Data Processing Addendum

“Personal Data”, “Processing”, “Controller”, “Processor”, “Sub-Processor”, and “Data Subject” have the meanings set out in the GDPR (EU 2016/679). “Data Fiduciary” and “Data Principal” have the meanings set out in DPDP 2023.

The Customer is the Controller / Data Fiduciary with respect to Personal Data of its End Users. Waxiomatic is the Processor / Data Processor.

The subject matter is the processing necessary to provide the Service. Duration coincides with the Customer's subscription, plus 30 days for data export, then deletion as set out in our Privacy Policy.

Data subjects: End Users of the Customer's WhatsApp Business Account (typically the Customer's own customers, leads, or contacts).

Categories of personal data: phone number (E.164), display name, email address (where provided), WhatsApp message content and metadata, opt-in / opt-out consent records, contact tags + custom attributes uploaded by the Customer.

The Customer must not transmit special-category data (health, biometric, genetic, sexual orientation, political opinion, religious belief, trade union membership) or financial data subject to PCI DSS through the Service unless covered by a separate compliance addendum.

Waxiomatic will:

• Process Personal Data only on the Customer's documented instructions (the Terms + this DPA constitute those instructions);
• Ensure persons authorised to process Personal Data are subject to confidentiality;
• Implement the technical and organisational measures listed in §8 below;
• Engage Sub-Processors only with prior notice as set out in our Privacy Policy and with equivalent contractual obligations;
• Assist the Customer with Data Subject requests, security incidents, and Data Protection Impact Assessments (DPIAs);
• Delete or return Personal Data at the end of the subscription as required by the Customer (default: delete after 30-day export window);
• Provide reasonable information to demonstrate compliance with this DPA.

The Customer authorises the Sub-Processors listed in our Privacy Policy §6. We will give 30 days' notice (via dashboard banner + email to the Customer's billing contact) before adding any new Sub-Processor. The Customer may object in writing within 14 days; if the objection is reasonable and unresolved, either party may terminate the affected portion of the Service.

For transfers of EU/UK Personal Data outside the EEA/UK to our Sub-Processors, we rely on Standard Contractual Clauses (SCCs) (Commission Decision 2021/914, Module 2 or 3 as applicable) plus appropriate supplementary measures. The SCCs are incorporated into this DPA by reference.

We maintain at least the following:

• TLS 1.3 in transit; AES-256 at rest.
• Row-level security (Postgres RLS) enforcing per-tenant data isolation.
• WhatsApp access tokens and integration credentials encrypted at rest with libsodium sealed boxes; per-organization key derivation.
• HMAC-SHA256 on outbound webhooks; timestamp replay protection.
• Scoped API keys with last-used IP recorded; revocation UI in the dashboard.
• SAST + dependency vulnerability scans on every CI build; manual security review for high-risk changes.
• Annual third-party penetration test (most recent report available on request under NDA).
• Encrypted off-site backups; documented disaster-recovery runbook.
• Audit logging of access to production Customer data; principle of least privilege.

We will notify the Customer of any confirmed Personal Data Breach affecting their data within 72 hours of becoming aware, including the nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and remediation steps taken.

The Customer may, no more than once per year and at its own cost, audit our compliance with this DPA — by reviewing our SOC 2 / pen-test reports (when issued) under NDA, or by submitting a written questionnaire we will answer in good faith within 30 days.

Liability under this DPA is subject to the Limitation of Liability clause in the Terms. If there is a conflict between this DPA and the Terms, this DPA controls for matters relating to processing of Personal Data.

This DPA is accepted when you sign up for the Service, by your continued use of the Service, or — for enterprise customers — by signing it as part of the order form.