KYC verification
• Facial images and biometric templates used for liveness detection and identity matching

Outside of Identity Verification and Fraud Detection, we do not seek to collect other special categories of personal data, including:

• Racial or ethnic origin
• Political opinions or religious beliefs
• Health data
• Sexual orientation or sexual life
• Trade union membership

5. How We Use Your Data

We use your personal data for the following purposes:

6. Legal Basis for Processing

Under the GDPR, we process your personal data based on the following legal grounds:

7. Data Sharing & Transfers

7.1 Data Sharing

We share your personal data with:

• Service Providers: Third-party vendors who help us deliver our Services (e.g., cloud providers, payment processors).
• Business Partners: With your consent, we may share data with trusted partners.
• Legal Authorities: When required by law or to protect our rights and safety.

7.2 International Data Transfers

• We operate globally and may transfer data to countries outside the EEA.
• All transfers are protected by appropriate safeguards, including:
• Standard Contractual Clauses (SCCs)
• EU-US Data Privacy Framework (where applicable)
• Adequacy decisions by the European Commission
• You can request a copy of our transfer safeguards.

8. Your Data Subject Rights

Under the GDPR, you have the following rights regarding your personal data:

8.1 How to Exercise Your Rights

• Submit your request via email to dpo@sendexa.co
• We will respond to your request within 30 days of receipt.
• We may need to verify your identity before processing.
• You have the right to lodge a complaint with a supervisory authority.

9. Data Security

We implement comprehensive technical and organizational measures to protect your personal data:

9.1 Data Breach Response

• We have a comprehensive Data Breach Response Plan in place.
• We will notify affected users within 72 hours of becoming aware of a breach.
• We will cooperate with supervisory authorities in investigating breaches.

10. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this Policy:

You can request deletion of your data at any time by contacting our Data Protection Officer.

11. Cookies & Tracking

We use cookies and similar tracking technologies to enhance your experience:

11.1 Cookie Consent

• We request explicit consent before setting non-essential cookies.
• You can withdraw your consent at any time.
• You can manage cookie preferences through your browser settings.
• We respect Do Not Track (DNT) signals where possible.

12. Children's Data

• Our Services are not directed to children under the age of 16 (or applicable age in your jurisdiction).
• We do not knowingly collect personal data from children without parental consent.
• If you believe we have collected data from a child, please contact us immediately.
• We will delete such data promptly upon discovery, unless legally required to keep it.

13. Changes to This Policy

• We may update this Policy from time to time.
• We will notify you of significant changes via email or platform notification.
• Continued use of our Services after changes constitutes acceptance of the updated Policy.
• If you do not agree to the changes, you must stop using our Services.
• The "Last Updated" date at the top indicates when this Policy was last revised.

14. Contact Us

If you have any questions about this Policy or want to exercise your rights, please contact our Data Protection Officer: