Data Processing Agreement (DPA) — CNDP Law 09-08 & GDPR Compliant - EnvoiSMS.ma
Official Data Processing Agreement (DPA) governing the relationship between the Customer (Data Controller) and EnvoiSMS.ma (Data Processor), strictly compliant with Moroccan CNDP Law No. 09-08 and GDPR (Article 28). Enterprise procurement-ready document including the Security & Data Architecture Whitepaper and execution framework.
This Data Processing Agreement ("DPA") governs the processing of personal data that ALLNOACROBÁTICO - CONSULTORIA DE ANÁLISE DADOS, UNIPESSOAL LDA (publisher and operator of EnvoiSMS.ma, Tax ID / NIF 517551624) carries out on behalf of its customers for programmable messaging services (transactional SMS, bulk broadcast campaigns, OTP verification, WhatsApp Business notifications). For all such processing, the Customer acts as Data Controller and EnvoiSMS.ma acts exclusively as Technical Data Processor, within the meaning of Moroccan Law No. 09-08 and Article 28 of the GDPR.
This DPA forms the official binding contractual framework governing data processing. The official agreement document to be completed and signed by the Customer is available for download in PDF format.
Article 2 — Contractual Description of Data Processing
The specific characteristics and technical parameters of the outsourced processing activities are set out in the following summary schedule:
Contractual Parameter
Technical Specifications & Commitments
Exclusive Purpose
Technical routing of SMS, OTP verification codes, WhatsApp Business messaging, recipient contact list management, and delivery receipt (DLR) return.
Data Categories
Standardised mobile telephone numbers (MSISDN), message text content, sender identification (Sender ID), delivery status reports, and technical metadata (timestamps, API calling IP).
Data Subjects
End customers, subscribers, consenting prospects, mobile application users, and legitimate business contacts of the Customer.
Active Retention Period
Rolling 30 to 90 days for routing and DLR logs for billing reconciliation and regulatory audit compliance, followed by automatic purge or irreversible anonymisation.
Data Fate Upon Termination
Permanent deletion or export within 30 days of account closure, subject to statutory Moroccan accounting archive requirements.
Article 3 — Obligations and Warranties of the Controller (The Customer)
•
Lawful Collection & Consent (Opt-in) : The Customer warrants that it holds prior, freely given, specific, and informed consent from all recipients for commercial or marketing communications, pursuant to Law 09-08 and CNDP guidelines. For transactional traffic (OTP, system alerts), Customer warrants a legitimate contract or legal basis.
•
Prior CNDP Formalities & Cross-Border Transfers : The Customer certifies having fulfilled all requisite prior declarations, authorizations, or permits with the Moroccan CNDP, including specific filings for direct marketing and cross-border data transfers.
•
Information of Data Subjects : The Customer undertakes to clearly inform recipients regarding data processing purposes and the exercise of their legal privacy rights.
•
Prohibition of Unsolicited Messaging & Permitted Hours : The Customer strictly prohibits sending spam, phishing, smishing, or messages outside statutory Moroccan permitted commercial hours (prohibited on Sundays, national holidays, and outside legal daytime hours).
•
API Key & System Security Duty : The Customer undertakes to rigorously safeguard its API keys and access credentials, never embed them in publicly accessible or client-side code, and adequately secure its own servers, webhook receiver endpoints, and databases. Any data leak or breach originating from Customer's side remains exclusively under Customer's liability.
•
Absolute Indemnification (Hold Harmless) : The Customer agrees to indemnify, defend, and hold harmless EnvoiSMS.ma, its officers, employees, and infrastructure partners from and against any and all claims, regulatory sanctions, administrative fines (specifically CNDP or ANRT penalties), carrier surcharges, legal fees, and liabilities arising out of or related to Customer's breach of privacy laws, lack of recipient consent, unlawful message content, or any data leak originating from Customer's API keys, credentials, or systems.
Article 4 — Obligations of the Processor (EnvoiSMS.ma)
•
Processing on Documented Instructions : EnvoiSMS.ma processes customer personal data solely upon documented written instructions conveyed through API requests or dashboard settings.
•
No Commercial Exploitation : EnvoiSMS.ma never sells, rents, leases, profiles, or monetises customer data or contact lists for its own purposes.
•
Personnel Confidentiality : All staff and technical operators with access to operational systems are bound by strict contractual and statutory confidentiality obligations.
•
Breach Notification within 72 Hours : EnvoiSMS.ma shall notify Customer in writing within seventy-two (72) hours upon confirming a verified security breach directly compromising Customer personal data. Such notice is provided for regulatory assistance and cooperation and shall under no circumstances constitute an admission of fault, negligence, contractual breach, or liability of any kind by EnvoiSMS.ma.
•
Customer Assistance & Self-Service : The platform provides self-service features for data export (JSON/CSV) and contact deletion. Any extraordinary bespoke engineering assistance shall be subject to prior quotation.
•
Public Authority Requests : EnvoiSMS.ma handles any public authority request relating to Customer data in accordance with Section 7 of its Privacy Policy (https://envoisms.ma/en/legal/privacy/) — legality verification, contestation of unlawful orders, data minimisation, and prompt notification of Customer unless prohibited by law on important grounds of public interest (GDPR Art. 28(3)(a)).
Article 5 — Technical and Organisational Security Measures (TOMs)
Security & Incidents
EnvoiSMS.ma operates a globally distributed Edge-Native Serverless architecture enforcing deep defense. The following five (5) fundamental technical safeguards are audited and contractually guaranteed:
1. Encryption in Transit (TLS 1.3 strict, HSTS) : Mandatory TLS 1.3 protocol across all API endpoints (https://api.envoisms.ma) and dashboard web portals. Global HSTS header enabled (Strict-Transport-Security: max-age=31536000; includeSubDomains; preload) preventing SSL downgrade attacks. Modern cipher suites supporting Perfect Forward Secrecy (PFS).
2. Encryption at Rest (AES-256) : All distributed relational database clusters (D1 SQLite Edge), object storage buckets (R2), and key-value stores (KV) are encrypted at rest using industry-standard AES-256 bit encryption.
3. Zero Plaintext OTP Storage (Automatic KV Purge after 5 Minutes) : One-time verification passwords (OTP) are never stored in plaintext within relational databases or message routing logs. Codes reside ephemerally in distributed in-memory KV cache (OTP_CODES) in cryptographic hashed form with a strict 300-second (5-minute) TTL purge. Codes are immediately invalidated upon successful verification or 3 failed attempts.
4. Webhooks Signed with Secret Key (HMAC-SHA256) : Every outgoing event notification and delivery receipt (DLR) dispatched to Customer systems is digitally signed with HMAC-SHA256 using an account secret key (transmitted in X-EnvoiSMS-Signature header), allowing cryptographic verification of payload authenticity and integrity.
5. Automated STOP Opt-out Management Compliant with CNDP : Real-time automated unsubscribe engine. Immediate keyword detection ("STOP", "ARRET", "UNSUBSCRIBE") on inbound SMS and WhatsApp, instant addition to global suppression table, and pre-send blocking at the gateway without balance debit, strictly enforcing Law 09-08 and CNDP mandates.
These technical safeguards serve as the formal technical annex for enterprise cybersecurity audits and procurement questionnaires.
Article 6 — Sub-processors & International Data Transfers
•
The Customer grants general authorisation for sub-processors published on the official reference list: https://envoisms.ma/en/legal/subprocessors/.
•
Telecom routing : licensed telecom operators and messaging aggregators, selected per destination (in Morocco: routing to Maroc Telecom, Orange and Inwi).
•
AI models for the WhatsApp assistants : Cloudflare, Inc. (Workers AI) and Google LLC (Gemini model, through our own AI gateway).
•
Cloud Edge Infrastructure : Cloudflare, Inc. (global edge routing, distributed D1 SQLite database, DDoS mitigation, and Web Application Firewall).
•
International transfers outside Morocco or the EEA are governed by Standard Contractual Clauses (SCCs) meeting Moroccan CNDP transfer authorization standards.
Article 7 — Limitation of Liability & Third-Party Telecom Disclaimers
Liability Framework
•
Telecom Carrier Contingencies & Pure Conduit Status : EnvoiSMS.ma operates as an automated technical conduit. Final delivery depends on third-party mobile network operators (Maroc Telecom, Orange, Inwi), handset availability, and radio coverage. EnvoiSMS.ma provides no 100% handset delivery guarantee. Carrier-level anti-spam rejections or delivery latency do not engage EnvoiSMS.ma liability.
•
Financial Liability Cap : In the event of proven liability exclusively attributable to EnvoiSMS.ma, cumulative damages are strictly capped at the total amounts (excluding VAT) paid by Customer during the three (3) months preceding the incident. All indirect, consequential, or reputational damages are expressly excluded.
EnvoiSMS.ma supplies enterprise procurement and security teams with compliance documentation within thirty (30) business days (privacy@envoisms.ma). On-site technical audits are strictly limited to one (1) per 12-month period, require thirty (30) business days prior written notice, must be conducted by an independent auditor bound by confidentiality during normal business hours, and are at Customer's sole expense (including technical support time), with absolute exclusion of proprietary source code and other customers' data.
Article 9 — Data Deletion and Account Termination
Upon account termination or contract expiration, EnvoiSMS.ma shall, at Customer's written choice, delete or return all personal data within thirty (30) business days, subject to mandatory statutory tax and accounting archiving requirements.
Article 10 — Official Contacts & Data Protection Officer
•
Data Protection Officer (DPO) : privacy@envoisms.ma