Data Processing Agreement

1. Scope and parties

This Data Processing Agreement ("DPA") forms part of the Whautomate Terms and Conditions, or any other written agreement between Whautomate and the customer for use of the Whautomate platform (together, the "Agreement"). It applies whenever Whautomate processes Customer Personal Data on the customer's behalf while providing the service.

Whautomate is operated by two companies. The company that is party to this DPA, and acts as processor, depends on the region the customer's account was created in:

In this DPA, "Whautomate" means the applicable company above. By accepting the Agreement, the customer also accepts this DPA. No separate signature is required. Customers who need a countersigned copy can request one at [email protected].

2. Definitions

• Customer Personal Data: personal data that the customer, its team members or its own clients submit to, or that is collected through, the Whautomate service, and that Whautomate processes on the customer's behalf.
• Data Protection Laws: all data protection and privacy laws that apply to the processing, which may include the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Singapore Personal Data Protection Act 2012, India's Digital Personal Data Protection Act 2023, the Malaysia Personal Data Protection Act 2010, Brazil's Lei Geral de Proteção de Dados (LGPD), the UAE Federal Decree-Law No. 45 of 2021, the Saudi Arabia Personal Data Protection Law, and equivalent laws in other countries.
• Subprocessor: a third party engaged by Whautomate that processes Customer Personal Data in order to provide the service.
• Controller, processor, data subject, personal data, processing and personal data breach have the meanings given in the GDPR, or the equivalent terms (such as data fiduciary and data processor) in other Data Protection Laws.

3. Roles of the parties

The customer is the controller of Customer Personal Data and Whautomate is its processor. Where the customer itself acts as a processor for another business, Whautomate is a subprocessor and the customer confirms that its controller has authorised Whautomate's appointment on these terms.

Whautomate acts as an independent controller only for the limited personal data it needs to run its own business: account administration, subscription billing, signup fraud prevention, security logging and product analytics about how team members use the web app. That processing is covered by the Privacy Policy, not this DPA.

4. Whautomate's obligations

Whautomate will:

1. process Customer Personal Data only on the customer's documented instructions, which are the Agreement, this DPA and the customer's configuration and use of the service, unless the law requires otherwise (in which case Whautomate will tell the customer first, unless the law forbids it);
2. tell the customer promptly if it believes an instruction breaks Data Protection Laws;
3. make sure everyone authorised to process Customer Personal Data is bound by a duty of confidentiality;
4. apply the technical and organisational measures described in Annex 2, which may be updated as long as the overall level of protection does not decrease;
5. taking into account the nature of the processing, help the customer respond to data subject requests (access, correction, deletion, portability, objection and restriction). Most requests can be handled directly in the app, for example by editing or deleting a client record, or by running an export from Settings > Data Exports. If Whautomate receives a request directly, it will pass it to the customer and not respond itself, except to direct the data subject to the customer;
6. give the customer reasonable help with data protection impact assessments and consultations with supervisory authorities, where they relate to the customer's use of the service;
7. not sell Customer Personal Data, and not use it to train artificial intelligence models or for any purpose other than providing, securing and supporting the service.

5. Customer's obligations

The customer is responsible for:

• having a lawful basis, and any required notices and consents, for collecting Customer Personal Data and for sending messages to its contacts, including opt-in consent for WhatsApp, SMS and email marketing;
• the accuracy and lawfulness of the Customer Personal Data it submits and the instructions it gives;
• deciding whether the service is appropriate for any special category or sensitive data it chooses to store, such as health information in clinical notes, intake forms or body charts, and configuring team roles and access accordingly;
• keeping its own login credentials secure and managing which team members can access its account.

6. Subprocessing

The customer gives Whautomate general authorisation to engage subprocessors. The subprocessors in use at the date above are listed in Annex 3.

• Whautomate enters into a written agreement with each subprocessor that imposes data protection obligations no less protective than those in this DPA, to the extent applicable to the service the subprocessor provides.
• Whautomate will give at least 30 days' notice before a new subprocessor starts processing Customer Personal Data, by updating this page and notifying the account owner by email or in the app.
• The customer may object to a new subprocessor on reasonable data protection grounds by writing to [email protected] within that notice period. The parties will discuss the objection in good faith. If Whautomate cannot offer a reasonable alternative, the customer may stop using the affected part of the service or delete its account under section 10. Subscription fees are not refunded, as set out in the Agreement.
• Whautomate remains responsible for the performance of its subprocessors' obligations.

7. International transfers

Customer accounts are hosted in one of two regions, chosen when the account is created: India (Amazon Web Services, Asia Pacific Mumbai) for accounts in our India region, and Singapore (Amazon Web Services, Asia Pacific Singapore) for all other accounts. Some subprocessors process data in other countries, as listed in Annex 3.

Where Customer Personal Data is transferred out of a country whose laws restrict such transfers, Whautomate relies on a valid transfer mechanism. For transfers from the European Economic Area, Switzerland or the United Kingdom, the parties agree to the European Commission's Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, as applicable), together with the UK International Data Transfer Addendum where UK data is involved. These clauses are incorporated into this DPA by reference, with Annex 1 and Annex 2 of this DPA completing their appendices. Whautomate also relies on equivalent safeguards, such as the subprocessors' own Standard Contractual Clauses or adequacy decisions, for its onward transfers.

8. Personal data breaches

Whautomate will notify the customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as is known at the time, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken or proposed. Whautomate will take reasonable steps to contain the breach and will provide further information as it becomes available. Notifying a breach is not an admission of fault.

9. Audits and information

On request, Whautomate will make available the information reasonably needed to demonstrate compliance with this DPA, including written answers to security questionnaires and a description of its security practices and the measures in Annex 2. If that information is not enough to satisfy a requirement of Data Protection Laws or a supervisory authority, the customer, or an independent auditor it appoints that is bound by confidentiality, may carry out an audit, no more than once a year, with at least 30 days' written notice, during business hours, at its own cost and subject to reasonable confidentiality and security conditions. Audits will not give access to other customers' data.

10. Return and deletion

During the subscription, the customer can export its data at any time from Settings > Data Exports, and should do so before deleting its account.

The customer can delete its account at any time, either itself from the app or by asking Whautomate at [email protected] to delete it. When an account is deleted, access ends immediately: team members are signed out and connected channels are disconnected. Customer Personal Data is then permanently deleted from Whautomate's active systems within 30 days, unless the law requires it to be kept for longer. The same applies when the Agreement ends for any other reason. Copies in backups are deleted as those backups expire in the normal backup cycle and are protected by this DPA until then.

11. Customer-enabled third-party services

The service lets the customer connect its own accounts with third-party providers, such as AI providers using the customer's own API key, calendars, e-commerce platforms and automation tools. When the customer connects one of these services, data is shared with that provider on the customer's instructions and under the customer's own agreement with that provider. These providers are not Whautomate subprocessors, and Whautomate is not responsible for their processing. They are listed in Annex 3, Part B for transparency.

12. General terms

• This DPA lasts for as long as Whautomate processes Customer Personal Data under the Agreement.
• If this DPA conflicts with the Agreement, this DPA prevails for matters of data protection. If it conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail.
• Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws do not allow this.
• This DPA is governed by the same law, and disputes go to the same courts, as the Agreement, except where the Standard Contractual Clauses require otherwise.
• Whautomate may update this DPA to reflect changes in law or in the service. Changes that reduce the protection of Customer Personal Data will not apply without the customer's agreement.

Annex 1: Details of processing

Annex 2: Security measures

Infrastructure and encryption

• Production systems run on Amazon Web Services in the account's region, on private networks with no public web ports. Web traffic reaches the application only through Cloudflare over HTTPS (TLS 1.2 or higher).
• Server disks and database volumes are encrypted at rest. Integration credentials and API keys stored for customers are encrypted at the application level.
• Databases are backed up regularly, and backups are encrypted.
• Cloudflare web application firewall, DDoS protection and bot challenges protect public endpoints.

Access control

• Every account's data is isolated from other accounts by server-side tenant checks, and every data class has an enforced access-control policy.
• Team members get role-based access within the customer's account. Two-factor authentication, account lockout after repeated failed logins and session expiry are supported.
• Access to production systems by Whautomate personnel is limited to those who need it, uses individual SSH keys and is logged.

Application security

• Rate limiting on login, OTP, media and public endpoints; signature verification on inbound webhooks from messaging and payment providers.
• Public pages read business data only through server-side functions that return the minimum fields needed.
• Activity logs record key account actions.

Operations

• Infrastructure monitoring and alerting, with an incident response process covering breach notification under section 8.
• Code changes are reviewed before release, and production is deployed only from a controlled release branch.
• Personnel are bound by confidentiality obligations.

Annex 3: List of subprocessors

Part A: Subprocessors

These providers process Customer Personal Data on Whautomate's behalf to deliver the service.

Part B: Customer-enabled third-party services

These providers receive data only when the customer connects them to its account, under the customer's own agreement with the provider (see section 11). They are not Whautomate subprocessors.