Privacy Policy

1. General Information

This Privacy Policy describes how TDACRM Solutions SRL ("we", "our" or "company") collects, uses and protects your personal information when you use the SendSMS service ("Service").

2. Personal Data Collected

2.1 Data collected automatically:

• Information about your Bitrix24 portal (URL, portal ID)
• Application usage data (frequency of use, features accessed)
• IP address and browser information
• Error logs and activity logs for diagnostics

2.2 User-provided data:

• Phone numbers of contacts in your CRM
• Content of SMS messages sent
• Custom application settings
• Billing information for purchasing credits

2.3 Data received from third parties:

• Contact information from your Bitrix24 portal (name, phone, email)
• Bitrix24 authentication data
• Delivery reports from SMS operators

3. Processing Purposes

We use your personal data for the following purposes:

• Service Delivery: Sending SMS messages through global networks
• Billing and Payments: Processing transactions for SMS credits
• Reporting and Analytics: Providing delivery reports and statistics
• Technical Support: Troubleshooting and improving the Service
• Legal Compliance: Complying with legal and regulatory obligations
• Security: Preventing fraud and abusive use

4. Legal Basis for Processing

We process your data based on the following legal bases:

• Contract Performance (Art. 6(1)(b) GDPR) - for providing the Service
• Legitimate Interest (Art. 6(1)(f) GDPR) - for service improvement and security
• Legal Obligation (Art. 6(1)(c) GDPR) - for tax and legal compliance
• Consent (Art. 6(1)(a) GDPR) - for non-essential cookies

5. Data Sharing with Third Parties

5.1 SMS Operators:

We transmit phone numbers and message content to international SMS operators for delivery. These act as data processors in accordance with processing agreements.

5.2 Payment Processors:

Billing information is transmitted to authorized payment processors for transaction processing.

5.3 Bitrix24:

We synchronize delivery status back to your Bitrix24 portal according to application settings.

5.4 Competent Authorities:

We may disclose personal data to competent authorities in case of a valid legal request.

6. International Transfers

Data may be transferred to SMS operators in third countries for message delivery. These transfers are made on the basis of:

• European Commission adequacy decisions
• Standard contractual clauses (SCC)
• Protection certifications (e.g., Privacy Shield for USA)

7. Retention Period

• SMS Message Content: 30 days after sending (for debugging)
• Delivery Reports: 12 months (for billing and disputes)
• Billing Data: 5 years (tax obligations)
• Activity Log: 24 months (security and analysis)
• Account Data: Until account closure + 30 days

8. Your Rights

Under GDPR, you have the following rights:

• Right of Access - request copies of your personal data
• Right of Rectification - request correction of inaccurate data
• Right to Erasure - request deletion of data under certain conditions
• Right to Restriction - request limitation of processing
• Right to Data Portability - receive data in a structured format
• Right to Object - object to processing based on legitimate interest
• Right not to be Subject to a decision based solely on automated processing

To exercise these rights, contact us at [email protected].

9. Data Security

We implement technical and organizational measures to protect your personal data:

• Encryption of data in transit and at rest (TLS 1.3, AES-256)
• Robust authentication and authorization systems
• Continuous monitoring and intrusion detection
• Regular system and process audits
• Data protection training for staff
• Security incident response plans

10. Cookies and Similar Technologies

The website uses cookies for:

• Essential Cookies: Basic application functionality
• Performance Cookies: Analytics and improvement (with consent)
• Preference Cookies: Saving user settings

You can manage cookie preferences through the consent banner or your browser settings.

11. Minors

The Service is not intended for persons under 16 years of age. We do not intentionally collect personal data from minors without parental or guardian consent.

12. Changes to This Policy

We may update this Privacy Policy periodically. Significant changes will be communicated through:

• Notification in the Bitrix24 application
• Email to portal administrators
• Updating the "Last updated" date on this page

13. Contact and Complaints

For questions about this Privacy Policy or to exercise your GDPR rights:

You also have the right to lodge a complaint with the data protection authority:

National Data Protection Authority (ANSPDCP)
Website: www.dataprotection.ro