Privacy Policy

Overview and scope

This Privacy Policy applies to the website bestbulksms.com.ng , the BestBulkSMS web application, SMS messaging tools, WhatsApp messaging tools, APIs, dashboards, wallets, support channels and related services that link to this policy.

It explains our practices when we process personal data as a controller and when we process personal data on behalf of a business customer. It also explains the responsibilities of customers who upload recipient numbers or send messages through the platform.

Definitions

Customer

A business, school, organisation, developer, professional or other account holder using the platform.

Recipient

A person whose telephone number receives or is intended to receive an SMS or WhatsApp message.

Personal data

Information relating to an identified or identifiable natural person.

Controller

The person or organisation deciding why and how personal data is processed.

Processor

A service provider processing personal data on documented instructions from a controller.

WhatsApp assets

A customer’s business portfolio, WABA, business phone number, profile and approved templates.

Our privacy roles

Our legal role depends on the processing context. The table below describes the roles that normally apply, although applicable law, contracts and the facts of a particular service may require a different analysis.

Information we process

The categories below describe information we may process. The exact information depends on the features used, customer configuration, message channel, recipient interaction and legal requirements.

Sensitive or special-category information

Customers must avoid submitting highly sensitive data unless it is strictly necessary, lawful, appropriately secured and permitted by the applicable messaging channel. Depending on jurisdiction, this may include health, biometric, genetic, religious, political, sexual-life, criminal, financial-account or government identification information.

How we obtain information

We obtain personal data from the following sources:

• Directly from account users when they register, complete a profile, verify a business, fund a wallet, contact support or configure services.
• From customers and their authorised users when they upload contact lists, create campaigns, submit API requests or configure recipient data.
• From message recipients when they reply, opt out, complain, report abuse or contact us.
• From Meta and WhatsApp during embedded signup, WABA and phone-number management, template synchronisation, message transmission and webhook delivery.
• From mobile networks and messaging providers through routing, delivery receipts, sender-ID processes and error responses.
• From payment processors and banks through payment confirmation, settlement, refunds and fraud-screening results.
• Automatically from devices and systems through cookies, sessions, logs, security tools, API gateways and monitoring.
• From public or lawful verification sources where needed to verify business identity, authority, fraud risk or compliance.

How we use information

We process personal data only for specified, explicit and legitimate purposes, including the following:

1. Create, authenticate, administer and secure customer accounts.
2. Provide SMS sending, scheduling, personalisation, routing, short-link and delivery-report services.
3. Connect and manage customer-owned WhatsApp Business Accounts, phone numbers, profiles and approved templates.
4. Queue, transmit, retry, cancel, synchronise and report message delivery.
5. Price messages, debit wallets, process wallet transfers, issue invoices and reconcile payments.
6. Provide API access, enforce permissions, prevent abuse and apply rate limits.
7. Respond to support requests, disputes, delivery questions and privacy complaints.
8. Detect fraud, spam, account compromise, unlawful messaging, policy violations and security threats.
9. Maintain service availability, backups, audit records and operational diagnostics.
10. Comply with law, regulatory directions, court orders and lawful requests.
11. Improve usability, reliability, performance and customer experience using aggregated or appropriately protected data.
12. Send service notices and, where permitted, product or marketing communications that can be opted out of.

Service communications

We may send account, security, payment, delivery, compliance, maintenance and policy notices needed to operate the service. These are not promotional messages and may continue while an account or unresolved transaction remains active.

Aggregated and de-identified information

We may aggregate or de-identify information so it no longer reasonably identifies an individual. We may use that information for statistics, capacity planning, security, pricing analysis, product improvement and reporting, subject to applicable law.

Lawful bases for processing

Depending on the processing activity and jurisdiction, we rely on one or more of the following lawful bases:

• Contract: processing necessary to create an account, deliver messaging services, administer wallets, provide APIs, support customers and perform our agreement.
• Consent: processing based on a freely given, specific, informed and unambiguous agreement, including certain marketing, cookies or recipient communications.
• Legitimate interests: platform security, service improvement, fraud prevention, customer support, business administration and proportionate direct marketing where those interests are not overridden by individual rights.
• Legal obligation: tax, accounting, regulatory, court, law-enforcement, sanctions, consumer-protection and data-protection duties.
• Vital interests: exceptional situations involving protection of life or physical safety.
• Public interest or official authority: where applicable law authorises or requires such processing.

SMS-specific processing

How SMS delivery works

When a customer sends an SMS, we process the sender ID, recipient number, message content, route, segment count, price, schedule and delivery information. The message may pass through one or more SMS gateways, aggregators, mobile-network operators and recipient networks before reaching the recipient.

Personalised SMS

Customers may submit variable fields such as name, account number, customer ID, appointment date, amount, school class, admission number, invoice number or other custom values. Customers must minimise these fields, verify accuracy and avoid unnecessary sensitive data.

Delivery receipts and errors

Networks and gateways may return delivery states, timestamps, error codes and error descriptions. These records are used for delivery reporting, troubleshooting, billing, fraud prevention, complaints and reconciliation.

Sender IDs and network routing

We may process sender-ID registration information, network prefix information, destination country, routing rules and gateway assignments. Provider and gateway credentials remain restricted operational data and are not disclosed in normal customer responses.

Short links

If a customer uses a BestBulkSMS short link, we may process the destination URL, token, click count, click time, IP address and browser information for redirection, abuse prevention and reporting. Customers must provide any legally required notice about link tracking.

WhatsApp-specific processing

Customer-owned WhatsApp business identity

BestBulkSMS is designed so that each customer connects and uses its own Meta business portfolio, WhatsApp Business Account, WhatsApp business phone number, business profile, display name and approved templates. A recipient should see the customer’s authorised business identity, not a shared BestBulkSMS sender.

Embedded signup and asset management

During Meta Embedded Signup, the customer interacts with Meta to connect or create business assets. We may receive identifiers, status information and permissions needed to manage the connected WABA, phone number, profile and templates. Meta separately processes information under its own terms, privacy notices and platform policies.

Message templates and recipient communications

Customers may create, synchronise and use approved authentication, utility, marketing or other permitted templates. We process the selected template, language, variables, recipient number, media metadata and delivery events needed to transmit and report the message.

Webhooks and delivery events

Meta may send webhooks containing message states, inbound-message information, errors, template events, phone-number events and account updates. We verify, process, correlate, retry and log those events as needed to operate the service. Sensitive webhook credentials and signature values are restricted from normal display.

Meta and WhatsApp policies

Customers must comply with the WhatsApp Business Terms of Service , the WhatsApp Business Messaging Policy , applicable Meta platform terms, template rules and all applicable laws.

Customer responsibilities

Every customer using BestBulkSMS to contact recipients must comply with applicable privacy, electronic communications, consumer-protection, advertising, telecommunications and industry-specific laws.

Customers must:

• Collect recipient information lawfully, fairly and transparently.
• Provide recipients with an appropriate privacy notice identifying the customer and explaining the messaging purpose.
• Obtain and retain valid consent where consent is required, including the wording, source, date and scope of the consent.
• Use recipient lists only for purposes compatible with the notice and lawful basis under which the information was collected.
• Avoid purchased, scraped, guessed, harvested or unlawfully shared telephone-number lists.
• Maintain suppression lists and promptly honour STOP, unsubscribe, block, objection and do-not-contact requests.
• Use accurate sender identities and avoid impersonation, deception, phishing, fraud, unlawful promotions and prohibited content.
• Minimise message content and avoid unnecessary sensitive or confidential information.
• Apply appropriate access controls to accounts, API keys, contact files, templates and message history.
• Notify us promptly of suspected account compromise, data breach, unlawful use or recipient complaint.
• Respond to recipient-rights requests for data the customer controls and cooperate with us where our systems hold relevant processor data.

Who receives information

We do not sell personal data for money. We may disclose personal data only where reasonably necessary for the purposes described in this policy, including to the following categories:

Corporate events

If our business is reorganised, financed, merged, acquired, sold or transferred, relevant information may be disclosed under confidentiality and transferred as part of that transaction, subject to applicable law and continued protection.

Legal disclosures

We may preserve or disclose information where we reasonably believe disclosure is required by law, court order, regulatory direction or lawful process; necessary to protect rights, safety or property; or appropriate to investigate fraud, abuse, security incidents or unlawful messaging.

International data transfers

Messaging and cloud services may involve processing in countries other than the country where a customer or recipient is located. For example, WhatsApp Business Platform services, international SMS routes, cloud infrastructure, support providers and payment processors may operate across multiple jurisdictions.

Where required, we use legally recognised transfer mechanisms and safeguards, which may include adequacy decisions, contractual clauses, data-processing agreements, confidentiality duties, transfer-risk assessments, access controls, encryption and vendor due diligence.

Customers sending messages internationally are responsible for determining whether recipient data may lawfully be transferred to the relevant countries, networks and service providers.

Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including service delivery, security, fraud prevention, accounting, regulatory compliance, dispute resolution and enforcement.

Actual retention may be shorter or longer depending on the account plan, customer instruction, backup cycle, complaint, legal hold, fraud investigation, tax rule, regulatory requirement or technical necessity. When retention is no longer justified, data is deleted, securely disposed of, anonymised or aggregated.

Security safeguards

We use risk-based technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure, access, misuse or unauthorised processing.

Measures may include:

• HTTPS/TLS encryption for data in transit.
• Password hashing, secure sessions, CSRF protection and authentication controls.
• Role-based access, administrator restrictions and least-privilege practices.
• Encryption or protected storage for sensitive credentials and platform tokens.
• API-key hashing or restricted key storage, rate limiting and request authentication.
• Webhook-signature verification and replay, duplication or idempotency controls.
• Audit, login, API, webhook, wallet and security logging.
• Gateway isolation, credential restriction and suppression of provider secrets from customer-facing responses.
• Backups, monitoring, patching, incident response and recovery procedures.
• Vendor assessment, confidentiality obligations and data-processing agreements where appropriate.

No system is completely secure. Customers must protect their passwords, API keys, connected business assets and authorised devices, and must notify us immediately if they suspect unauthorised access.

Your privacy rights

Subject to applicable law, identity verification, exemptions and our role in the processing, you may have the following rights:

1. Request access to personal data we hold about you.
2. Request correction of inaccurate or incomplete information.
3. Request deletion where there is no continuing lawful reason to retain the information.
4. Request restriction of processing in qualifying circumstances.
5. Object to processing based on legitimate interests or to direct marketing.
6. Withdraw consent at any time where consent is the lawful basis.
7. Request data portability where applicable and technically feasible.
8. Ask for information about safeguards used for international transfers.
9. Complain to the Nigeria Data Protection Commission or another competent supervisory authority.
10. Request review of a decision based solely on automated processing where applicable law provides that right.

How to exercise a right

Contact us at support@bestbulksms.com.ng or through our contact page . Describe your request, the account or telephone number involved, the messaging channel and any information that helps us locate the record.

We may request proportionate information to verify your identity and protect data from unauthorised disclosure. We may also ask a customer to respond where that customer is the controller and we hold the relevant data only as its processor.

Authorised agents

Where law permits an authorised agent to make a request, we may require proof of authority and direct verification with the individual.

Messaging consent and opt-out

Opting out from a customer’s SMS

Follow the opt-out instruction in the message, reply with the instructed keyword where supported, or contact the sender directly. If the sender does not honour the request, contact us with the sender ID, recipient number, message date and a copy of the message so we can investigate.

Opting out from a customer’s WhatsApp messages

Tell the business to stop, use any provided opt-out method, block the business or use WhatsApp’s reporting controls. The customer must maintain the relevant suppression record and stop non-essential messages where required.

BestBulkSMS marketing

Account users may opt out of promotional communications from BestBulkSMS by using the unsubscribe method in the communication or contacting us. Service, security, billing, compliance and account notices may still be sent where necessary.

Cookies, sessions and analytics

We may use cookies, local storage and similar technologies for the purposes below.

• Strictly necessary: login sessions, security, load balancing, fraud prevention, preferences and requested features.
• Functional: interface settings, theme, language and other remembered choices.
• Analytics: understanding site use, performance, traffic sources and feature adoption where analytics is enabled and legally permitted.
• Security: bot detection, abuse prevention, device recognition and incident investigation.

You may control non-essential cookies through available consent tools or browser settings. Blocking necessary cookies may prevent login, wallet, API, messaging or security features from working correctly.

Children and minors

BestBulkSMS is a business messaging service and is not directed to children. Account holders must be legally capable of entering into the service agreement or be authorised by an organisation that is.

Customers messaging minors, parents, guardians, students or schools must comply with applicable age, consent, education, child-protection and safeguarding laws. Customers must not use WhatsApp or SMS to market age-restricted products to minors or otherwise violate platform rules.

If you believe a child’s personal data was submitted unlawfully, contact us so we can investigate and take appropriate action.

Automated processing

We may use automated rules to route messages, calculate segments and prices, deduct wallets, detect duplicates, enforce rate limits, flag suspicious activity, block prohibited requests, select configured network routes or synchronise delivery states.

These operational rules generally support service delivery, security and compliance and are not intended to make decisions that produce legal or similarly significant effects about recipients. Where applicable law grants a right regarding solely automated decision-making, you may contact us to request information or human review.

Security incidents and data breaches

We maintain procedures to identify, contain, investigate, document and remediate suspected security incidents. Where required, we notify affected customers, individuals, the Nigeria Data Protection Commission or another competent authority within the applicable legal timeframe.

Customers must promptly notify us of compromised credentials, exposed API keys, unlawful contact uploads, unauthorised WABA access, accidental recipient disclosure, phishing or other incidents involving the platform.

Incident communications may include the nature of the event, affected data, likely consequences, containment steps and recommended protective measures, subject to security and legal constraints.

Changes to this policy

We may update this policy to reflect changes in law, regulation, technology, services, vendors, messaging networks, Meta or WhatsApp requirements, security practices or business operations.

The updated policy will display a new “Last updated” date. Where a change materially affects rights or processing, we may provide an additional notice through the website, dashboard, email or another appropriate channel.

Previous versions may be retained for legal, audit and transparency purposes.

Contact, questions and complaints

The operator responsible for this policy is: