Data Processing Agreement
Last updated: 12 August 2026 · This Data Processing Agreement is incorporated into the Terms of Service and requires no separate signature.
1. Parties and roles
This Data Processing Agreement ("DPA") under Art. 28 GDPR is concluded between the Customer (the business holding the Whapier account — the controller) and ADDO VISION SOLUTIONS SRL, VAT RO32203240, Bucharest, Romania (the processor, "Whapier"). It governs all personal data the Customer brings into the Service.
2. Subject matter, duration, nature and purpose
Subject matter: the operation of the Whapier platform — storage, transmission, display, automation and reporting of WhatsApp conversations and contact data on the Customer's behalf. Duration: the life of the Customer's account, plus the deletion window in section 8. Nature and purpose: hosting and processing strictly as needed to provide the contracted features; no processing for Whapier's own purposes.
3. Categories of data and of data subjects
| Data subjects | Data categories |
|---|---|
| The Customer's customers, prospects and other conversation partners | Names, phone numbers, WhatsApp identifiers, custom contact fields defined by the Customer, message content and media, delivery metadata, group/segment membership |
| The Customer's team members | Names, email addresses, roles, activity within the account (assignments, notes) |
The Customer warrants it does not direct special categories of data (Art. 9 GDPR) into the Service; message content transmitted spontaneously by end users is processed as content without evaluation by Whapier.
4. Instructions
Whapier processes the data only on the Customer's documented instructions — in the first place, the configuration and use of the Service itself — unless Union or member-state law requires otherwise, in which case Whapier informs the Customer before processing, where the law does not forbid it. Whapier informs the Customer immediately if, in its view, an instruction infringes data-protection law.
5. Confidentiality and security (Art. 32)
Persons authorised to process the data are bound to confidentiality. Taking into account the state of the art and the risks, Whapier implements and maintains, among others: TLS encryption in transit; salted password hashing; hashed, individually revocable API keys; role-based access control and optional two-factor authentication; signature verification on inbound webhooks; logical tenant separation per organization; EU hosting; backups; least-privilege access to production limited to operating personnel; logging of administrative access.
6. Sub-processors
The Customer generally authorises the engagement of sub-processors. The current list:
| Sub-processor | Purpose | Location |
|---|---|---|
| Meta Platforms Ireland Ltd | WhatsApp Business Platform — message transmission | Ireland / Meta group per its terms |
| EU hosting provider | Infrastructure, storage, backups | European Union |
| Stripe Payments Europe Ltd | Subscription payment processing (controller data, listed for transparency) | Ireland |
| Pusher (MessageBird group) | Realtime delivery of conversation updates to the Customer's own browser sessions | European Union (EU cluster) |
| OpenAI (EU region) | AI-assisted replies, transcription and document search — engaged only if the Customer enables the IntelliReply add-on | European Union (EU data-residency endpoint, zero data retention, no training on customer data) |
| Oblio Software SRL | Issuing fiscal invoices (controller data, listed for transparency) | Romania |
Whapier informs account owners of intended additions or replacements at least 14 days in advance by email; the Customer may object on reasonable data-protection grounds, and if no solution is found, may terminate the affected service. Whapier imposes on every sub-processor data-protection obligations no less protective than this DPA and remains fully liable to the Customer for their performance.
7. Assistance and notifications
Whapier assists the Customer, insofar as possible and by appropriate technical and organisational measures, in answering data-subject requests (Articles 15–22) — the product's export, correction and deletion functions are the first instrument for this — and in the Customer's obligations under Articles 32–36 (security, breach notification, impact assessments). Whapier notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, with the information Art. 33(3) requires as it becomes available.
8. Deletion and return
During the contract the Customer can export contacts and conversation results at any time. Upon closure of the account, Whapier deletes or irreversibly anonymises the Customer's content within 90 days, unless Union or member-state law requires longer storage (in which case the data is blocked from any other use). On request, Whapier confirms deletion in writing.
9. Audit
Whapier makes available the information necessary to demonstrate compliance with Art. 28 and, no more than once per year unless a supervisory authority requires otherwise or a breach has occurred, allows audits — in the first instance by answering a written questionnaire, and where genuinely necessary by an on-site or remote inspection during business hours, under confidentiality, at the Customer's cost.
10. International transfers, liability, precedence
Processing takes place in the EU; any transfer outside the EEA by a sub-processor rests on an adequacy decision or standard contractual clauses (section 6). Liability follows the Terms of Service. Where this DPA and the Terms conflict on data protection, this DPA prevails. Romanian law governs.