Effective date: October 15, 2026
This Data Processing Addendum (“DPA”) forms part of the agreement between The Provider, doing business as Whatsgate (“Whatsgate”, “Processor”, “Service Provider”, “we”, “us”), and the Customer that uses the Whatsgate Service (“Customer”, “Controller”, “Business”).
This DPA applies where Whatsgate processes Personal Data contained in Customer Content on behalf of Customer.
If there is a conflict between this DPA and the Terms of Service concerning the processing of Customer Personal Data, this DPA controls.
“Applicable Data Protection Law” means privacy and data-protection laws applicable to the processing covered by this DPA, which may include the EU GDPR, UK GDPR, applicable U.S. state privacy laws, and other applicable privacy laws.
“Customer Personal Data” means Personal Data contained in Customer Content that Whatsgate processes on behalf of Customer in providing the Service.
“Data Subject”, “Controller”, “Processor”, “Personal Data”, “Processing”, and “Supervisory Authority” have the meanings given by Applicable Data Protection Law.
“Subprocessor” means a third party engaged by Whatsgate to process Customer Personal Data on behalf of Customer.
Customer is the Controller/Business of Customer Personal Data and Whatsgate is the Processor/Service Provider, except where Applicable Data Protection Law requires a different classification for a specific processing activity.
Whatsgate will process Customer Personal Data only:
The agreement, Customer's use/configuration of the Service, and this DPA constitute Customer's documented instructions.
If Whatsgate believes an instruction violates Applicable Data Protection Law, we may notify Customer and suspend the affected processing until the parties resolve the issue.
Customer represents that:
Customer is responsible for determining whether the Service is suitable for processing sensitive or special-category data and for implementing additional safeguards required by law.
| Item | Description |
|---|---|
| Subject matter | Provision of the Whatsgate messaging automation API, webhooks, connected sessions, support, security, and related SaaS functionality |
| Duration | For the duration of the Customer's use of the Service plus the limited retention/deletion periods described in the agreement and Privacy Policy |
| Nature of processing | Collection, transmission, routing, hosting, storage where technically required, retrieval, organization, display, security monitoring, troubleshooting, deletion, and other processing necessary to provide the Service |
| Purpose | To provide Customer-requested messaging, integration, automation, webhook, account, security, support, and related functionality |
| Data subjects | Customer personnel; Customer's customers, prospects, contacts, message recipients and senders; group participants; other persons whose data Customer submits or makes accessible through connected accounts |
| Personal-data categories | Names; usernames; phone numbers; messaging identifiers; message content; media/files; contact and group data; message metadata; delivery/status events; webhook data; device/session identifiers; technical logs; other Customer-submitted data |
| Sensitive data | Not intentionally required by the Service; may appear incidentally in Customer Content. Customer must ensure lawful processing and required safeguards |
Whatsgate will ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.
Access will be limited to personnel and contractors who require access for legitimate Service, security, support, or legal purposes.
Whatsgate will maintain technical and organizational measures designed to provide a level of security appropriate to the risks of processing.
Measures may include, as appropriate:
Customer is responsible for securing its own systems, webhook endpoints, API credentials, connected accounts, recipient data, and authorized users.
Customer authorizes Whatsgate to engage Subprocessors to provide the Service.
A current list of material Subprocessors should be maintained at:
Subprocessors and Service Providers
Whatsgate will impose data-protection obligations on Subprocessors that are appropriate to the processing they perform.
Where required by Applicable Data Protection Law, Whatsgate will provide notice of material new Subprocessors and a reasonable opportunity for Customer to raise a good-faith data-protection objection.
If the parties cannot reasonably resolve a valid objection, Customer may discontinue the affected Service in accordance with the agreement.
Taking into account the nature of processing, Whatsgate will provide reasonable assistance to Customer in responding to verified requests from Data Subjects to exercise rights under Applicable Data Protection Law.
If Whatsgate receives a request concerning Customer Personal Data for which Customer is the Controller, Whatsgate may direct the requester to Customer unless prohibited by law.
Customer is responsible for evaluating and responding to the request.
Whatsgate will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data where notification to Customer is required by Applicable Data Protection Law.
The notice will include information reasonably available to Whatsgate regarding the nature of the incident, affected data, likely consequences, and mitigation measures.
Whatsgate's notification is not an admission of fault or liability.
Customer is responsible for any notifications to Data Subjects or authorities required because Customer is the Controller, except to the extent law assigns an obligation directly to Whatsgate.
Taking into account the nature of processing and information available to us, Whatsgate will provide reasonable assistance with Customer's legally required security, breach, data-protection-impact-assessment, and regulatory consultation obligations relating to the Service.
Whatsgate will make available information reasonably necessary to demonstrate compliance with applicable processor obligations.
Any audit rights will be exercised in a manner that protects the confidentiality, security, and rights of other Customers and does not unreasonably disrupt operations. We may satisfy reasonable audit requests through current security documentation, questionnaires, certifications, or independent reports where appropriate.
On-site audits, if legally required and not reasonably satisfied by other means, must be subject to advance notice, confidentiality, security procedures, and reasonable scope limitations.
Customer authorizes Whatsgate and its Subprocessors to process Customer Personal Data in the United States and other countries in which authorized Subprocessors operate, subject to Applicable Data Protection Law.
Where a restricted transfer from the EEA requires contractual safeguards, the parties agree to implement the applicable European Commission Standard Contractual Clauses (“EU SCCs”) in the legally appropriate module and configuration, to the extent the SCCs are available and required for the transfer.
Where a restricted transfer from the United Kingdom requires additional contractual safeguards, the parties will apply the legally appropriate UK transfer mechanism, including the UK International Data Transfer Addendum to the EU SCCs or another valid mechanism where applicable.
If a different or successor transfer mechanism becomes legally required, the parties will cooperate in good faith to implement it.
Upon termination or expiration of the Service, Whatsgate will delete or return Customer Personal Data as required by Applicable Data Protection Law and consistent with the Service's documented export/deletion functionality.
Customer Content and session-data retention following termination is governed by:
Message content and webhook payloads may be retained for up to 7 days where necessary for delivery, retries, synchronization, troubleshooting, security, and service reliability. Media files may be temporarily cached for up to 24 hours where necessary for message delivery, processing, retries, or synchronization. Message delivery, status, and related operational metadata may be retained for up to 30 days for troubleshooting, abuse prevention, security, and service reliability. Connected-account session data, authentication data, and credentials required to maintain the integration are retained while the applicable integration remains active and may be retained for up to 7 days after the integration is disconnected, after which they are deleted or invalidated. Upon account termination, Customer Content remaining in active production systems is deleted according to the retention periods described above. Residual copies may remain in encrypted backups for up to 30 additional days before being overwritten in the ordinary backup cycle. Backup copies are not restored except where necessary for disaster recovery, security, or legal compliance.
Deletion may not immediately remove information from disaster-recovery or backup media, provided remaining copies are protected, not restored except where necessary for recovery/security, and deleted or overwritten in the ordinary backup cycle.
Whatsgate may retain information where required by law, provided it remains protected and is processed only for the legally required purpose.
Where an applicable U.S. state privacy law treats Customer as a “business” or “controller” and Whatsgate as a “service provider”, “contractor”, or “processor”:
If this DPA conflicts with another agreement between the parties on the same subject, this DPA controls with respect to Customer Personal Data.
If mandatory provisions of Applicable Data Protection Law conflict with this DPA, the mandatory law controls to the extent of the conflict.
Privacy and data-protection notices under this DPA:
service@whatsgate.org