STXSTX
LEGAL

GDPR compliance

Last updated — September 2026

01 — Scope

This notice supplements our Privacy policy and applies to natural persons in the European Union and European Economic Area whose personal data is processed by STX SMS in connection with the services described at stxsms.org and panel.stxsms.org.

02 — Data controller

STX SMS acts as the data controller for account registration data, contact form submissions and billing records. For SMS delivery records (CDRs), STX acts as a data processor on behalf of the partner who routes traffic through the platform. CDRs contain masked phone numbers and carrier metadata — not message content.

03 — Legal basis for processing

We process personal data on the following legal bases under Article 6 GDPR:

  • Contract performance — processing account, routing and settlement data necessary to deliver the service you registered for.
  • Legitimate interest — platform security monitoring, fraud prevention and service reliability analytics.
  • Legal obligation — financial record retention required by tax and telecommunications regulation.

We do not rely on consent as a legal basis for any core processing activity. The contact form is based on pre-contractual steps (Article 6(1)(b)).

04 — International transfers

Our servers are located in the EU (Germany). Personal data is not transferred outside the EEA except when a payout is processed to a non-EEA payment provider, in which case the transfer is governed by Standard Contractual Clauses or an adequacy decision.

05 — Your rights

Under GDPR you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — request deletion where there is no overriding legal retention obligation.
  • Restriction — limit processing while a dispute is resolved.
  • Portability — receive your data in a structured, machine-readable format.
  • Object — object to processing based on legitimate interest.
  • Complaint — lodge a complaint with your national supervisory authority.

All requests are fulfilled within 30 days.

06 — Contact

For GDPR-related requests write to [email protected] with the subject line "GDPR request". Include your account email so we can locate your records.