01Overview & Data Controller Information
NAMX Telecom operates a global telecommunication switching network, SMS traffic exchange, and developer messaging API suite. We recognize the fundamental importance of information security, data confidentiality, and privacy rights across all borders.
Under applicable data protection legislation (including the EU General Data Protection Regulation 2016/679 "GDPR", the UK Data Protection Act, and the California Consumer Privacy Act "CCPA"):
- Data Controller: For client account details, contractual communications, billing ledgers, and technical portal authentication credentials, NAMX Telecom acts as a Data Controller.
- Data Processor: For the transient message text, destination telephone numbers (MSISDNs), Sender ID strings, and message payloads transmitted through our SMPP v3.4/v5.0 bindings or REST endpoints, NAMX Telecom acts as a Data Processor on behalf of the Customer (who acts as the Data Controller).
02Categories of Information We Process
We process strictly the minimum necessary data required to provision wholesale telecommunications services, execute routing switches, settle bilateral invoices, and prevent SS7 signaling fraud:
03Lawful Basis & Purposes of Processing
We process personal and telecommunication data only under lawful, legitimate grounds:
- Performance of Contract (Article 6(1)(b) GDPR): Routing, switching, delivering, and confirming SMS transactions, WhatsApp Business sessions, and RCS messaging as ordered by our clients.
- Compliance with Legal & Regulatory Obligations (Article 6(1)(c) GDPR): Telecom licensing compliance, lawful interception mandates where strictly required by authorized judicial warrants, accounting standards, and anti-money laundering (AML) requirements.
- Legitimate Interests (Article 6(1)(f) GDPR): Network security, SS7 anti-fraud firewalling, preventing Distributed Denial of Service (DDoS) attacks, detecting SIM-box bypass operations, and maintaining 99.99% system availability.
04Automated Message Content Purging & Retention Schedule
NAMX Telecom champions privacy-by-design. We do not maintain perpetual archives of consumer text messages or SMS contents:
All Short Message Service message contents (the text body inside PDU submit_sm payloads) are automatically and irreversibly purged from our active RAM caches and transient routing buffers within 72 hours of network acknowledgment.
| Data Category | Storage Location | Retention Window | Purge Mechanism |
|---|---|---|---|
| SMS Text Content (Payload) | Volatile RAM / Encrypted Transit Cache | Maximum 72 hours | Automated hard cryptographic overwrite |
| Call Detail Records (CDR) | Encrypted Audit Storage | 6 to 12 months (or contractual billing requirement) | Scheduled archival roll-off & pseudonymization |
| Financial Invoices & KYC | Secure Financial Storage | 5 to 7 years | Mandatory international corporate tax retention |
| Edge Firewall Connection Logs | Protected SOC System Logs | 30 days | Rolling automated FIFO log truncation |
05Data Security, Encryption & Infrastructure Safeguards
We implement multi-layered physical, technical, and administrative security measures aligned with ISO/IEC 27001 standards to prevent unauthorized access, alteration, disclosure, or destruction of communications:
- Transport Layer Security: All SMPP binds support TLS 1.3 protocol encapsulation. All REST APIs enforce mandatory HTTPS with modern cipher suites and HSTS preloading.
- IPsec VPN Binds: For sovereign mobile operators and tier-1 banking institutions, dedicated IPsec VPN tunnels with static IP mutual authentication are provisioned on demand.
- Access Control: Zero-trust network architecture with mandatory Multi-Factor Authentication (MFA), role-based access control (RBAC), and continuous auditing of all administrative console actions.
- Data Center Tiering: Hosted in Tier-3+ and Tier-4 carrier-neutral data centers featuring biometric access barriers, 24/7 armed physical security, redundant UPS power, and automated fire suppression systems.
06Carrier Interconnections & Authorized Sub-processors
To terminate messaging traffic to worldwide mobile subscribers, NAMX Telecom transmits signaling metadata through direct interconnect agreements with authorized Mobile Network Operators (MNOs), licensed transit carriers, and verified SS7 hubbing partners.
All third-party carriers and sub-processors undergo rigorous security due diligence and are bound by strict data processing agreements prohibiting secondary use of customer data for commercial advertising, marketing, or profiling.
07International Data Transfers & Cross-Border Routing
Because telecommunications is fundamentally global, message delivery requires the international transfer of signals to the destination country where the recipient's mobile device is registered.
Where personal data originating in the European Economic Area (EEA) or United Kingdom is transferred to third countries lacking an adequacy decision under Article 45 of the GDPR, NAMX Telecom incorporates European Commission Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements (IDTAs) to ensure equivalent data protection safeguards.
08Your Rights Under Global Privacy Laws (GDPR, CCPA & More)
Depending on your country of residence, you or your authorized representatives hold distinct legal rights regarding personal data:
- Right of Access: Request confirmation of whether we process personal data and obtain a copy of relevant records.
- Right to Rectification: Request correction of inaccurate, outdated, or incomplete corporate and account records.
- Right to Erasure ("Right to be Forgotten"): Request deletion of personal records where retention is no longer necessary for contractual or legal compliance.
- Right to Restrict or Object to Processing: Request suspension of certain processing activities where legitimate grounds are disputed.
- Right to Data Portability: Receive account records in a structured, commonly used, and machine-readable format (JSON/CSV).
- Right to Lodge a Complaint: Lodge a complaint with your national Data Protection Authority (DPA) or Information Commissioner.
10Data Protection Officer & Privacy Contact
To exercise any privacy rights, request a copy of our Standard Data Processing Addendum (DPA), or escalate data security questions, please reach out to our dedicated Data Protection team:
NAMX Telecom Data Protection & Privacy Office
Inquiries regarding GDPR compliance, DPA execution, CDR redaction & security audits.