Data Processing Agreement

1Parties and scope

This Data Processing Agreement (the “DPA”) is made between [COMPANY LEGAL NAME], a [LEGAL FORM] with a share capital of [SHARE CAPITAL], registered office at [REGISTERED ADDRESS], RC [RC NUMBER], ICE [ICE NUMBER] (“relay”, “we”), and the organization that subscribes to relay (the “Customer”, “you”).

It forms part of the Terms of Use (the “Terms”) and applies whenever we process personal data on your behalf through the service: the web inbox, the REST API and webhooks. Where this DPA and the Terms differ on the protection of personal data, this DPA prevails.

It does not cover the personal data of the account owner, such as their name, email address and billing details. We process that data as controller, under our Privacy Policy.

2Definitions

GDPR

Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data.

Law 09-08

Moroccan law no. 09-08 on the protection of individuals with regard to the processing of personal data, and its implementing texts.

Data Protection Law

The GDPR, Law 09-08 and any other personal data law that applies to the processing.

Customer Data

The personal data we process on your behalf through the service, described in Annex I: in essence, the WhatsApp messages, media and identifiers of the people your numbers talk to.

Sub-processor

A third party we engage to process Customer Data for the service.

Personal Data Breach

A breach of security leading to the accidental or unlawful destruction, loss or alteration of Customer Data, or to its unauthorised disclosure or access.

Controller, processor, data subject, processing and supervisory authority have the meaning given in the GDPR.

3Roles of the parties

For Customer Data, you are the controller and relay is your processor. If you use relay on behalf of your own client, you act as its processor and relay as your sub-processor: you remain our only contact and pass your client's instructions on to us.

You are responsible for the lawfulness of the processing you instruct, in particular for:

• having a legal basis to process the messages and identifiers of the people your numbers talk to;
• informing those people as Data Protection Law requires;
• using your WhatsApp numbers in line with WhatsApp's own terms and with our Acceptable Use Policy.

Data you retrieve through the API or receive through webhooks leaves our systems at your request. From then on, your own systems and providers are responsible for it.

WhatsApp is not our sub-processor: your numbers use WhatsApp under your own relationship with WhatsApp and its terms. [COUNSEL TO CONFIRM THIS POSITION]

4Subject matter, duration, nature and purpose

Subject matter

Providing the relay service: linking your WhatsApp numbers as linked devices, showing their chats in the web inbox, and giving access to the same numbers through the REST API and webhooks.

Duration

As long as your subscription runs, then until the data is deleted as set out in section 13.

Nature

Receiving, storing, displaying, searching and sending messages; importing past chats within your plan's window; downloading media; delivering API responses and webhooks; deleting.

Purpose

Only to provide the service to you and keep it secure. We do not process Customer Data for our own purposes.

5Data subjects and categories of data

Annex I sets out the details. In summary:

5.1Data subjects

• the WhatsApp contacts your numbers exchange messages with;
• the participants of the groups your numbers belong to;
• any person named or shown in messages or media.

5.2Categories of data

• messages: text, captions, replies, edits and deletions;
• media: images, video, documents and voice notes;
• phone numbers and WhatsApp identifiers;
• contact names, group names, group membership and roles;
• timestamps, delivery and read status, and reactions.

We do not ask for special categories of data. They may still appear in messages your contacts send you; how you handle them is your decision as controller.

6Instructions

We process Customer Data only on your documented instructions. They consist of the Terms, this DPA and the actions you take in the service: connecting or deleting a number, sending a message, calling the API, setting up a webhook, changing your plan.

If we believe an instruction infringes Data Protection Law, we tell you without delay, and we may suspend it until you confirm or change it.

If the law of the European Union, of a member state or of Morocco requires us to process Customer Data in another way, we tell you before doing so, unless that law forbids it.

7Confidentiality

Only the people who need access to run, support or secure the service can reach Customer Data, and each of them is bound by a duty of confidentiality [STAFF CONFIDENTIALITY TERMS].

Administrative actions on the service are recorded in an audit log. Logs, error reports and analytics carry identifiers, counts and codes only: never message bodies, phone numbers, names or media.

8Security

We apply the technical and organisational measures listed in Annex II. We keep them up to date as risks and technology change, without lowering the overall level of protection.

You are responsible for the security of what you control: your account credentials, your API keys and their scopes, and the endpoints that receive your webhooks.

9Sub-processors

You give us a general authorisation to engage sub-processors. The current list is on the Sub-processors page, which forms Annex III.

We tell you at least [SUB-PROCESSOR NOTICE PERIOD] before adding or replacing a sub-processor, by email to the organization owner and on that page. You may object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may end the affected service [REFUND POLICY].

Each sub-processor is bound in writing by obligations that protect Customer Data at least as well as this DPA. We remain responsible to you for their performance.

10International transfers

Customer Data is stored in the European Union, in Frankfurt, Germany: on DigitalOcean servers (FRA1) and, for media files and data exports, in a private Google Cloud bucket (europe-west3).

Requests to the service, including the Customer Data they carry, pass through Cloudflare's global network in transit and may be handled outside the European Economic Area [CONFIRM REGION].

When Customer Data is processed outside the European Economic Area, by a sub-processor or by our own staff [STAFF LOCATIONS], the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses [TRANSFER MECHANISM].

Where Customer Data is sent from or accessed from Morocco, we follow Law 09-08 and the rules of the CNDP on transfers [CNDP TRANSFER AUTHORIZATION]. Our CNDP declaration number is [CNDP NUMBER].

11Assistance

11.1Requests from data subjects

The service lets you handle most requests yourself: you can find a person's chats with search, read their messages and media in the inbox, retrieve them through the REST API, and download all Customer Data at once with the self-serve export described in section 13.

For what you cannot do yourself, such as erasing one person's data from a number you keep, we help on request [ERASURE PROCESS], within [RESPONSE TIME].

If a data subject contacts us directly about Customer Data, we pass the request on to you and do not answer it ourselves, unless you ask us to.

11.2Impact assessments and authorities

We give you the information you reasonably need, as far as it concerns the service, for a data protection impact assessment or a prior consultation with a supervisory authority such as the CNDP.

12Personal data breaches

We notify you of a Personal Data Breach affecting Customer Data without undue delay, and in any case within [HOURS] hours of becoming aware of it, by email to the organization owner.

The notice describes, as far as we know at the time:

• the nature of the breach, and the categories and approximate number of data subjects and records concerned;
• its likely consequences;
• the measures taken or proposed to address it and limit its effects;
• who to contact for more information.

We add what we learn as the investigation goes on. Notifying the supervisory authority and the people concerned remains your decision as controller; we help you do it.

13Deletion and return of data

Retention follows your plan. Every night, messages and media older than your plan's window are deleted.

Past chats imported when you link a number are capped to the same window.

Deleting a number permanently deletes its chats, messages and media and logs the number out of WhatsApp. Deleting your organization, in Settings › Data & privacy, does the same for every number, and also deletes its API keys, webhooks and data exports. The owner's user account is kept until the owner deletes it in Settings; the Privacy Policy covers it.

When your subscription ends, we delete the organization's Customer Data within [END-OF-SUBSCRIPTION DELETION PERIOD], unless the law requires us to keep it.

Until then, the owner can download all Customer Data from Settings › Account & security › Export my data: one ZIP file with every number's chats, contacts and messages, the list of its media and the media files still stored, in JSON and JSON Lines. We email the owner when it is ready; it is downloaded from Settings while signed in, through a link that works for 5 minutes, and deleted 7 days after it is built. One export runs at a time, at most one every 24 hours. You can also retrieve the data through the REST API. Copies in backups are deleted within [BACKUP RETENTION PERIOD].

14Audits and information

We make available the information you need to show compliance with Article 28 of the GDPR: this DPA, the Security page, and answers to reasonable security questionnaires.

You may audit our compliance yourself, or through an independent auditor bound by confidentiality, on these terms: [AUDIT TERMS].

15Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms. Nothing in this DPA limits a party's liability where Data Protection Law does not allow it.

16Term, changes and governing law

This DPA applies as long as we process Customer Data, and ends once that data is deleted.

We may update this DPA to follow changes in the law or in the service. We announce material changes [NOTICE PERIOD] in advance, and each version carries its effective date.

This DPA is governed by the law and courts set out in the Terms: [GOVERNING LAW AND COURTS].

17Annex I: Processing details

18Annex II: Technical and organisational measures

The measures in place today. Items in brackets are still to be documented.

19Annex III: Sub-processors

The Sub-processors page lists every provider we use, with what each one does and where. The providers on that list that process Customer Data, as updated under section 9, form this annex.

Customer Data itself is stored by DigitalOcean (servers and databases) and Google Cloud (the media bucket), both in Frankfurt, Germany, and passes in transit through Cloudflare, which protects and delivers every address of the service. Providers that handle only the account owner's own data, such as billing and account email, are covered by the Privacy Policy.

If you turn on the proxy add-on, a number's traffic passes through a proxy in that number's country, run by [PROXY PROVIDER]. [CONFIRM THAT TRAFFIC STAYS ENCRYPTED END TO END THROUGH THE PROXY]

20Acceptance and signature

You accept this DPA together with the Terms when you subscribe; it applies without a signature.

If your organization needs a countersigned copy, ask us and we send it to you for signature [SIGNATURE PROCESS].

20.1The Customer (Controller)

20.2relay (Processor)

We reply from support@wrelay.site.

21Contact

Write to us about this DPA, a sub-processor change or a request from one of your contacts.