Data Processing Agreement
pursuant to Art. 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
Version 1.0 · valid from 14 May 2026
Who is this document for? This data processing agreement is intended for companies (TopSMS clients) that send SMS to their own customers through TopSMS and thereby process the personal data of third parties. In this relationship TopSMS acts as the processor and the client as the controller. The agreement forms an integral part of the TopSMS terms and conditions and is concluded at the moment a paid account is activated.
1. Parties
Processor:
TopSMS.cz, operated by Vojtěch Šafář, ID No. (IČO) 03346951, with registered office at Terronská 742/55, 160 00 Prague 6, Czech Republic, a natural person doing business under the Czech Trade Licensing Act. Contact: info@topsms.cz (hereinafter the “Processor”).
Controller:
The client who has created an account with the Processor and provided its identification details at registration (company name, ID No. (IČO), registered office, contact e-mail). The identification of the Controller is kept in the client dashboard and in the accounting documents (invoices) issued by the Processor (hereinafter the “Controller”).
2. Subject matter of the agreement
The Processor provides the Controller with a service for sending short text messages (SMS) to recipients’ end devices through a contracted aggregator that ensures delivery to the networks of mobile operators (T-Mobile CZ, O2, Vodafone) and to foreign networks. Within this service the Processor processes the personal data the Controller provides to it via the REST API, the dashboard or contact import.
3. Scope of processing
| Item | Specification |
|---|---|
| Subject matter of processing | Sending SMS messages on behalf of the Controller to the telephone numbers of its customers (data subjects) |
| Duration of processing | For the duration of the contract between the Controller and the Processor + statutory retention periods (accounting documents 10 years, SMS logs 12 months, opt-out database permanently) |
| Nature and purpose | Delivery of notifications, transactional confirmations, OTP codes, marketing communications and other content defined by the Controller |
| Type of personal data | Recipient’s telephone number, possibly name, e-mail and other contact details entered by the Controller; SMS content (may contain personal data); delivery records; the Controller’s own contact ID (“customId”) assigned by the Controller |
| Categories of data subjects | The Controller’s customers, its employees or other persons to whom the Controller sends SMS |
| Sensitive data (Art. 9 GDPR) | Not processed as standard. If the Controller enters sensitive data in the text of an SMS, it bears full responsibility for doing so and must have a separate legal basis (e.g. Art. 9(2)(h) for healthcare). |
4. Obligations and rights of the Controller
- The Controller is responsible for having a valid legal basis for the SMS sent under Art. 6 (and, where applicable, Art. 9) GDPR — typically the recipient’s consent, performance of a contract or legitimate interest.
- The Controller is responsible for fulfilling the information obligations towards data subjects (Art. 13, 14 GDPR).
- For marketing communications the Controller is responsible for obtaining consent under Section 7 of Czech Act No. 480/2004 Coll.
- The Controller must not use the service to distribute unlawful content, spam, fraudulent messages or communications infringing the rights of third parties.
- The Controller has the right to verify performance of this agreement by means of an audit (notified in writing at least 30 days in advance, at most once a year, at its own expense).
5. Obligations of the Processor
The Processor undertakes to:
- process personal data solely on the basis of documented instructions from the Controller (technically represented by API calls, actions in the dashboard or account settings) — in accordance with Art. 28(3)(a) GDPR;
- ensure that persons with access to personal data are bound by confidentiality (contractually and by internal rules);
- implement technical and organisational measures pursuant to Art. 32 GDPR (see Article 7 of this agreement);
- assist the Controller in responding to requests from data subjects (Art. 12–22 GDPR) — typically export, rectification and erasure of data from the dashboard;
- notify the Controller of a personal data breach without undue delay (at most within 48 hours of becoming aware of it) (Art. 33 GDPR);
- assist the Controller with a DPIA (Art. 35) and prior consultation with the supervisory authority (Art. 36) if the Controller so requests;
- after termination of the agreement, at the Controller’s request, hand over the personal data in a machine-readable format (CSV) or delete it. Closing the account in the application anonymises the Controller’s identification data; complete deletion of data is carried out by the Processor on the basis of a request sent to info@topsms.cz, within 30 days. Data whose further retention is required by European or Czech law (e.g. accounting documents for 10 years) is retained;
- provide the Controller with all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.
6. Sub-processors
The Controller gives the Processor general authorisation to engage other processors (sub-processors) in accordance with Art. 28(2) GDPR. The Processor publishes the current list of sub-processors below and will notify the Controller of any change (addition/replacement) by e-mail or by a notification in the dashboard at least 30 days in advance. If the Controller does not agree with the change, it has the right to terminate the agreement.
| Sub-processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Telecommunications aggregators | Delivery of SMS to CZ/SK operator networks and internationally, including a backup channel | EU | GDPR — no SCCs required; list of names on request |
| Stripe Payments Europe, Ltd. | Processing of card payments for credit top-ups (e-mail, payment details) | Ireland (EU) | Standard Contractual Clauses + DPA |
| Google Ireland Ltd. | Website traffic and advertising measurement (Google Analytics, Google Ads) — only with cookie consent | Ireland (EU) / USA | Standard Contractual Clauses + EU–US Data Privacy Framework |
| Microsoft Ireland Operations Ltd. | Microsoft Clarity — anonymised click maps and recordings of movement on the public website, only with cookie consent (does not apply to the dashboard or customer data) | Ireland (EU) / USA | Standard Contractual Clauses + EU–US Data Privacy Framework |
| Anthropic PBC | Optional AI suggestion of message text — only the prompt the user enters is processed | USA | Standard Contractual Clauses |
| DigitalOcean, LLC | Application hosting (server, database, file storage) | EU (Frankfurt or Amsterdam) | Standard Contractual Clauses + DPA |
| Resend, Inc. | Transactional e-mails (registration confirmation, password reset, invoices) | USA | Standard Contractual Clauses + DPA (EU–US Data Privacy Framework) |
| Mobile operators (T-Mobile CZ, O2 CZ, Vodafone CZ, and foreign networks where applicable) | Physical delivery of SMS to the end device | CZ + recipient’s destination country | Own statutory transmission obligation |
7. Technical and organisational measures (Art. 32 GDPR)
- Encrypted transport: TLS 1.3 for all communication between the client and the server; HSTS preload.
- Password hashing: bcrypt (cost 10+, planned upgrade to 12).
- Separation of roles: only authorised administrators have access to the database; actions of admin users are logged (audit log).
- 2FA: two-factor authentication (SMS OTP) is mandatory for all admin users.
- Network isolation: the database is not accessible from the internet, only from the application server.
- Backup: daily database backups; restoration possible within 24 hours.
- Monitoring: continuous monitoring of availability and security incidents.
- Security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy — grade A on securityheaders.com.
- Security audits: annual external penetration test (planned).
- Responsible disclosure programme: topsms.cz/security
8. Transfers outside the EU/EEA
The Processor undertakes to transfer personal data outside the EU/EEA only through sub-processors with which it has concluded Standard Contractual Clauses (pursuant to Commission Implementing Decision (EU) 2021/914) or which are members of the EU–US Data Privacy Framework (Resend). For the current list see Article 6.
9. Liability
Each party is liable for damage caused by a breach of this agreement in accordance with the general legal regulations. The maximum amount of compensation payable by the Processor for non-pecuniary harm is limited to the amount of fees paid in the last 12 months, unless the breach was intentional or caused by gross negligence.
10. Duration and termination
This agreement takes effect together with the activation of the Controller’s account with the Processor and remains in force for the entire period during which the service is provided. Termination of the main contract (deactivation of the account) also terminates this data processing agreement — the obligations relating to confidentiality, deletion/return of data and retention of statutory documents (e.g. invoices) survive its termination.
11. Amendments to the agreement
The Processor may amend this agreement unilaterally due to changes in legislation, the state of the art or the list of sub-processors. It will notify the Controller of changes by e-mail or by a notification in the dashboard at least 30 days before they take effect. If the Controller does not agree with the change, it has the right to terminate the agreement.
12. Final provisions
- This agreement is governed by Czech law, in particular the GDPR and Czech Act No. 110/2019 Coll.
- Disputes will be resolved within the jurisdiction of the courts of the Czech Republic.
- If any provision is invalid, the remaining provisions remain in force.
- This agreement is concluded in electronic form and is available at topsms.cz/zpracovatelska-smlouva. By accepting the terms and conditions, the Controller also agrees to this agreement.
Contact for DPA matters
For questions about data processing, data subject requests, incident notifications or questions about the DPA:
info@topsms.cz
For clients with higher requirements for the processing of personal data (banks, healthcare providers, public administration) we provide a tailored data processing agreement — write to info@topsms.cz.