Privacy policy
Last updated 6 November 2026. This is a summary of the Czech privacy policy, which prevails in case of doubt.
1. Controller
Vojtěch Šafář, sole trader, Terronská 742/55, 160 00 Prague 6, Czech Republic, ID No. (IČO) 03346951. E-mail: info@topsms.cz.
2. Data we process
- At registration: name, e-mail address, mobile number, password (hashed) and, optionally, company name. Billing details are entered later in the account settings.
- When using the service: SMS texts, recipient numbers, time of sending, delivery status.
- Payments: payment history, billing details, payment references.
- Technical: IP address, browser type, access time (logs).
3. Purposes and legal bases
- Performance of the contract (Art. 6(1)(b) GDPR): providing the SMS gateway.
- Legal obligations (Art. 6(1)(c) GDPR): accounting, tax.
- Legitimate interest (Art. 6(1)(f) GDPR): security of the service, abuse prevention.
- Consent (Art. 6(1)(a) GDPR): marketing and analytics cookies.
4. Retention
- Invoices and accounting records: 10 years under the Czech VAT Act.
- Logs of sent SMS: for the duration of the contract, at most 12 months after sending; earlier on request.
- Access logs (IP, audit): for the duration of the contract, at most 6 months.
5. Recipients
We share data only with:
- Mobile network operators, through our contracted SMS carriers (telecommunications aggregators based in the EU): recipient number and message text. The list is available on request.
- DigitalOcean LLC (EU region): hosting of the application and database.
- Resend Inc. (USA, EU-US Data Privacy Framework and standard contractual clauses): transactional e-mails (registration, password, invoices).
- Stripe Payments Europe, Ltd. (Ireland): card payments for top-ups.
- Google Ireland Ltd.: traffic measurement and advertising, only with cookie consent.
- Seznam.cz, a.s. (Czech Republic): measuring advertising in the Sklik network.
- Microsoft Ireland Operations Ltd.: Microsoft Clarity, anonymised usage recordings of the public website, only with consent to analytics cookies.
- Anthropic PBC (USA, standard contractual clauses): optional AI text suggestions; only the prompt you enter is sent.
- Public authorities where required by law.
6. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. We answer requests sent to info@topsms.cz within 30 days. You can lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, uoou.gov.cz) or the supervisory authority in your country.
7. Processing on behalf of business customers
If you send SMS to your own customers or staff through TopSMS, we process their data on your behalf (Art. 28 GDPR). The data processing agreement is concluded in the customer dashboard.
8. Cookies
Necessary cookies (login, security tokens) are set without consent. Analytics and marketing cookies (Google Analytics, Google Ads, Microsoft Clarity, Sklik) are set only after you agree in the cookie banner, where you can change your choice at any time. Details of each cookie: topsms.cz/cookies.
9. Security
Encrypted transport (TLS), hashed passwords, access restrictions, logging and regular security checks. More at topsms.cz/security.