In plain language
- We handle two kinds of data: our own (website visitors, account holders, billing) and our customers’ (the people they message). For our own data we decide why and how it is used; for our customers’ data we only act on their instructions.
- We use your data to run and secure the service, bill you, support you and — only with your consent — market to you. We never sell personal data.
- You can ask us to access, correct or delete your data at any time. Indian users can also reach our Grievance Officer directly.
- Data can be stored in India, the EU or the UK depending on your plan and region choice. Transfers outside those regions use approved safeguards.
1. Who we are and what this policy covers
Sendlz Technologies Pvt Ltd (“sendlz”, “we”, “us”) provides a platform for sending WhatsApp, SMS and email messages. Our registered office is at [registered office address] and we operate from Bengaluru, Dubai and London.
This policy applies to personal data we handle in two different roles, and it is important to know which one applies to you:
- As controller (Data Fiduciary under India’s DPDP Act) — for data about visitors to sendlz.com, people who sign up for or use a sendlz account, people who contact us, and our billing and marketing records. This policy explains how we use that data.
- As processor (Data Processor) — for the contact lists, message content, replies and delivery data that our customers load into or generate through the platform. The customer decides why that data is processed. We process it only on the customer’s documented instructions under our Data Processing Addendum, and this policy does not govern it.
If you received a message sent through sendlz by one of our customers, that customer is responsible for that message. Please contact them first; see section 9.
2. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and contact | Name, work email, phone number, company, role, password hash | You, when you register or contact us |
| Business and billing | Legal entity name, GSTIN or tax ID, billing address, invoices, wallet top-ups and transaction records | You and our payment providers |
| Verification | Business documents needed for WhatsApp Business verification or SMS DLT registration | You |
| Usage and technical | IP address, device and browser type, pages viewed, log data, API request metadata, error reports | Collected automatically |
| Communications | Support tickets, emails, call notes and recordings made with notice | You and our team |
| Marketing and events | Email address and preferences, webinar registrations, survey answers | You, with consent where required |
| Recruitment | CV, contact details and interview notes | Applicants |
| Third-party sources | Business contact details from partners or public sources; sign-in details if you use a third-party login | Partners and public sources |
We do not knowingly collect sensitive personal data through our own website. If a customer’s messages contain sensitive data, that data is customer content processed under section 1 (processor role).
Message metadata (sender, recipient, timestamp, delivery status) and message content are handled differently: content is kept only as long as needed to deliver and display the conversation, subject to the retention table in section 6.
3. How we use personal data and our legal bases
We use personal data only for the purposes below. Where GDPR or UK GDPR applies, the legal basis is shown; for DPDP purposes we rely on your consent or on a “legitimate use” recognised by the Act, as noted.
| Purpose | Legal basis |
|---|---|
| Create and run your account, provide the service, provide support | Contract; DPDP legitimate use (voluntarily provided for a stated purpose) |
| Bill you, collect payment, keep tax and accounting records | Contract; legal obligation |
| Keep the platform secure, prevent fraud and abuse, enforce our terms and messaging policies | Legitimate interests; legal obligation |
| Improve and develop the product through aggregated, de-identified usage analysis | Legitimate interests |
| Send product updates and marketing emails about sendlz | Consent, or legitimate interests for existing business customers where the law allows; you can opt out at any time |
| Set non-essential cookies and analytics | Consent |
| Comply with law, respond to lawful requests, establish or defend legal claims | Legal obligation; legitimate interests |
| Assess job applications | Legitimate interests; steps at your request |
We do not sell personal data, and we do not use customer message content to train advertising profiles.
5. International transfers
sendlz operates across India, the Gulf, Southeast Asia and the UK, so personal data may be processed outside the country where it was collected. Customers can choose a hosting region (for example Mumbai for Indian data, or Ireland or Frankfurt for EU data) as described on our DPDP & GDPR page.
Where data is transferred outside the EU, UK or another jurisdiction that restricts transfers, we use recognised safeguards — such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum — and assess the destination. Transfers out of India are made in line with the DPDP Act and any restrictions the Government of India notifies. You can ask us for a copy of the safeguards in use.
6. How long we keep personal data
We keep personal data only as long as needed for the purpose it was collected, then delete or anonymise it. The periods below are our defaults; where the law requires longer, the longer period applies.
| Data | Retention |
|---|---|
| Account and profile data | While your account is active, then [30 days] after closure |
| Billing, invoices and tax records | [8 years] as required by Indian tax and company law |
| Message metadata and delivery logs (customer content, processor role) | [90 days] by default, configurable by the customer |
| Message content and media (customer content, processor role) | [Per the customer’s setting; deleted within 30 days of account closure] |
| Consent and opt-out records | For the life of the account plus [3 years], so consent can be proven |
| Support tickets and correspondence | [3 years] after the last interaction |
| Website analytics and logs | [13 months] |
| Backups | Rolling backups overwritten within [60 days] |
| Job applications | [12 months] unless you agree to a longer period |
7. How we protect personal data
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access with least privilege, separation of customer environments, logging and monitoring, vendor security reviews and staff confidentiality obligations. Customers can also control which of their own team members see which data through the platform’s roles and permissions.
No system is perfectly secure. If a personal data breach affects you, we will notify you and regulators as the law requires and as set out in our DPDP & GDPR page.
8. Your rights and how to use them
Depending on where you live, you can ask us to:
- give you a copy of the personal data we hold about you and information about how it is used (access);
- correct or complete inaccurate data, and update it (correction);
- delete your data where it is no longer needed or you withdraw consent (erasure);
- restrict or object to certain uses, and withdraw consent at any time without affecting earlier lawful processing;
- receive your data in a portable format (GDPR/UK GDPR);
- not be subject to decisions based solely on automated processing that significantly affect you (GDPR/UK GDPR);
- nominate another person to exercise your rights if you die or are unable to (DPDP Act); and
- complain to us, and to your data protection authority — in India the Data Protection Board, in the UK the ICO, in the EU your local supervisory authority.
To exercise a right, email [privacy@sendlz.com] from the address on your account or use the request form in the console. We may need to verify your identity. We will respond within [30 days] and tell you if we need more time or cannot fully comply, and why.
9. If you were messaged by a sendlz customer
If you received a WhatsApp, SMS or email through sendlz, the business that sent it decided to contact you and is responsible for that data. Reply STOP (or the opt-out keyword in the message) to opt out, or contact the business directly to access or delete your data. If you contact us instead, we will pass your request to the relevant customer without undue delay, and we can suppress your number or address from further sends through the platform on request.
10. Children
sendlz is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children through our own services. If you believe a child has provided us data, contact us and we will delete it. Customers who message children are responsible for obtaining any verifiable parental consent the law requires.
12. Grievance Officer, Data Protection Officer and contact
| Role | Details |
|---|---|
| Grievance Officer (India — IT Act and DPDP Act) | [Name], [Designation] · [grievance@sendlz.com] · [postal address]. We acknowledge complaints within [48 hours] and aim to resolve them within [30 days]. |
| Data Protection Officer / privacy team | [dpo@sendlz.com] |
| UK and EU representative (if required) | [Name and address — to be appointed] |
| General enquiries | hello@sendlz.com |
13. Changes to this policy
We will update this policy when our practices or the law change. The “last updated” date is at the top of the page. For material changes we will give account holders at least [30 days’] notice by email or in the console before they take effect.