Privacy Statement

We, Intergo Telecom Ltd, a company registered in Cyprus under registration number HE 352115, with registered office at Tepeleniou 17, Office 102-103, 8010 Paphos, Cyprus (the operators of the SMS.to online service), take your privacy very seriously. We handle your personal data with the utmost care and attention. You can trust that we treat your information with the same level of responsibility we expect for our own. Our goal is to ensure you can use our services with confidence and without worry.

SMS.to provides a comprehensive SMS Marketing and SMS API gateway platform for businesses aimed at excellence. We provide tailored services, tools and technology to empower businesses to reach their audience effectively, efficiently, and seamlessly.

Processing personal data is necessary for us to offer our services, ensure the proper functioning of our websites, and carry out our business operations.

PURPOSE OF THIS PRIVACY STATEMENT.

This privacy statement aims to give you information about the collection and use of your personal data while using this website as a visitor or customer. This privacy statement applies to all our websites, platforms and services and provides information for the kind of personal data we collect, why we collect it and how we use it during our relationship with you.

PERSONAL DATA.

Personal data is any information that can directly or indirectly identify a natural person.

 We regard the protection of personal data as a fundamental principle. We strive to ensure you remain informed and empowered regarding the handling of your data and your end users’ data, and the measures in place to keep it secure.

This Privacy Statement applies where we act as the controller of your personal data. Where we process the personal data of your end-users on your behalf in the course of providing the Services, you act as the controller and we act as a processor, and that processing is governed by our Data Processing Terms, available at https://sms.to/dpa/, which form part of our Acceptable Use Policy and Agreement, rather than by this Privacy Statement.

We apply similar data protection standards to all individuals regardless of nationality or location. Personal data is only used when necessary to achieve a purpose, with proper notification to affected individuals, and with legal grounds to do so. All activities involving personal data are checked against the EU’s GDPR or other applicable data protection laws.

PROCESSING PERSONAL DATA.

We process personal data only for specific purposes, unless we are legally obliged to do otherwise.

We always collect and process personal data lawfully and under a legal basis.

The legal basis we use for processing is:

Consent: Where you have given us your consent, for example to receive marketing material or marketing information from us;

Performance of a contract: Including service provision and contract negotiations.

Compliance with legal obligations applicable to us: Such as preventing service misuse, cooperating with disclosure requests, and retaining required customer and financial data.

Legitimate interest: To deal with customer service and complaints and for related purposes such as improving our services, analysing usage, and maintaining the security of our systems and preventing fraud. When relying on legitimate interest, we assess that the processing is not high risk, does not involve special categories of personal data, and does not violate fundamental privacy rights.

The specific legal basis for processing your data may differ outside the European Economic Area (EEA) due to varying data protection requirements.

We only request necessary personal data for specified purposes; if our relationship changes, we may need you to provide additional information or remove data that is no longer required.

Providing the personal data we request to create and operate your account is necessary for us to enter into and perform our agreement with you. If you do not provide it, we may be unable to provide the Services. Providing personal data for marketing purposes is optional.

Personal data processing purposes include:

Provision of services

Sharing relevant product and service information according to your marketing preferences

Creating and managing your account

Verifying your identity

Facilitating service access and use

Finance and billing purposes

Providing customer support and account communications

Analyzing product and service usage

Optimizing communications processing and infrastructure

Enforcing Terms compliance and applicable laws

Maintaining security of our site, your account, and services

Detecting and preventing fraudulent or unlawful activity

Protecting rights, property, and safety of all parties

Meeting legal obligations, including compliance with valid legal mechanisms

Conducting surveys to improve services (voluntary participation)

Applying cookies according to your consent settings

 

WHAT PERSONAL DATA WE COLLECT.

1. Personal Data directly collected from you.

Personal identifiers: Name, business address, phone number, email address, optional photo, bio description, and signature.

Employment/professional information: Company information, and job title.

Financial information: Payment and billing details, including banking information.

Commercial information: Product interests, service usage, account dashboard usage, and web page visits.

Internet activity information: Device data, browser information, time zone, pages visited, products viewed, response times, interaction data, IP address, and cookie usage.

Location-related information: IP Address, business address, and service traffic metadata like routing paths and carriers.

Support interaction information: Contact details and query content for customer support interactions.

1. Personal Data from third parties or publicly available sources.

We may receive personal data about you from various third parties and public sources as set out below.

Technical Data from the following parties:

(a)  analytics providers such as Google

(b)  advertising networks such as Google Ads,  YouTube, X (formerly Twitter), Facebook and

(c)  search information providers such as Google, Facebook

1. Message recipients’ traffic data.

When our customers send messages through SMS.to, we process certain traffic data relating to the recipients of those messages, such as the recipient’s mobile number, sender ID, timestamps, routing information, the carrier or aggregator used and delivery status. We process this data as an independent controller to invoice our services, detect and prevent fraud and misuse, maintain network and information security, and comply with our legal obligations as an electronic communications provider. Our legal bases are compliance with legal obligations and our legitimate interests in securing, operating and billing for our services and network. We retain this data only for as long as necessary for these purposes, including any retention period required by law.

The content of messages, and any other processing we carry out on behalf of our customers, is governed by our Data Processing Terms, under which our customer is the controller. If you have received a message sent through SMS.to and wish to exercise your rights in relation to it, please contact the sender of the message. You may also contact us at dpo@intergotelecom.com and, where appropriate, we will forward your request to the sender.

DATA SHARING AND DISCLOSURE.

We are committed to maintaining the confidentiality of personal data. We do not, under any circumstances sell personal data.

We may share your personal data, when necessary and with all appropriate safeguards, to provide and improve our services, comply with legal obligations or for the effective operations of our business with:

Telecommunications Carriers and Routing Partners

To deliver messages through the SMS.to platform, we share relevant data, such as recipient phone numbers, routing details, and message metadata, with telecommunications carriers, SMS aggregators, and routing partners. These partners process data strictly for message delivery, quality assurance, and regulatory compliance within their respective jurisdictions. When conveying messages, these carriers and aggregators act as providers of electronic communications services in their own right and are bound by the confidentiality of communications rules that apply to them.

Payment Processors

When you make payments for our services, your payment information is processed by trusted third-party payment processors. We only share the data required to securely complete transactions, prevent fraud, and manage billing activities.

Third-party Services

Third-party service providers used by us will only collect, use, or disclose your information as needed to perform the services they deliver to us.

However, certain providers—including payment processors—have their own privacy policies governing how they handle your information. We encourage you to read those policies to understand how your data will be managed by these providers.

Some providers may operate in jurisdictions different from yours or ours. As a result, if you engage in a transaction involving a third-party provider, your data may be subject to the laws of the jurisdiction in which that provider operates.

For example, if you are located in Canada and your payment is processed by a gateway located in the United States, your personal information may be subject to U.S. legislation, including the U.S. CLOUD Act and the USA PATRIOT Act.

Once you leave our site or are redirected to a third-party website or application, this Privacy Statement  and our Terms and Conditions  no longer apply.

Cloud Hosting Providers

Our platform is hosted on secure cloud infrastructure. Personal data stored or processed within our system may be held on servers operated by cloud service providers. These providers act under our instructions and implement strong technical and organizational measures to protect the data.

Regulatory and Legal Authorities

We may disclose personal data when required to comply with applicable laws, lawful requests, or regulatory obligations. This may include responding to court orders, government inquiries, or law enforcement requests. We will always ensure that disclosures are limited to what is legally necessary.

Internal Departments and Authorized Personnel

Personal data may be accessed by internal teams such as customer support, billing, technical operations, security, and legal solely for the purpose of performing their job functions. Access is strictly controlled through role-based permissions and confidentiality obligations.

Links on our site may direct you to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

INTERNATIONAL DATA TRANSFERS

 As part of operating our services, some personal data may be transferred to and processed in countries outside the European Economic Area (EEA). These locations may have different data protection laws than those in your home country. Regardless of where data is processed, we ensure that it is handled securely and in accordance with applicable data protection legislation, including the GDPR.

Transfers to Countries with Adequacy Decisions

Where personal data is transferred to a country that the European Commission has determined provides an adequate level of data protection, we rely on that adequacy decision to permit the transfer. This means the destination country offers protections comparable to those within the EEA.

Standard Contractual Clauses (SCCs)

For transfers to countries that do not benefit from an adequacy decision, we implement European Commission–approved Standard Contractual Clauses (SCCs). These legally binding clauses contractually require recipients to safeguard personal data, uphold data subject rights, and maintain security and confidentiality to GDPR standards. Where appropriate, we also conduct transfer impact assessments and apply additional measures when needed.

Additional Safeguards and Security Measures

To further protect personal data transferred internationally, we apply a combination of technical and organizational measures, which may include:

▪ Encryption in transit and at rest to ensure data cannot be accessed by unauthorized parties

▪ Pseudonymization or minimization of data where feasible

▪ Strict access controls and role-based permissions

▪ Monitoring and auditing processes to verify compliance

▪ Use of secure, industry-leading hosting environments

These measures are designed to ensure the continued protection of personal data regardless of where it is stored or processed.

Transfers to Service Providers and Partners

When engaging third-party service providers or cloud hosting providers located outside the EEA, we only work with organizations that can demonstrate robust privacy and security practices. All such service providers are contractually obligated to:

▪ Process data solely on our instructions

▪ Maintain GDPR-level security

▪ Not use the data for their own purposes

▪ Notify us of any security incidents

▪ Support us in fulfilling data subject rights

DATA RETENTION

We keep personal data only for as long as we’re obligated to, either by our agreements or by law. How long we hold onto specific information depends on what it is, why we collected it, and the legal rules that apply in the country or region where it’s processed. When personal data is no longer required for the purposes for which it was collected, we securely delete or anonymize it.

SECURITY

We take reasonable precautions and follow industry best practices to ensure your personal data is not lost, misused, accessed without authorization, disclosed, altered, or destroyed.

Card payments are processed by our PCI-DSS-compliant payment processors, and we do not store full card numbers on our systems [CONFIRM WITH FINANCE/IT]. While no method of internet transmission or electronic storage is 100% secure, we implement appropriate security safeguards.

DATA STORAGE

Our site is hosted on reputable cloud providers such as Amazon Web Services and Google Cloud. Our production and disaster-recovery environments are located mainly in the European Economic Area. Your data is stored securely behind firewalls, and all transfers occur over encrypted channels.

COOKIES

Cookies are small pieces of text sent to  your web browser by a website you visit. A cookie file is stored in your web browser and allows the site or a third-party to recognise you and make your next visit easier and the site more useful to you.

Web beacons are small graphic files linked to our servers that allow us to track your use of our site and related functionalities. Cookies and web beacons allow us to serve you better and more efficiently, and to personalise your experience on our site.

Cookies can be “persistent” or “session” cookies.

We use both session and persistent cookies on the site, and we use different types of cookies to run the site:

• Essential cookies. Necessary for the operation of the site. We may use essential cookies to authenticate users, prevent fraudulent use of user accounts, or offer site features.
• Analytical/performance cookies. Allow us to recognise and count the number of visitors and see how visitors move around the site when using it. This helps us improve the way the site works.
• Functionality cookies. Used to recognise you when you return to the site. This enables us to personalise our content for you, greet you by name, and remember your preferences (for example, your choice of language or region).
• Targeting cookies. Record your visit to the site, the pages you have visited, and the links you have followed. We will use this information to make the site more relevant to your interests. We may also share this information with third parties for this purpose.

Third-party cookies

In addition to our own cookies, we may also use various third-party cookies to report usage statistics of the Site and refine marketing efforts.

• Tracking cookies. Follow on-site behaviour and tie it to other metrics allowing better understanding of usage habits.
• Optimization cookies. Allow real-time tracking of user conversion from different marketing channels to evaluate their effectiveness.
• Partner cookies. Provide marketing conversion metrics to our partners so they can optimize their paid marketing efforts.

What are your choices regarding cookies?

Non-essential cookies are placed only with your consent, which you can give, refuse or withdraw at any time through the cookie settings on our website. In addition, if you’d like to delete cookies or instruct your web browser to delete or refuse cookies, please visit the help pages of your web browser. Please note, however, that if you delete cookies or refuse to accept them, you might not be able to use some or all the features we offer. You may not be able to log in, store your preferences, and some of our pages might not display properly.

YOUR LEGAL RIGHTS

Under certain circumstances, you have rights under data protection laws in relation to your personal data.

You have the right to:

Request access to your personal data.

Request correction of your personal data.

Request erasure of your personal data.

Object to processing of your personal data.

Request restriction of processing your personal data.

Request transfer of your personal data.

Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Lodge a complaint with a supervisory authority; in Cyprus, this is the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy). We would, however, appreciate the chance to address your concerns before you approach the supervisory authority, so please contact us in the first instance.

If you wish to exercise any of the rights set out above, please contact us at dpo@intergotelecom.com

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

AUTOMATED DECISION-MAKING

When you register for an account, we use automated processing, including profiling, to verify the information you provide and to help us prevent fraud and misuse of our services. These automated checks assess your registration details against risk and verification indicators and may result in an application not being activated automatically. Where such a decision produces legal effects concerning you or similarly significantly affects you, you have the right to obtain human intervention on our part, to express your point of view, and to contest the decision. To exercise these rights, please contact our Data Protection Officer at dpo@intergotelecom.com.

CHILDREN

Our services are not designed for individuals under the age of 18. We do not knowingly collect or handle personal information from anyone under 18. If we become aware that such information was provided to us without the proper parental or legal consent, we will take appropriate steps to remove it.

OPT-OUT

You may opt-out of any optional service, feature or processing activity at any time by providing a written notice to us. When we receive your opt-out notice we shall cease the relevant optional activity within a reasonable time. It is noted that all mandatory services required for the performance of the Agreement will remain unaffected.

CONTACT INFORMATION

For any queries regarding this statement and/or the processing of your personal data, please contact the Data Protection Officer at dpo@intergotelecom.com.