Data Processing Terms — Pratick Auth
Last updated: 20 July 2026
These Data Processing Terms ("DPT") form part of the Pratick Auth Terms of Service and apply where PRATICK ("Processor") processes personal data of end recipients on behalf of the Client ("Controller") in the course of providing the Services.
1. Scope and roles
The Controller submits end-recipient personal data (notably phone numbers and associated message metadata) through the API for the purpose of dispatching and verifying one-time passwords and transactional messages. For this data, the Client is the controller and Pratick is the processor. For account, KYC, billing, and platform security data, Pratick acts as an independent controller as described in its Privacy Policy.
2. Processing details
- Subject matter: dispatch and verification of authentication and transactional messages.
- Duration: the term of the Client's account, plus limited retention for billing and audit.
- Nature and purpose: transmission of messages to end recipients via SMS and supported channels; verification of codes; delivery tracking; billing.
- Data categories: phone numbers; message dispatch and delivery metadata; verification codes (stored hashed only).
- Data subjects: the Client's end users and message recipients.
3. Processor obligations
Pratick will: (a) process the data only on the Client's documented instructions, including as embodied in API calls, unless required otherwise by law; (b) ensure persons authorized to process the data are bound by confidentiality; (c) implement appropriate technical and organizational measures, including encryption in transit, hashed storage of verification codes with purge on use or expiry, access controls, key masking in logs, and tenant isolation; (d) assist the Client, insofar as reasonably possible, in responding to data subject requests and in meeting security and breach-notification obligations; (e) notify the Client without undue delay upon becoming aware of a personal data breach affecting the Client's data; and (f) at the Client's choice, delete or return the data at the end of the Services, subject to retention required by law.
4. Sub-processors
The Client authorizes Pratick to engage sub-processors necessary to provide the Services, including infrastructure/hosting providers and messaging/carrier partners for delivery in destination networks. Pratick will bind sub-processors to data protection obligations no less protective than these DPT and remains responsible for their performance. A current list of sub-processor categories is available on request; Pratick will provide notice of material changes, and the Client may object on reasonable data-protection grounds.
5. International transfers
Delivery of messages inherently requires transmission to carriers and channel providers in the destination country of each recipient. The Client instructs Pratick to perform such transfers as necessary for delivery. For other transfers, Pratick implements safeguards consistent with applicable data protection law.
6. Audit
Upon reasonable written request, no more than once per year, Pratick will make available information reasonably necessary to demonstrate compliance with these DPT, which may be satisfied through documentation, security summaries, or third-party attestations where available.
7. Client obligations
The Client warrants that it has a lawful basis for the processing it instructs, including any required consents from end recipients, and that its instructions comply with applicable law. The Client will not instruct processing that would cause Pratick to violate applicable data protection law.
8. Liability
Liability under these DPT is subject to the limitations set out in the Terms of Service, except where applicable data protection law provides otherwise.