Data Processing Agreement

1. Who is who

You are the controller: you decide whose numbers you upload and what you send them. Beaurickz, a sole proprietorship registered in India (proprietor: Muhammed Safeed S), is the processor: we handle that data only to deliver the service, and only on your instructions. Using the product — uploading contacts, sending a campaign, running a flow — is an instruction.

For your own account data (your email, your plan, your billing records) we are the controller instead, and our Privacy Policy covers it.

2. What we process, and for how long

• Subject matter: sending and receiving WhatsApp messages through Meta's WhatsApp Cloud API on your behalf.
• Duration: for as long as your workspace exists, plus the deletion window in section 8.
• Categories of people: your customers, leads and anyone else you choose to message.
• Types of data: phone numbers; names and any other columns you upload; message content you send and receive; delivery and read status; opt-out status; the time of each message.
• Special category data: none is required, and you shouldn't upload any. If your use involves health, financial or other sensitive data, that's your decision and your lawful basis.

3. What we promise

• We process personal data only on your documented instructions, including for transfers, unless the law requires otherwise — and then we tell you first, unless the law forbids it.
• Everyone with access is bound by confidentiality.
• We do not sell personal data, do not use your contacts or messages for advertising, and do not use them to train AI models.
• We help you meet requests from people exercising their rights (access, correction, deletion, objection) — see section 6.
• We help you with security, breach notification and impact assessments, given the information we hold.

4. Security measures

• Encryption in transit (TLS) everywhere, and at rest on our database and backups.
• Meta access tokens and app secrets are separately encrypted with AES-256-GCM before being stored, so a database copy alone doesn't expose them.
• API keys are stored only as a one-way hash — we cannot read your key back, and neither can anyone who reaches the database.
• Tenant isolation: every record carries a workspace id, and every query is filtered by it. Incoming webhooks are verified against the signing secret of the number they claim to come from, so one workspace cannot forge events for another.
• Least privilege: administrative access is limited to the proprietor, protected by multi-factor authentication.
• Logging of message activity and webhook events, so delivery and access can be reconstructed.

5. Sub-processors

You give general authorisation for the sub-processors below. We'll give at least 30 days' notice by email before adding or replacing one, and you may object; if we can't resolve your objection, you may terminate and get a refund of the unused part of your plan.

6. Helping you answer people's requests

The dashboard lets you find, export and delete a contact and their message history yourself, which covers most access and erasure requests without involving us. Opt-outs are handled automatically: anyone who replies STOP is marked opted out and excluded from further sending. If you need help with a request you can't complete yourself, email us and we'll respond within 5 business days.

7. International transfers

Our database is hosted in Mumbai, India, and we operate from India, so personal data you upload leaves the EEA and the UK. That transfer relies on the European Commission's Standard Contractual Clauses (module two, controller to processor) and the UK International Data Transfer Addendum, which are incorporated into this agreement by reference and take precedence over it if they conflict. Meta processes message delivery under its own terms and transfer mechanisms.

If EU or UK data residency is a requirement for you, say so before you subscribe — tell us at safeedpromo@gmail.com and we'll tell you honestly whether we can meet it yet, rather than after you've paid.

8. Breaches, audits, deletion

• Breach: we notify you without undue delay, and within 72 hours of becoming aware, with what we know and what we're doing.
• Audit: we answer reasonable written security questionnaires and provide the information needed to show compliance. On-site audits are available at your cost, once a year, with 30 days' notice.
• Deletion: when your workspace closes we delete your contacts, messages, templates and settings within 30 days, except records the law requires us to keep. You can export beforehand.

9. Your side of it

You are responsible for having a lawful basis and a valid opt-in for every person you message, for honouring opt-outs, and for making sure your own privacy notice tells people you use a messaging provider. WhatsApp's own rules require opt-in too, so this isn't only a legal point — it's also what keeps your number from being blocked.

10. General

This agreement is governed by the laws of India, without limiting rights people have under the GDPR. Our liability under it is subject to the limits in the Terms. Contact for data protection matters: Muhammed Safeed S, Beaurickz, #134, BMRCL Metro Quarters, Kareemsabnagar, Sunkadkatte, Bengaluru (Urban), Karnataka 560091, India — safeedpromo@gmail.com.