Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between Outhentica Global (Private) Limited, trading as Whatsuite ("Processor", "we") and the customer ("Controller", "you") for the use of the Whatsuite Service (the "Agreement"). It applies where Whatsuite processes personal data on your behalf.

1. Definitions

• Data Protection Laws: all laws that apply to the processing of personal data under the Agreement, including, where applicable, the EU GDPR, the UK GDPR and the UK Data Protection Act 2018, and similar laws elsewhere.
• Personal Data: any information relating to an identified or identifiable person that we process on your behalf.
• Sub-processor: a third party we engage to process Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

Other terms have the meanings given in the Data Protection Laws.

2. Roles

1. You are the controller of Personal Data in your workspace, such as contacts, messages, call recordings and files.
2. Whatsuite is the processor and processes Personal Data only on your behalf.
3. Each party will comply with the Data Protection Laws that apply to it.

3. Your instructions

1. We process Personal Data only on your documented instructions, which include the Agreement, this DPA and your configuration of the Service.
2. If we believe an instruction breaks Data Protection Laws, we will tell you.
3. You are responsible for the lawfulness of your instructions and for having a valid legal basis, including any required consent, for the processing.

4. Details of processing

• Subject matter: provision of the Service.
• Duration: the term of the Agreement plus the deletion period in section 11.
• Nature and purpose: hosting, storing, transmitting, analysing and displaying messages and related data to provide messaging, automation, AI, calling and integration features.
• Data subjects: your users, and your customers, leads and other contacts.
• Categories of data: names, phone numbers, account identifiers, message content, media, call recordings and transcripts, contact fields, tags and usage data.
• Special categories: you should not send special category data through the Service unless permitted by law and agreed in writing.

5. Confidentiality

We ensure that anyone authorised to process Personal Data is bound by confidentiality obligations.

6. Security

We implement appropriate technical and organisational measures, including:

1. Encryption of Personal Data in transit and at rest.
2. Role-based access controls and least-privilege access for staff.
3. Multi-factor authentication for administrative access.
4. Logging and monitoring of access and changes.
5. Regular backups and tested recovery procedures.
6. Vulnerability management and security testing.
7. Staff security and privacy training.

We may update these measures as long as the overall level of protection is not reduced.

7. Sub-processors

1. You authorise us to engage Sub-processors. Our current list is published in our trust centre.
2. We will give at least 30 days' notice before adding or replacing a Sub-processor. You may object on reasonable data protection grounds. If we cannot address the objection, you may terminate the affected part of the Service.
3. We impose data protection terms on each Sub-processor that are no less protective than this DPA, and remain responsible for their performance.
4. Channels. Meta, TikTok, telecom carriers and integration partners you connect act under their own terms with you. They are not our Sub-processors for data you choose to send to them.

8. International transfers

Where Personal Data is transferred from the EEA, UK or Switzerland to a country without an adequacy decision, the parties agree to the applicable Standard Contractual Clauses or UK International Data Transfer Addendum, which are incorporated by reference. We will carry out transfer assessments where required.

9. Data subject requests

Taking into account the nature of the processing, we will help you respond to requests from data subjects, mainly through features in the Service such as export, edit and delete. If we receive a request directly, for example through our data deletion page, we will pass it to you within 5 business days and not respond to its substance ourselves unless you instruct us to. We may tell the person that we have passed the request on.

10. Security incidents

1. We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting your Personal Data.
2. The notice will include what we know about the nature of the incident, the likely consequences and the measures taken or proposed.
3. We will take reasonable steps to contain and remedy the incident and will cooperate with you.

11. Return and deletion

1. You can export Personal Data at any time during the term.
2. After the Agreement ends, you have 30 days to export your data. We then delete Personal Data within a further 60 days, including from backups as they rotate, unless the law requires us to keep it.
3. On request, we will confirm deletion in writing.

12. Audits

1. We will make available information reasonably necessary to show compliance with this DPA, such as security summaries and third-party audit reports where available.
2. If that information is not enough, you may carry out an audit, no more than once a year, with at least 30 days' notice, during business hours and under confidentiality, at your own cost.

13. Assistance

We will provide reasonable help with data protection impact assessments and consultations with supervisory authorities, where related to our processing.

14. AI features

1. Personal Data processed by AI features is used only to provide those features to you.
2. We do not use your Personal Data to train third-party foundation models.
3. AI providers we use are listed as Sub-processors.

15. Healthcare data

If you intend to process protected health information, you must not do so until a separate Business Associate Agreement or equivalent has been signed. Ask our sales team about a BAA for the Business plan.

16. Liability and precedence

Liability under this DPA is subject to the limitations in the Agreement. If there is a conflict between this DPA and the Agreement, this DPA prevails for matters of data protection.

17. Contact

Data protection questions and notices under this DPA: privacy@whatsuite.io, or by post to Outhentica Global (Private) Limited, Site 105, 1st Floor, PECHS Community Hall & Office Complex, Block-2, Karachi, Sindh 75400, Pakistan.