Last updated: 29 October 2026
Contents
1. Zero tolerance
Orbis Digital Ltd has a zero-tolerance approach to spam on Orbis SMS. Spam harms recipients, gets legitimate senders blocked and damages trust in business texting. It can also be unlawful.
This policy forms part of our Terms of Service and sits alongside our Acceptable Use Policy. It applies to every message sent from your account, whether through the portal or an API key. It is a summary, not legal advice. If you are unsure whether you can lawfully message someone, take advice before you send.
2. What counts as spam
For this policy, spam means any message that:
- is direct marketing sent without the consent or lawful basis the law requires;
- is sent to someone who has opted out or asked you to stop;
- hides or disguises who it is from, or gives no valid way to opt out;
- is sent to numbers that were bought, rented, scraped, guessed or generated; or
- is sent in a volume or pattern the recipient would not reasonably expect.
Direct marketing is wide. It covers selling, but also promoting your aims or ideals, such as a charity appeal, a newsletter or a survey with a promotional purpose.
3. The consent rules for SMS marketing
Marketing texts are controlled mainly by the Privacy and Electronic Communications Regulations 2003 (PECR). The UK GDPR also applies whenever you use personal data, such as a person's mobile number.
| Type of recipient | What PECR requires for marketing texts |
|---|---|
| Individual subscribers: members of the public, sole traders and partnerships | Regulation 22: you need their prior consent, unless the soft opt-in applies. You must also identify yourself and give a valid opt-out address (regulation 23). |
| Corporate subscribers: companies, LLPs, public bodies and other incorporated organisations | Regulation 22 does not apply, but regulation 23 does: you must not hide your identity and must give a valid opt-out address. If you text a named employee, the UK GDPR applies and they have an absolute right to object to direct marketing. |
Some partnerships count as corporate subscribers in law. Because it is often hard to tell, on Orbis SMS you must treat all sole traders and partnerships as individual subscribers. If a number could be a personal mobile, treat it as an individual's.
Consent
Consent must be freely given, specific, informed and unambiguous. It must be a clear positive action, such as ticking an unticked box or texting a keyword. It must name your business and cover marketing by text. It cannot be hidden in terms and conditions or be a condition of buying something unless genuinely needed. People must be able to withdraw it as easily as they gave it.
The soft opt-in
You may send marketing texts to an individual without consent only if all of these conditions are met:
- you got their number directly from them during a sale, or negotiations for a sale, of your products or services;
- you only market your own similar products or services;
- you gave them a clear, simple chance to refuse marketing when you collected their number; and
- you give them a simple way to opt out in every message.
Since the Data (Use and Access) Act 2025 (DUAA), charities can also use the soft opt-in. A charity may text a supporter without consent where it got their number directly from them when they expressed an interest in, or offered or gave support to, the charity's purposes; the message is only for furthering the charity's charitable purposes; and the person was given the chance to refuse when their details were collected and in every message since.
The soft opt-in never covers numbers you got from someone else.
Service messages and marketing
Genuine service messages are not marketing. Examples include one-time passcodes, appointment reminders, delivery updates and account notices. They do not need marketing consent, but you still need a lawful basis under the UK GDPR. If a service message also promotes something, such as an offer added to an appointment reminder, it becomes marketing and the rules above apply.
4. Bought and rented lists
You must not upload or message bought, rented, shared, scraped or harvested lists of numbers. The only exception is where every person on the list gave specific, valid consent to receive marketing texts from your business, named at the time they consented. Consent given to "selected partners" or "third parties" is not enough. If you cannot show this for every number, do not use the list.
5. Consent records
You must keep records that prove consent. For each recipient, record:
- who consented, and the number they gave;
- when they consented;
- how they consented, such as the web form, keyword or paper form used; and
- what they were told, including the exact wording shown to them.
Keep these records for as long as you message the person, and long enough afterwards to answer any complaint. You must give them to us promptly if we ask.
6. Opt-outs
- Every marketing message must include a free, simple way to opt out, such as "Reply STOP to opt out".
- When a recipient replies STOP, Orbis SMS automatically adds their number to your account's suppression list. Your account will not send further messages to that number.
- Suppression lists apply per account. A number that opts out from you is suppressed only for your account, and an opt-out given to another Orbis SMS customer does not apply to you.
- You must never re-add, re-import or otherwise try to message an opted-out number, unless that person later gives you fresh, specific consent and you keep a record of it.
- You must honour opt-outs given in any other way, such as by email, by phone, in person or through words like "unsubscribe" or "no more texts". Mark the contact as opted out or remove them from your lists promptly.
7. Frequency and relevance
Send only what people signed up for, and only as often as they would reasonably expect. Too many messages, or messages that have nothing to do with why the person gave you their number, cause complaints and opt-outs and can lead networks to block your sender ID. Keep your lists clean by removing numbers that fail to deliver or that you no longer have a reason to contact.
8. How we enforce this policy
- Approval. Accounts and sender IDs are manually reviewed and approved before sending. New accounts may have daily sending limits.
- Screening. Message content is automatically screened against risk rules for spam, scams and phishing. Flagged messages may be held for review by our team or blocked.
- Complaint thresholds. We monitor complaints, opt-out rates and delivery failures. If yours are high compared with normal business sending, or a network or regulator raises a concern, we will investigate and may ask for your consent records.
- Suspension. Where we reasonably suspect spam, we may suspend sending or your account immediately, lower your limits, withdraw sender IDs or close your account under the Terms. We may report serious or repeated breaches to the ICO and to networks.
9. How recipients can complain
If you have received a text you did not want, you can:
- contact the business that sent it and ask it to stop, or reply STOP if the message offers that;
- contact us at support@orbisdigital.co.uk or on 0330 223 7919 if it was sent through Orbis SMS. Tell us the sender name, the date and time and the message text. We acknowledge complaints within 2 working days and aim to resolve them within 10 working days;
- forward the text to 7726, free of charge, to report it to your mobile network; and
- complain to the ICO (or its successor, the Information Commission) at ico.org.uk or on 0303 123 1113.
10. Penalties under the law
Breaking PECR is serious. Under the DUAA, the maximum fines for breaching PECR are now aligned with those under the UK GDPR: up to £17.5 million or 4% of total annual worldwide turnover, whichever is higher. The regulator can also issue enforcement notices requiring you to stop. Individuals who suffer damage can claim compensation.
You are responsible for your own compliance. If your spam leads to fines, charges or claims against us, you must cover them as set out in the Terms.