Data Processing Addendum

SMSRay is a product of Lacspace Corporation Pvt. Ltd. ("Lacspace", "we", "us" or "our"), a company registered in India (CIN U46511DL2025PTC079972, RoC-Delhi) and registered in Nepal (Reg. No. 377566/82/83, PAN 622468837).

This Data Processing Addendum (the "DPA") forms part of the Terms of Service between you (the "Customer") and Lacspace, and applies where Lacspace processes personal data on the Customer's behalf through SMSRay. In this DPA, the Customer is the controller and Lacspace is the processor.

This page summarises the DPA. If you need a countersigned copy for your records, contact legal@lacspace.com.

The Customer must not send special categories of personal data (such as health, biometric or financial account details) in message content unless that is necessary and lawful for its use case.

Lacspace will:

• process personal data only on the Customer's documented instructions, which include these Terms and the Customer's use of the Service, unless the law requires otherwise (in which case we will tell the Customer, unless the law forbids it);
• ensure that people authorised to process the data are bound by confidentiality;
• implement the security measures described below;
• assist the Customer, taking into account the nature of the processing, in responding to data subject requests and in meeting its obligations on security, breach notification and impact assessments;
• make available information reasonably necessary to demonstrate compliance with this DPA;
• not sell the personal data or use it for advertising.

The Customer is responsible for having a lawful basis and any required consent for the processing, for the accuracy of the data it sends, for honouring opt-outs (automatic STOP handling is coming soon) and for giving recipients any notices the law requires.

The Customer authorises Lacspace to use sub-processors in the following categories:

• Cloud hosting for the API, portal and supporting services.
• Database hosting for storing workspace, message and delivery data.
• Email delivery for sending portal sign-in codes to customers who sign in by email.

Lacspace affiliates may also help operate the Service. Lacspace operates the delivery infrastructure that delivers messages, and mobile network operators in Nepal transmit them to recipients as part of the telecommunications service. Mobile network operators act independently, not as Lacspace's sub-processors.

Lacspace imposes data protection terms on each sub-processor that are no less protective than this DPA and remains responsible for their performance. We will give notice of material changes to sub-processor categories, and the Customer may object on reasonable data protection grounds by writing to privacy@lacspace.com.

We will take reasonable steps to contain the breach, investigate it and reduce its effects, and keep the Customer informed.

Lacspace and its sub-processors may process personal data in countries other than the Customer's. Where we do, we will ensure the transfer is protected as required by applicable law.

When the Customer's workspace is closed, Lacspace will delete or anonymise the Customer's personal data within a reasonable period, unless the law requires us to keep it. Before closing, the Customer can view its message history in the portal or retrieve messages through the API.

OTP codes expire after 5 minutes and webhook delivery history is deleted after 7 days in the ordinary course.

Data protection questions: privacy@lacspace.com. Countersigned copies and legal matters: legal@lacspace.com. Grievances: grievance@lacspace.com.