Privacy Policy for DARSMS account, contact, and messaging data.

DARSMS operates a bulk SMS platform in Tanzania and processes personal data in line with the Personal Data Protection Act, 2022 (Cap. 44) and the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023. We act as the data controller for our customers' account, billing, and usage data. For the recipient phone numbers, contact lists, and message content that customers upload or send, the customer is the data controller and DARSMS processes that data on the customer's instructions as a data processor.

Depending on how you use the platform, we may collect:

• Account details such as name, email address, phone number, password, or Google sign-in identity, and company profile information;
• Contact lists, groups, and recipient phone numbers you upload or enter;
• Sender ID requests and supporting business documents;
• Message content, scheduling details, and delivery logs returned by mobile networks;
• Billing records, invoices, and the mobile money or payment reference used for purchases;
• Unsubscribe records: the phone number and sender name submitted on our public unsubscribe page;
• Support requests, and technical data such as IP address, device and browser details, and security logs.

We use personal data to create and manage accounts, verify sender IDs, process and deliver SMS traffic, report delivery status, process payments, prevent fraud and abuse, honour opt-outs, respond to support requests, improve the service, and meet legal and regulatory obligations, including requirements of the Tanzania Communications Regulatory Authority (TCRA). We rely on performance of our contract with you, compliance with legal obligations, your consent where required, and our legitimate interest in operating a secure and reliable service.

We send account owners service messages such as one-time passwords, payment confirmations, and low-balance alerts. We may also send product tips and offers by SMS or email. Account owners can turn off marketing messages at any time from their profile settings or by contacting us; service messages needed to operate your account will continue.

If you received an SMS sent through DARSMS, it was sent by the business named as the sender, and that business is responsible for having your consent or another lawful basis. You can stop further messages from a sender at any time using our unsubscribe page. We keep a record of your phone number and the sender name so that future messages from that sender to your number are blocked; deleting this record would cause messages to resume.

We share personal data only where needed to deliver the service or as required by law, with mobile network operators and SMS gateways that carry messages, payment providers, hosting and infrastructure providers, and professional advisers. We may disclose information to TCRA, the Personal Data Protection Commission, law enforcement, or courts where we are legally required to do so. We do not sell personal data.

Some of our service providers may store or process data outside Tanzania. Where that happens, we transfer personal data only as permitted by the Personal Data Protection Act and take reasonable steps to ensure it receives an adequate level of protection.

We keep personal data only for as long as reasonably necessary for service delivery, records management, dispute handling, fraud prevention, and legal, tax, and regulatory compliance. Unsubscribe records are kept for as long as they are needed to honour the opt-out. DARSMS uses administrative, technical, and operational safeguards, including access controls, encrypted connections, and activity logging, designed to protect account and messaging data. If a personal data breach occurs that is likely to affect your rights, we will notify you and the relevant authorities as required by law.

Subject to the Personal Data Protection Act, you have the right to:

• Be informed about how your personal data is collected and used;
• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of data that is no longer needed or was processed unlawfully;
• Object to processing, including processing for direct marketing;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with the Personal Data Protection Commission (PDPC).

The DARSMS platform is intended for businesses and organisations and is not directed at children under 18. We do not knowingly create accounts for children.

This policy may change as our platform, providers, or legal obligations evolve. The current version and effective date shown on this page apply to ongoing use of the DARSMS service.