Data Processing Agreement

This data processing agreement (“DPA”) applies between the customer as controller (“Controller”) and Widchat, owner Kilian Hauber, Am Rosengarten 18B, 79183 Waldkirch, Germany, as processor (“Processor”). It becomes part of the main contract for the use of Widchat when the Terms of Service are accepted. A signed copy is available on request.

1. Subject matter and duration

1.1 The Processor processes personal data on behalf of the Controller to provide the Widchat software under the main contract.

1.2 This DPA applies for the term of the main contract and beyond for as long as the Processor processes the Controller’s data.

2. Nature, purpose and scope of processing

Nature of processing	Storing, receiving, sending, displaying, automated processing according to flows set up by the Controller, exporting and deleting
Purpose	Communication between the Controller and its contacts via WhatsApp and other connected channels, automation of this communication, collaboration in teams
Types of data	Phone numbers and channel IDs, profile names, message content and media, timestamps and delivery status, answers and variables from flows, attributes and notes stored by the Controller, consent and opt-out status
Data subjects	The Controller’s contacts (customers, prospects, applicants and others communicating via connected channels); for agencies also employees and contacts of end clients

Special categories of personal data (Art. 9 GDPR) should only be processed if the Controller has a legal basis and takes appropriate safeguards.

3. Instructions

3.1 The Processor processes the data only on documented instructions from the Controller unless required to do so by law. Instructions are the main contract, the Controller’s settings and actions in Widchat and instructions in text form.

3.2 If the Processor considers an instruction unlawful, it informs the Controller without delay and may suspend execution until the Controller confirms or changes it.

4. Obligations of the Processor

4.1 The Processor commits all persons with access to the data to confidentiality.

4.2 It implements the technical and organisational measures under Art. 32 GDPR described in Annex 1. It may develop them further as long as the level of protection does not decrease.

4.3 It assists the Controller to a reasonable extent with data subject requests, personal data breach notifications, data protection impact assessments and consultations with the supervisory authority. Data subject requests received by the Processor are forwarded to the Controller without delay.

4.4 It notifies the Controller of personal data breaches without undue delay, where possible within 48 hours of becoming aware, with the information required by Art. 33(3) GDPR as far as available.

4.5 It does not use the data for its own purposes, in particular not for advertising, profiling or training AI models.

5. Sub-processors

5.1 The Controller approves the sub-processors listed in Annex 2. The Processor may engage additional or different sub-processors if it informs the Controller in text form at least four weeks in advance. The Controller may object within this period for an important data protection reason. If the parties cannot agree, the Controller may terminate the main contract as of the change.

5.2 The Processor contractually binds sub-processors to an equivalent level of protection.

5.3 Meta: The Controller (or its end client) concludes the contract for the WhatsApp Business Platform directly with Meta. Meta is therefore not a sub-processor of the Processor. Processing by Meta is governed by the agreements between the Controller and Meta.

6. Agencies

Where an agency uses Widchat for its end clients, the agency is the Controller towards the Processor. If the agency is itself a processor for its end client, the Processor acts as its sub-processor. The agency ensures that its contract with the end client permits the use of Widchat and passes the end client’s instructions and requests on to the Processor.

7. Transfers to third countries

The Processor processes the data in Germany or the EU. Transfers to third countries take place only as stated in Annex 2 and where the requirements of Art. 44 et seq. GDPR are met.

8. Audits

On request, the Processor demonstrates compliance with its obligations through suitable documentation, for example descriptions of its measures or certificates of its sub-processors. In addition, the Controller may carry out audits itself or through an auditor bound to confidentiality, with reasonable notice (as a rule at least 30 days), during business hours and without disproportionate disruption of operations. The Controller bears the costs of on-site audits.

9. Deletion and return

After the main contract ends, the Controller can export its data for 30 days. The Processor then deletes the data, including copies, unless legally required to keep it. Data in backups is deleted when the backups are regularly overwritten, after 30 further days at most.

10. Liability and precedence

Liability is governed by Art. 82 GDPR and otherwise by the liability provisions of the main contract. In case of conflict between this DPA and the main contract, this DPA prevails on data protection matters.

Annex 1: Technical and organisational measures

Confidentiality

• Hosting in certified data centres of Hetzner Online GmbH in Germany (ISO 27001) with physical access control by the operator
• Server access only via SSH keys; administrative accounts protected with two-factor authentication
• Role and permission model in the application; every record belongs to a workspace and is visible only to its authorised users
• Database not reachable from the internet
• Passwords stored only as cryptographic hashes; Meta access tokens stored encrypted with AES-256

Integrity

• All transfers encrypted (TLS)
• Signature verification of all incoming webhooks from Meta
• Logging of sign-ins and important changes

Availability and resilience

• Daily database backups, kept for 30 days at most
• Protection against denial-of-service attacks via Cloudflare
• Service monitoring and automatic restarts

Regular review

• Regular security updates of operating system, database and dependencies
• Review of these measures at least annually and after significant changes

Sub-processors

Annex 2: List of approved sub-processors.

Provider	Service	Location of processing	Safeguard for third countries
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany	Servers, database, backups	Germany	–
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA	DNS, reverse proxy, attack protection (connection data, encrypted traffic)	EU and worldwide	EU-U.S. Data Privacy Framework, Standard Contractual Clauses

Providers for email delivery and payment processing will be added to this list once they are in use, and customers will be informed under section 5.1.