Data Processing Addendum

SMSRay is a product of Lacspace Corporation Pvt. Ltd. ("Lacspace", "we", "us" or "our"), a company registered in India (CIN U46511DL2025PTC079972, RoC-Delhi) and registered in Nepal (Reg. No. 377566/82/83, PAN 622468837).

This Data Processing Addendum (the "DPA") forms part of the Terms of Service between you (the "Customer") and Lacspace, and applies where Lacspace processes personal data on the Customer's behalf through SMSRay. In this DPA, the Customer is the controller and Lacspace is the processor.

This page summarises the DPA. If you need a countersigned copy for your records, contact legal@lacspace.com.

• Subject matter and purpose: sending OTP, transactional and two-way SMS for the Customer, tracking delivery, handling inbound replies and delivering webhooks.
• Data subjects: the Customer's end users and other people the Customer messages or receives replies from.
• Personal data: mobile numbers, message content (with OTP codes stored only as hashes and hidden in logs), delivery metadata, inbound message content and, if the Customer passes it, end-user IP addresses for OTP rate limiting.
• Duration: for as long as the Customer uses the Service, plus the retention periods set out in the Privacy Policy.

The Customer must not send special categories of personal data (such as health, biometric or financial account details) in message content unless that is necessary and lawful for its use case.

Lacspace will:

• process personal data only on the Customer's documented instructions, which include these Terms and the Customer's use of the Service, unless the law requires otherwise (in which case we will tell the Customer, unless the law forbids it);
• ensure that people authorised to process the data are bound by confidentiality;
• implement the security measures described below;
• assist the Customer, taking into account the nature of the processing, in responding to data subject requests and in meeting its obligations on security, breach notification and impact assessments;
• make available information reasonably necessary to demonstrate compliance with this DPA;
• not sell the personal data or use it for advertising.

The Customer is responsible for having a lawful basis and any required consent for the processing, for the accuracy of the data it sends, for honouring opt-outs (automatic STOP handling is coming soon) and for giving recipients any notices the law requires.

The Customer authorises Lacspace to use sub-processors in the following categories:

• Cloud hosting for the API, portal and supporting services.
• Database hosting for storing workspace, message and delivery data.
• Email delivery for sending portal sign-in codes to customers who sign in by email.

Lacspace affiliates may also help operate the Service. Mobile network operators carry messages as part of the telecommunications service and act independently, not as Lacspace's sub-processors.

Lacspace imposes data protection terms on each sub-processor that are no less protective than this DPA and remains responsible for their performance. We will give notice of material changes to sub-processor categories, and the Customer may object on reasonable data protection grounds by writing to privacy@lacspace.com.

• OTP codes stored only as SHA-256 hashes; OTP message text hidden in logs and the dashboard.
• API keys and portal refresh tokens stored only as hashes; short-lived access tokens; refresh tokens that rotate with reuse detection.
• Encryption in transit for the API, portal and webhooks; webhook payloads signed with HMAC-SHA256 and a timestamp.
• Role-based access within workspaces and restricted staff access on a need-to-know basis.
• An audit log of portal changes and session management with the ability to revoke sessions.
• Rate limits and abuse controls on sending and OTP endpoints.
• Our pool phones and SIM cards are owned and managed by Lacspace, and devices can be disabled and removed from routing.

If Lacspace becomes aware of a personal data breach affecting the Customer's data, we will notify the Customer without undue delay, and provide the information reasonably available to us to help the Customer meet its own notification obligations.

We will take reasonable steps to contain the breach, investigate it and reduce its effects, and keep the Customer informed.

Lacspace and its sub-processors may process personal data in countries other than the Customer's. Where we do, we will ensure the transfer is protected as required by applicable law.

When the Customer's workspace is closed, Lacspace will delete or anonymise the Customer's personal data within a reasonable period, unless the law requires us to keep it. Before closing, the Customer can view its message history in the portal or retrieve messages through the API.

OTP codes expire after 5 minutes and webhook delivery history is deleted after 7 days in the ordinary course.

Data protection questions: privacy@lacspace.com. Countersigned copies and legal matters: legal@lacspace.com. Grievances: grievance@lacspace.com.