GSMXCODE

1. Scope & Responsible Contact

1.1 About This Policy

This Policy applies to personal information processed in connection with the GSMXCODE website and associated customer-facing functions, including accounts, software, SaaS products, APIs, diagnostic and device-information services, subscriptions, transactions, digital fulfillment, and support communications. Certain products or integrations may have a separate privacy notice or additional terms, which should be read together with this Policy.

1.2 Brand and Controller Identity

“GSMXCODE,” “Platform,” and similar references identify the brand, website, or relevant digital service for readability. They do not, by themselves, identify a company as the domain owner, website-content owner, merchant of record, service provider, or data controller.

For a specific processing activity, the controller is the person or organization that determines the purposes and means of processing, as defined by applicable law. Where applicable law requires its legal name, postal address, contact details, a representative, or a data protection officer, that information must be disclosed in the applicable privacy notice or at the point of collection. A brand-only reference is not intended to replace a disclosure required by law.

1.3 Privacy Contact

1.4 Jurisdiction-Specific Rights

Available rights and legal obligations depend on the individual's location, the nature of the processing, the role of the relevant party, and the laws that apply. Where applicable, relevant collection notices and service-specific disclosures should provide the information required by those laws.

2. Information We Collect

2.1 Account & Identity Information

Depending on how you use the Platform, information may include:

• name or account-holder name, username, and email address;
• telephone number, country, or general location where provided;
• business or company details supplied by you;
• account credentials, authentication identifiers, and security settings; and
• verification information where reasonably required for security, a transaction, or compliance.

2.2 Transaction, Order & Cancellation Information

When you order a product or service, relevant records may include order ID, product or service selected, quantity, price, currency, payment status, provider transaction reference, subscription details, fulfillment status, refund history, and communications about the order.

To administer order handling and the 120-second cancellation window described in the applicable order and refund terms, records may include the order-placement timestamp, cancellation request timestamp, processing/fulfillment status, and whether a cancellation was accepted before fulfillment began.

2.3 Payment Information

Payment-card and bank details are generally collected and processed by the payment provider selected at checkout. Depending on the payment method, that provider may process billing, device, authentication, fraud-screening, and transaction information. The Platform may receive payment status, transaction references, payment method type, billing country or region, amount, currency, refund status, and risk or verification results. The exact information returned depends on the provider and integration.

2.4 Service, Device & Diagnostic Information

Depending on the purchased service, information submitted or generated may include technical parameters, configuration details, device model or identifiers, warranty or eligibility details, network-status information, diagnostic output, software/environment information, API inputs, and service results. Do not submit information you are not authorized to provide.

2.5 Support Communications

We may process support tickets, email and chat messages, attachments, screenshots, error reports, troubleshooting material, and records of steps taken to resolve an issue. Do not send passwords, complete payment credentials, private API keys, authentication secrets, or unnecessary sensitive information through ordinary support channels.

2.6 Technical, Usage & Security Information

2.7 Information From Other Sources

Where reasonably necessary, information may be received from payment and hosting providers, fraud-prevention or identity-verification services, technical suppliers, supported service partners, or other sources involved in delivering a requested service or protecting accounts and transactions.

3. How Information Is Collected

3.1 Directly From You

Information may be provided when you create or maintain an account, make a purchase, subscribe, configure API access, submit a device or service request, request support, communicate with the Platform, or voluntarily provide information.

3.2 Automatically

Technical, security, performance, session, and usage information may be recorded automatically as you use the website or a service, depending on the functionality and technologies actually enabled.

3.3 Through Service Providers

Third-party providers may collect information directly when you use their checkout, identity verification, authentication, security, communications, analytics, hosting, or infrastructure services. Those providers may act as independent controllers for some processing and are governed by their own notices and terms.

4. How We Use Information

Information may be used for the following purposes, to the extent relevant to the service and permitted by law:

Non-essential marketing or analytics processing, where used, must be handled consistently with applicable consent, notice, and opt-out requirements. Transactional messages are distinct from promotional communications.

5. Legal Bases

Where an applicable privacy law requires a legal basis, the basis depends on the processing activity and circumstances. It may include:

Where applicable law requires it, the collection notice should state the applicable legal basis and explain whether information is required for a contract or legal obligation and the consequences of not providing it.

6. Payments & Transaction Data

6.1 Payment Providers

The Platform may integrate independent payment processors, acquiring institutions, banks, card networks, or payment platforms. Such providers may separately collect and process payment and identity information under their own privacy notices and terms. The specific provider should be identified at checkout.

6.2 Information Returned to the Platform

Depending on the provider and method, the Platform may receive payment status, transaction ID, payment type, billing region, amount and currency, refund status, authentication outcome, and fraud or verification signals.

6.3 Transaction Records and Disputes

Relevant records may be retained for reconciliation, customer support, cancellations, refunds, chargebacks, fraud prevention, legal compliance, and dispute resolution. When responding to a payment dispute, relevant transaction, access, fulfillment, consent, cancellation, and support records may be provided to a payment provider where appropriate and lawful.

7. API & Technical Data

7.1 API Logs

When an API is used, technical information may be processed to authenticate, operate, secure, meter, and troubleshoot requests. Depending on the API, this may include account or credential identifiers, endpoint, request time, request count, response status, source IP address, technical headers, submitted parameters, and diagnostic output.

7.2 Customer-Submitted Data

Some APIs, SaaS products, diagnostics, and device-information services require technical inputs. Customers must have the legal right and authorization necessary to submit those inputs and must provide any required notices or obtain permissions from affected individuals where applicable.

7.3 Sensitive Credentials

Do not submit passwords, complete card details, private authentication secrets, or other sensitive information through an API unless the service expressly requires it and provides an approved secure mechanism.

7.4 API Security and Abuse

API and security logs may be used to detect unauthorized access, excessive usage, attempted attacks, fraud, abuse, and violations of documented technical restrictions. Logs should be accessed only by authorized personnel or providers for relevant operational, security, and legal purposes.

8. Sharing & Service Providers

Personal information may be disclosed to recipients where reasonably necessary for the purposes described in this Policy, as instructed by the relevant controller, or as permitted or required by law. Recipients may include:

8.1 Legal Disclosures

Information may be disclosed where required by law or lawful process, to respond to a lawful authority request, or to establish, exercise, or defend legal rights, subject to applicable law.

8.2 Security and Fraud

Information may be shared with relevant payment, security, service, or law-enforcement recipients where reasonably necessary to investigate fraud, unauthorized activity, security incidents, or threats, where legally permitted.

8.3 Business Transfers

If an actual business transfer, reorganization, or similar transaction occurs, information may be transferred only as permitted by law and subject to required notices or safeguards. This clause does not assert that any particular entity owns the website or its content.

8.4 Sale, Sharing, and Targeted Advertising

Personal information is not offered as a standalone data product. However, some privacy laws define “sale,” “sharing,” or targeted advertising more broadly than an exchange of data for money. The actual status depends on the technologies and integrations enabled. Where required, applicable notice, consent, and opt-out controls must be made available before relevant processing occurs. The operator should audit analytics, advertising pixels, and other third-party scripts to ensure this statement matches the live configuration.

9. Cookies & Similar Technologies

9.1 Essential Technologies

Depending on the functionality enabled, cookies, session identifiers, local storage, or similar technologies may be used for authentication, session management, security, essential preferences, checkout functionality, and other core Platform features.

9.2 Analytics and Performance

If analytics or performance tools are enabled, they may process usage and technical information to understand service performance, diagnose issues, and improve functionality. Any consent or notice required by law must be provided before the relevant non-essential technology is used.

9.3 Security Technologies

Security tools may use technical signals to identify automated attacks, suspicious activity, abuse, or unauthorized access.

9.4 Choices and Browser Controls

Most browsers provide controls for cookies and similar storage. Blocking essential technologies may impair account, checkout, or security functionality. Browser controls do not necessarily withdraw consent recorded through a separate consent tool. Where required, the Platform should offer an accessible way to manage or withdraw cookie consent.

10. Security

10.1 Safeguards

Appropriate technical and organizational measures should be used to protect personal information against unauthorized access, alteration, disclosure, loss, or destruction. Depending on the system and risk, measures may include TLS/HTTPS, authentication and access controls, logging, API protections, backup and recovery procedures, restricted access, monitoring, incident response, and supplier controls. This description is not a warranty that every measure is enabled in every system.

10.2 Limitations

No electronic transmission or storage system can be guaranteed absolutely secure. This does not exclude responsibilities that cannot legally be excluded or reduce any duty to implement legally required safeguards.

10.3 Security Incidents

Where a personal-data breach or security incident triggers a legal notification obligation, the responsible party will assess and make notifications within the timescales and to the recipients required by applicable law.

11. International Processing

Hosting, payment, security, communications, or technical providers may process information in countries other than the country where you reside. The actual locations depend on the providers and configurations in use.

11.1 Transfer Safeguards

Where applicable law restricts international transfers, the responsible party must use an available lawful transfer mechanism, such as an adequacy decision, approved contractual safeguards, or another recognized mechanism, and provide information about that mechanism when required.

11.2 Provider-Specific Processing

Payment, hosting, security, communication, and other providers may process information under their own notices and contractual arrangements. The relevant provider list and transfer locations should be kept current as integrations change.

12. Data Retention

Personal information should be kept only as long as reasonably necessary for the disclosed purposes, the service relationship, security, dispute handling, and legal obligations. Actual periods depend on the data category, system, and applicable law.

Where applicable law requires a specific retention period or criteria more detailed than these general principles, a category-specific schedule or point-of-collection notice should be provided. Do not publish specific time periods unless they match actual system settings and operational practice.

12.1 Deletion and Backups

When information is no longer required, it may be deleted, anonymized, or securely disposed of, subject to lawful retention needs, backups, technical limitations, legal holds, and dispute requirements. Where practical, deletion from backup media occurs through the applicable backup lifecycle.

13. Privacy Rights

Depending on where you live and which law applies, you may have rights to access or know about personal information, correct inaccuracies, request deletion, restrict or object to certain processing, receive portable information, withdraw consent, opt out of certain sale/sharing or targeted advertising, or appeal a decision on a privacy request.

13.1 How to Submit a Request

Email [email protected] with the request type and enough information to identify the relevant account or interaction. Do not send passwords or unnecessary sensitive documents. The responsible party may need to verify identity or authority before responding.

13.2 Authorized Agents

Where applicable law permits an authorized agent to submit a request, reasonable verification of the agent's authority and the individual's identity may be required.

13.3 Response and Appeals

Requests will be handled within applicable legal deadlines, subject to lawful extensions and exceptions. Where required, the response will explain any denial and describe available appeal or supervisory-authority complaint routes.

13.4 No Unlawful Discrimination

No person will be subjected to unlawful discrimination for exercising a privacy right protected by applicable law.

14. Children's Privacy

The Services are intended primarily for adults, professional users, and businesses. They are not knowingly directed to children where doing so would violate applicable law. The age at which parental consent or other special handling is required varies by jurisdiction.

If you believe a child has supplied personal information in circumstances where collection was not permitted, contact [email protected]. The request will be reviewed and handled as required by applicable law.

15. Automated Risk & Fraud Decisions

15.1 Risk Screening

The Platform or its payment and security providers may use automated tools to flag transactions or account activity that may indicate fraud, security concerns, abuse, or compliance risks. Relevant signals may include transaction history, account activity, technical and network indicators, request patterns, and provider-generated risk results.

15.2 Possible Outcomes

Risk controls may trigger additional verification, delayed processing, a payment decline, rate limits, or temporary access restrictions. Decisions should be proportionate to the risk and reviewed where appropriate. Automated screening should not be described as making a solely automated decision with legal or similarly significant effects unless that reflects the actual system.

15.3 Human Review and Rights

Where required by applicable law, information about significant automated decision-making, meaningful safeguards, human intervention, and available challenge mechanisms will be provided. You may contact [email protected] to raise a concern about a relevant decision.

16. Changes to This Privacy Policy

This Policy may be updated to reflect changes in the Services, technologies, provider integrations, processing activities, operational practices, or applicable legal requirements. The current version should be made available on the Platform.

16.1 Effective Date

The last-updated date is displayed below. A revision date does not mean that a new processing activity has been implemented or that a legal entity's ownership status has changed.

16.2 Material Changes

Where required or appropriate, material changes will be notified through the Platform, email, account notices, or another reasonable method. Where fresh consent is legally required, the update alone is not a substitute for obtaining that consent.

16.3 Continued Use

Continued use of the Platform does not override consent requirements or rights that cannot be waived by continued use under applicable law.

17. Contact