In plain language
- For your customers’ contact data, you are the Data Fiduciary / controller and sendlz is your Data Processor. We process it only on your instructions under our Data Processing Addendum.
- Consent capture and opt-out are enforced at send time, and consent records are exportable so you can prove them.
- You choose where data is hosted. We publish our sub-processors, tell you before adding one, and let you object.
- If we confirm a breach affecting your data, we tell you without undue delay and within [48 hours] of confirmation.
1. Our roles
| Data | sendlz’s role | Your role |
|---|---|---|
| Contacts, message content, replies, delivery data you load or generate | Processor / Data Processor | Controller / Data Fiduciary |
| Your account users’ details, billing and support records | Controller / Data Fiduciary | Data subject (your staff) |
| Website visitors and marketing leads | Controller / Data Fiduciary | Data subject |
| Fraud, abuse and security signals across the platform | Controller / Data Fiduciary (independent) | — |
Meta Platforms, telecom operators and mailbox providers process message data as independent parties when delivering messages. They are not sendlz’s sub-processors.
2. India — Digital Personal Data Protection Act 2023
As a Data Processor for our customers, we process personal data only under a valid contract with you, follow your lawful instructions, apply reasonable security safeguards, help you meet your obligations, and delete or return data when the service ends. As a Data Fiduciary for our own data, we give clear notice, obtain consent or rely on a recognised legitimate use, keep data accurate, limit retention, and publish a Grievance Officer contact (see our Privacy policy).
You, as the Data Fiduciary, remain responsible for giving your contacts a notice and obtaining valid consent before you message them, for honouring withdrawal of consent, for verifiable parental consent where you message children, and for responding to data principals’ requests. The platform supports these duties with consent fields, opt-out enforcement and exports, but does not replace them.
The DPDP Rules were notified in November 2025 and are being phased in. We track commencement dates and any restrictions the Government of India notifies on transfers outside India, and we will update this page and our Data Processing Addendum as obligations take effect.
3. UK and EU GDPR
Our Data Processing Addendum meets Article 28 GDPR and UK GDPR. It sets out the subject matter and duration, the nature and purpose of processing, the data types, our confidentiality and security duties, sub-processor rules, assistance with data-subject requests and impact assessments, breach notification, deletion or return, and audit rights.
For transfers outside the EEA or UK we use the EU Standard Contractual Clauses (Modules 2 and 3), the UK International Data Transfer Addendum, and a transfer assessment for each destination. Where an EU or UK representative is required we have appointed [name and address — to be appointed]. Our DPA for Singapore customers is aligned with the PDPA.
A signed copy of the DPA with the SCCs and UK Addendum is available on request at [privacy@sendlz.com] and will be added to the console for self-serve signing.
4. Consent and opt-out
Marketing messages require a logged opt-in under the DPDP Act and GDPR, and WhatsApp, SMS and email each have their own rules. For every contact the platform records the channel, the time, the source and the wording or form used, and lets you export the record to prove it. Opt-outs from any channel are held once and enforced at send time across every channel, so a person who opts out on WhatsApp is not messaged by SMS or email marketing afterwards.
5. Data-subject and data-principal requests
When someone asks to access, correct or delete their data held in your account, you decide the response and the console lets you do so yourself. If we receive a request directly about data we process for you, we will send it to you without undue delay and will not respond ourselves unless you instruct us or the law requires. Requests about our own data go to [privacy@sendlz.com] and are answered within [30 days].
6. Sub-processors
We use the sub-processors below to deliver the service. This is the initial draft list and must be confirmed and completed before publication.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage and Amazon SES email delivery | [India (Mumbai) by default; EU (Ireland or Frankfurt) on request] |
| [Payment gateway — confirm] | Payment collection and refunds | [Location] |
| [Support and ticketing tool — confirm] | Customer support | [Location] |
| [Product analytics and monitoring — confirm] | Performance monitoring and error tracking | [Location] |
| [Transactional email/SMS partners — confirm] | Platform notifications | [Location] |
We will give you at least [30 days’] notice before adding or replacing a sub-processor, by email to your account contact and on this page. You may object on reasonable data-protection grounds within [10 business days]; we will work with you to resolve it, and if we cannot you may terminate the affected service and receive a pro-rata refund of prepaid fees. Each sub-processor is bound by written terms no less protective than ours.
7. Data residency
Customers choose the AWS region where their data is hosted and where email is sent from. Indian customers default to Mumbai (ap-south-1). EU customers can use Ireland (eu-west-1) or Frankfurt (eu-central-1) to keep processing inside the EEA. Some processing — such as delivery through Meta, operators and mailbox providers, and support access from our teams in India, the UAE and the UK — necessarily crosses borders and is covered by the safeguards in section 3. [Additional regions to be listed only when operational.]
8. Security measures
- Encryption of data in transit and at rest.
- Role-based access control, least-privilege access for staff, and four-tier customer permissions with cascading flags.
- Signed and replay-protected webhooks, scoped and rotatable API keys, and sandbox keys that cannot reach real recipients.
- Logging, monitoring and alerting on access to customer data.
- Background checks and confidentiality obligations for staff with access to customer data [confirm].
- Vendor security review, backup and tested recovery procedures.
- [Independent certifications — list only those actually held, for example ISO 27001 or SOC 2. Do not claim any that are not.]
9. Personal data breaches
If we confirm a personal data breach affecting data we process for you, we will notify you without undue delay and in any event within [48 hours] of confirmation, with what we know: the nature of the breach, the data and volume affected, likely consequences, and the measures taken or proposed. We will keep you updated and give you the information you need to meet your own duties, including notifying the Data Protection Board of India, the ICO or EU supervisory authorities and affected individuals. For breaches of our own controller data, we notify regulators and individuals as the law requires.
10. Retention and deletion
| Event | What happens |
|---|---|
| During the contract | You control retention of message content and logs within the limits in your plan; [90 days] is the default for delivery logs. |
| Contract ends | You can export your data for [30 days]. |
| After export window | We delete or anonymise Customer Data within [30 days], and backups are overwritten within [60 days]. |
| Legal holds | Records we are legally required to keep (for example invoices) are retained only for that purpose and period. |
| On request | We confirm deletion in writing. |
11. Audits and assurance
We make available the information needed to show compliance with the DPA, including summaries of security reviews and any independent reports we hold. Where that is not enough, you may audit us on reasonable notice, not more than once a year unless there has been a breach or a regulator requires it, under confidentiality and without disrupting other customers.
12. Contact
Privacy and DPA requests: [privacy@sendlz.com]. Data Protection Officer: [dpo@sendlz.com]. Grievance Officer (India): see our Privacy policy. Postal: Sendlz Technologies Pvt Ltd, [registered office address].