dpa

Data Processing Agreement (DPA)

**Last Updated:** March 6, 2025

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Flowziac Technologies Private Limited ("Processor") and the customer ("Controller") regarding the processing of personal data through Flowziac's WhatsApp automation platform and services ("Services"). This DPA is effective as of the date of acceptance of the Terms of Service.

1. Definitions

**1.1 "Applicable Data Protection Law"** means:

• The GDPR (Regulation (EU) 2016/679) where applicable
• The UK Data Protection Act 2018
• The California Consumer Privacy Act (CCPA)
• The Personal Data Protection Act (PDPA) of Singapore
• Any other national data protection legislation applicable to the Controller's business

**1.2 "Controller"** means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

**1.3 "Data Subject"** means an identified or identifiable natural person whose personal data is processed.

**1.4 "GDPR"** means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

**1.5 "Personal Data"** means any information relating to a Data Subject that is processed by Processor on behalf of Controller through the Services.

**1.6 "Processing"** means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

**1.7 "Processor"** means Flowziac Technologies Private Limited, the natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Controller.

**1.8 "Security Incident"** means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

2. Roles and Responsibilities

2.1 Controller Responsibilities

The Controller shall:

• Determine the lawful basis for processing personal data
• Provide appropriate privacy notices to Data Subjects
• Obtain necessary consents from Data Subjects
• Handle Data Subject rights requests
• Ensure its instructions to Processor comply with Applicable Data Protection Law
• Notify Processor of any changes to processing instructions

2.2 Processor Responsibilities

Processor shall:

• Process personal data only on documented instructions from Controller
• Implement appropriate technical and organizational measures
• Maintain confidentiality of personal data
• Assist Controller with data subject rights requests
• Assist Controller with data protection impact assessments
• Notify Controller of any Security Incidents
• Delete or return personal data upon termination
• Maintain records of processing activities
• Cooperate with supervisory authorities

3. Instructions for Processing

3.1 Scope of Processing

Processor is authorized to process personal data solely to:

• Provide the Services as described in the Terms of Service
• Store and transmit messages through WhatsApp Business API
• Generate analytics and reports for Controller
• Maintain and improve platform functionality
• Fulfill legal and regulatory obligations

3.2 Instructions

Controller's initial instructions are set forth in the Terms of Service and Service documentation. Controller may provide additional instructions through:

• Account configuration settings
• API calls
• Written instructions from authorized representatives

Processor will not process personal data for any other purpose without Controller's prior written authorization.

3.3 International Data Transfers

Personal data may be transferred to and processed in countries outside the Controller's jurisdiction, including India, the United States, and other locations where Processor's service providers operate. Processor ensures appropriate safeguards for such transfers:

• EU Standard Contractual Clauses (SCCs) as approved by the European Commission
• UK International Data Transfer Agreement (IDTA) where applicable
• Adequacy decisions from relevant authorities
• Other legally recognized transfer mechanisms

4. Security Measures

4.1 Technical and Organizational Measures

Processor implements and maintains appropriate technical and organizational measures to protect personal data, including:

4.1.1 Access Controls

• Role-based access control (RBAC)
• Multi-factor authentication (MFA)
• Principle of least privilege
• Regular access reviews

4.1.2 Data Protection

• Encryption in transit (TLS 1.2+)
• Encryption at rest (AES-256)
• Database encryption for sensitive fields
• Secure key management

4.1.3 Infrastructure Security

• Cloud provider security controls (AWS, etc.)
• Network segmentation and firewalls
• Regular security patches and updates
• Vulnerability scanning and penetration testing
• DDoS protection

4.1.4 Monitoring and Logging

• Comprehensive audit logging
• Real-time security monitoring
• Intrusion detection systems
• Log retention for 12 months

4.1.5 Data Management

• Regular backups with encryption
• Backup retention policies
• Secure data deletion procedures
• Data minimization practices

4.1.6 Personnel

• Background checks for employees
• Regular security and privacy training
• Confidentiality agreements
• Need-to-know access principles

4.1.7 Incident Response

• 24/7 security monitoring
• Incident response plan
• Regular security drills
• Designated security team

4.2 Regular Assessment

Processor will:

• Conduct annual security assessments
• Perform penetration testing at least annually
• Review and update security measures regularly
• Document security controls and procedures

5. Sub-processors

5.1 Authorized Sub-processors

Processor may engage sub-processors to assist in providing the Services. Current sub-processors include:

| Sub-processor | Services | Location | Data Transfer Mechanism |

|---------------|----------|----------|------------------------|

| Amazon Web Services (AWS) | Cloud hosting | USA/Global | SCCs |

| Google Cloud Platform | Analytics, monitoring | USA/Global | SCCs |

| WhatsApp (Meta) | Message delivery | USA/Global | SCCs |

| Paddle | Billing & subscriptions | USA/Global | SCCs |

| SendGrid/Mailgun | Email notifications | USA | SCCs |

5.2 New Sub-processors

Processor will notify Controller at least 30 days before engaging any new sub-processor. Controller may object to such engagement in writing within 15 days of notification, providing reasonable grounds for objection. If Controller objects, Processor will either not engage the sub-processor or provide alternative arrangements.

5.3 Sub-processor Obligations

All sub-processors are bound by written agreements that impose:

• Data protection obligations equivalent to those in this DPA
• Liability for breaches
• Audit rights for Processor and Controller
• Confidentiality requirements

Processor remains liable to Controller for sub-processor compliance.

6. Data Subject Rights

6.1 Assistance Obligations

Processor shall provide reasonable assistance to Controller to fulfill its obligations under Applicable Data Protection Law regarding Data Subject rights, including:

• Right to access personal data
• Right to rectification of inaccurate data
• Right to erasure (right to be forgotten)
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

6.2 Request Handling

Upon receiving a Data Subject request from Controller, Processor will:

• Respond within the timeframe specified by Controller (minimum 30 days)
• Implement the requested action (access, deletion, restriction, etc.)
• Provide data in a structured, commonly used, machine-readable format for portability requests
• Notify Controller of any inability to comply with legal grounds

6.3 Direct Requests

If Processor receives a Data Subject request directly, it will:

• Notify Controller within 48 hours
• Forward the request to Controller
• Cooperate with Controller to fulfill the request
• Not disclose personal data directly to Data Subject without Controller's authorization

7. Security Incident Notification

7.1 Notification Requirements

Processor will notify Controller without undue delay and in any event within 72 hours of becoming aware of a Security Incident affecting personal data.

7.2 Notification Content

The notification will include:

• Nature of the Security Incident
• Categories and approximate number of Data Subjects affected
• Likely consequences of the incident
• Measures taken or planned to mitigate harm
• Contact point for further information

7.3 Cooperation

Processor will:

• Investigate and remediate the incident promptly
• Provide regular updates to Controller
• Assist Controller with any required notifications to Data Subjects or supervisory authorities
• Document the incident and response actions

8. Data Protection Impact Assessments (DPIA) and Prior Consultation

8.1 DPIA Assistance

If Controller is required to conduct a DPIA under Applicable Data Protection Law, Processor will provide reasonable assistance, including:

• Information about processing operations
• Security measures implemented
• Risk assessments
• Recommendations for risk mitigation

8.2 Prior Consultation

If Controller is required to consult a supervisory authority prior to processing, Processor will cooperate with such consultation and provide necessary information.

9. Data Deletion and Return

9.1 Upon Termination

Upon termination of the Terms of Service or upon Controller's request, Processor will:

• Cease all processing of personal data
• Delete all personal data from active systems within 30 days
• Provide written certification of deletion
• Delete personal data from backup systems within 90 days (or as required by law)

9.2 Retention Beyond Deletion

Processor may retain personal data longer if required to:

• Comply with legal obligations
• Resolve disputes
• Enforce agreements
• Maintain backup copies as per retention policy

Such retained data will remain subject to this DPA and will be deleted as soon as retention is no longer required.

10. Audit Rights

10.1 Audit Rights

Controller may audit Processor's compliance with this DPA:

• Once per calendar year at Controller's expense
• Upon reasonable prior notice (minimum 30 days)
• During normal business hours
• In a manner that minimizes disruption to Processor's operations

10.2 Scope of Audit

The audit may include:

• Review of security documentation and policies
• Inspection of security controls and systems
• Interviews with personnel
• Review of sub-processor agreements
• Examination of records of processing activities

10.3 Alternative: Third-Party Certifications

Instead of an audit, Controller may accept:

• SOC 2 Type II report
• ISO 27001 certification
• Other recognized security certifications
• Questionnaires and attestations

Processor will provide such documentation upon request.

10.4 Confidentiality

Audit findings are confidential and may only be shared with Controller's advisors and as required by law.

11. Records of Processing Activities

11.1 Maintenance

Processor maintains records of processing activities performed on behalf of Controller, including:

• Categories of personal data processed
• Purposes of processing
• Categories of Data Subjects
• Categories of recipients (including sub-processors)
• International transfers and safeguards
• Retention periods
• Security measures

11.2 Access

Controller may access these records upon reasonable request to verify Processor's compliance with this DPA.

12. Confidentiality

12.1 Personnel Confidentiality

Processor ensures that all personnel with access to personal data are bound by confidentiality obligations.

12.2 Business Confidentiality

Both parties agree to keep confidential all information disclosed in connection with this DPA, except as required by law or to fulfill obligations under this DPA.

13. Liability and Indemnification

13.1 Liability Cap

Processor's total liability for any breach of this DPA shall not exceed the total fees paid by Controller to Processor in the 12 months preceding the incident.

13.2 Data Protection Liabilities

Notwithstanding the above, liability for violations of data protection laws may be subject to statutory limits as defined by Applicable Data Protection Law.

13.3 Indemnification

Processor shall indemnify Controller against third-party claims arising from Processor's breach of this DPA, provided that:

• Controller notifies Processor promptly of the claim
• Processor has sole control of the defense and settlement
• Controller cooperates with Processor

14. Governing Law and Jurisdiction

This DPA is governed by the same law as the Terms of Service. Any dispute arising from this DPA shall be resolved in accordance with the dispute resolution provisions in the Terms of Service.

15. Term and Termination

15.1 Term

This DPA is effective as of the effective date of the Terms of Service and remains in effect for as long as Processor processes personal data on behalf of Controller.

15.2 Survival

Provisions that by their nature should survive termination shall survive, including:

• Data deletion obligations
• Security obligations for retained data
• Audit rights for past processing
• Liability and indemnification
• Confidentiality

16. Miscellaneous

16.1 Order of Precedence

In case of conflict between the Terms of Service and this DPA, this DPA shall prevail with respect to data protection matters.

16.2 Amendments

Any amendment to this DPA must be in writing and signed by both parties. Processor may update this DPA to reflect changes in Applicable Data Protection Law with 30 days' notice.

16.3 No Third-Party Beneficiaries

This DPA is solely for the benefit of the parties and does not confer rights on third parties, including Data Subjects.

16.4 Entire Agreement

This DPA, together with the Terms of Service and Privacy Policy, constitutes the entire agreement between the parties regarding data processing matters.

17. Contact Information

For data protection inquiries, privacy concerns, or to exercise Data Subject rights:

Flowziac Technologies Private Limited

Data Protection Officer

Email: dpo@flowziac.com

Address: [Your Company Address]

---

Annex A: Standard Contractual Clauses (SCCs)

The parties agree that transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to Processor's facilities shall be governed by the European Commission's Standard Contractual Clauses for Processors (SCCs), as set forth in Commission Implementing Decision (EU) 2021/914.

The SCCs are incorporated by reference into this DPA. The parties complete the required information as follows:

Module Three (Controller-to-Processor)

• **Clause 7:** Processor may engage sub-processors in accordance with Section 5 of this DPA
• **Clause 9:** Processor's security measures are described in Section 4 of this DPA
• **Clause 11:** Processor's assistance obligations are described in Section 6 of this DPA
• **Clause 12:** Audit rights are described in Section 10 of this DPA
• **Clause 14:** Data Subject requests are handled per Section 6 of this DPA
• **Clause 17:** Security Incident notifications are per Section 7 of this DPA
• **Clause 18:** Data deletion and return are per Section 9 of this DPA
• **Clause 22:** Liability provisions are per Section 13 of this DPA

Optional Clauses:

• **Clause 9(a):** Processor shall comply with the security measures in Section 4 of this DPA
• **Clause 11(3):** Controller's instructions for international transfers are in Section 3.3 of this DPA

The SCCs shall be interpreted in conjunction with this DPA. In case of conflict, the SCCs shall prevail.

---

Annex B: Technical and Organizational Measures (Detailed)

B.1 Data Security

• AES-256 encryption for data at rest
• TLS 1.3 for data in transit
• Database access logging and monitoring
• Regular security patching (critical patches within 7 days)
• Network segmentation and firewalls
• DDoS protection and rate limiting

B.2 Access Control

• Role-based access control (RBAC)
• Multi-factor authentication (MFA) required for all admin accounts
• Session timeout after 30 minutes of inactivity
• Unique user IDs for all personnel
• Quarterly access reviews
• Principle of least privilege

B.3 Infrastructure

• Hosted on AWS with ISO 27001 and SOC 2 Type II certifications
• Automated backups with encryption
• Backup retention: 30 days
• Disaster recovery plan with RTO < 4 hours, RPO < 1 hour
• Regular disaster recovery testing (annually)

B.4 Monitoring and Logging

• Centralized logging with 12-month retention
• Real-time security monitoring
• Intrusion detection/prevention systems
• File integrity monitoring
• Security incident response team available 24/7

B.5 Development and Testing

• Secure coding practices (OWASP Top 10)
• Code review for all changes
• Automated security testing in CI/CD
• Penetration testing annually
• Vulnerability scanning weekly
• Staging environments isolated from production

B.6 Personnel

• Background checks for all employees
• Annual security and privacy training
• Confidentiality agreements
• Clear desk and screen policies
• Access revocation within 24 hours of termination

B.7 Business Continuity

• Documented business continuity plan
• Off-site backup storage
• Alternate processing facilities
• Annual business continuity testing

B.8 Data Minimization

• Collection limited to necessary data
• Automatic deletion of temporary data after 30 days
• Data retention policies enforced
• Regular data purges

B.9 Sub-processor Management

• Due diligence on all sub-processors
• Written agreements with data protection clauses
• Annual compliance reviews
• Right to audit sub-processors

---

Annex C: Categories of Personal Data

C.1 Data Categories Processed

• **Contact Information:** Name, phone number, email address, company name, job title
• **Communication Data:** Message content, timestamps, delivery status, read receipts
• **Conversation History:** Full chat logs, media shared (images, documents, audio, video)
• **Analytics Data:** Message metrics, response times, engagement rates, flow performance
• **Technical Data:** IP addresses, device information, browser type, location data (if consented)
• **Account Data:** User credentials, workspace settings, team member information
• **Financial Data:** Billing information, payment method details (processed by payment sub-processors)

C.2 Special Categories of Data

Processor does not intentionally process special categories of personal data (sensitive data) unless explicitly declared by Controller with appropriate safeguards and legal basis. Controller warrants that it will not upload or process sensitive personal data without:

• Obtaining explicit consent from Data Subjects
• Implementing additional security measures
• Notifying Processor in writing
• Ensuring lawful basis under Applicable Data Protection Law

C.3 Children's Data

Controller must not process personal data of children under the age of 16 (or lower age as defined by Applicable Data Protection Law) without verifiable parental consent. Controller is responsible for implementing age verification mechanisms and obtaining necessary consents.

---

Annex D: Instruction for Processing

D.1 Core Processing Activities

Processor is authorized to perform the following processing activities:

• **Data Collection:** Receive personal data from Controller via API, web interface, or integrations
• **Data Storage:** Store personal data in encrypted databases
• **Data Organization:** Categorize contacts, create segments, tag conversations
• **Message Processing:** Transmit messages through WhatsApp Business API
• **Analytics:** Generate reports on message performance, engagement metrics, and platform usage
• **Flow Execution:** Process flow logic and trigger actions based on user responses
• **Template Management:** Store and manage message templates
• **Webhook Delivery:** Send event notifications to Controller's configured webhooks
• **Backup and Recovery:** Create encrypted backups for disaster recovery
• **Compliance Logging:** Maintain audit logs for compliance purposes

D.2 Retention Periods

• Active account data: Indefinite while account is active
• Deleted account data: 90 days in backups, then permanent deletion
• Audit logs: 12 months
• Analytics data: 24 months (aggregated, anonymized after 12 months)

D.3 Data Location

Primary data storage: AWS regions in [specify regions, e.g., Asia Pacific (Mumbai), US East (N. Virginia)]

Backup storage: AWS regions in [specify regions]

Sub-processor data: As per sub-processor locations in Section 5

D.4 Purposes of Processing

• Service delivery and operation
• Customer support
• Analytics and reporting
• Platform improvement
• Security and fraud prevention
• Legal and regulatory compliance
• Billing and account management

D.5 Data Subject Categories

• Controller's customers and prospects
• Controller's contacts and leads
• Controller's team members and users
• End-users interacting with Controller's WhatsApp messages

---

Annex E: Controller's Warranties and Undertakings

Controller represents and warrants that:

E.1 Lawful Basis

Controller has obtained all necessary consents, provided appropriate privacy notices, and established a lawful basis for processing personal data through the Services.

E.2 Data Accuracy

Controller is responsible for the accuracy, quality, and completeness of all personal data provided to Processor.

E.3 Compliance

Controller shall use the Services in compliance with all Applicable Data Protection Laws, including but not limited to:

• Providing clear and comprehensive privacy notices to Data Subjects
• Responding to Data Subject rights requests within legal timeframes
• Implementing appropriate technical and organizational measures for its own operations
• Notifying Processor of any changes to processing instructions or legal requirements

E.4 Sensitive Data

Controller will not process sensitive personal data (special categories) without explicit consent and prior written notification to Processor.

E.5 International Transfers

Controller has appropriate legal mechanisms in place for international transfers of personal data to Processor, including Standard Contractual Clauses where required.

E.6 Data Subject Communications

Controller is responsible for all communications with Data Subjects regarding their personal data. Processor will not communicate directly with Data Subjects except as instructed by Controller or required by law.

E.7 Data Protection Officer

Controller has appointed a Data Protection Officer or equivalent responsible for data protection matters, with contact details provided to Processor.

---

Annex F: Standard Contractual Clauses Completion

The parties confirm that they have entered into this DPA in accordance with the requirements of the GDPR and other Applicable Data Protection Laws. The SCCs are fully incorporated and binding upon the parties.

Party Details:

Controller:

• Name: [Customer Name]
• Address: [Customer Address]
• Contact Person: [Name and Email]
• Data Protection Officer: [Name and Email]

Processor:

• Name: Flowziac Technologies Private Limited
• Address: [Your Company Address]
• Contact Person: [DPO Name]
• Email: dpo@flowziac.com
• Data Protection Officer: [Name and Contact]

---

Execution

By accepting the Terms of Service and using the Services, the parties agree to be bound by this DPA. No separate signature is required.

For any questions regarding this DPA, contact dpo@flowziac.com.