Data Processing Agreement (DPA)

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service of WaQtor, a product of DXBMark Ltd, London, UK.

This DPA is automatically incorporated into the Terms and applies to all customers using WaQtor services.

It governs the processing of Personal Data by WaQtor on behalf of the Customer in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).

2. Definitions

• Controller: The Customer, who determines the purposes and means of processing Personal Data.
• Processor: WaQtor, which processes Personal Data on behalf of the Customer.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on Personal Data.
• Subprocessor: Any third party engaged by WaQtor to process data.

3. Scope and Roles

• WaQtor acts as a Data Processor.
• The Customer acts as a Data Controller.
• Processing is carried out strictly to provide the WaQtor platform, support communication workflows (including WhatsApp integrations), and provide account, billing, and operational services.

4. Processing Instructions

WaQtor processes Personal Data only in accordance with Customer instructions, as necessary to provide the service, or to comply with legal obligations.

Customer instructions are defined through platform configuration, API usage, and feature activation (e.g. AI, WhatsApp integrations).

5. Nature and Purpose of Processing

• Message routing and delivery (including WhatsApp via Evolution API).
• User authentication and account management.
• Automation workflows.
• Notifications and transactional emails (via Zoho SMTP).
• AI-assisted message generation (optional, via OpenRouter).
• Logging, monitoring, and system diagnostics.

6. Categories of Data Subjects

• Customer employees or users.
• End-users / contacts of the Customer.
• Communication recipients.

7. Types of Personal Data

• Names.
• Phone numbers.
• Email addresses.
• Message content (user-provided).
• Metadata (timestamps, delivery status, logs).
• Authentication data (hashed credentials, tokens).

8. Subprocessors

WaQtor uses subprocessors to deliver parts of the service.

WaQtor may update its list of subprocessors from time to time. Customers will be notified of material changes where required.

• Infrastructure providers (hosting, storage).
• Email delivery provider (Zoho SMTP).
• AI processing providers (OpenRouter - optional feature).
• Messaging platforms (e.g. Meta / WhatsApp when applicable).

A full and updated list is provided in Appendix C.

9. WhatsApp & Evolution API Processing

WaQtor integrates with the Evolution API, a multi-provider WhatsApp integration layer.

• Messaging may occur via WhatsApp Web-based connections (Baileys).
• Or via official WhatsApp Business API (Meta Cloud API).
• Third-party platforms (such as Meta) may process message data under their own policies.

10. Security Measures

• Encryption in transit (HTTPS/TLS).
• Encryption of sensitive credentials and secrets.
• Tenant isolation at application and database level.
• Role-based access control (RBAC).
• Secure API authentication.
• Audit logging.

Full details are provided in Appendix B.

11. Access Control & Support Access

Access to customer data is strictly controlled. Only authorized personnel (Super Admin / Support Team) may access data where necessary for administration, technical support, security, or legal compliance purposes.

• Access is typically limited to specific tenants (via Tenant ID).
• Access is triggered by customer request, issue, or maintenance need.
• All access is logged and subject to internal controls.

12. Logging & Monitoring

• System diagnostics.
• Performance monitoring.
• Security and abuse detection.

Access to logs is restricted and governed under Section 11.

13. Backup & Data Resilience

Backup systems are continuously being enhanced to improve system resilience, enable data recovery, and provide customer-level data control options.

Until full implementation, WaQtor applies best-effort data protection practices.

14. Data Subject Rights

WaQtor supports the Customer in fulfilling obligations related to access requests, rectification, deletion, and data portability. Requests must be initiated by the Customer as Controller.

Customers may request reasonable information regarding WaQtor's data protection practices.

15. Personal Data Breach

• Notify affected customers without undue delay (within 72 hours where applicable).
• Provide relevant details.
• Assist with compliance obligations.

16. International Transfers

Data may be processed in multiple jurisdictions. WaQtor ensures that transfers are safeguarded through contractual protections, including Standard Contractual Clauses (SCCs) where applicable, use of reputable providers, and adherence to applicable data protection frameworks.

17. Liability

Liability is governed by the Terms of Service. This DPA does not expand liability beyond those terms.

18. Termination

• Customer may request data export (if available).
• WaQtor may delete data after a defined retention period.

Appendix A - Processing Details

Appendix B - Security Measures

• TLS encryption for all network communication.
• Secure storage of credentials (hashed / encrypted).
• Tenant isolation (logical separation).
• RBAC (role-based access control).
• API authentication and authorization.
• Logging and audit trails.
• Restricted internal access.
• Monitoring and alerting systems, where applicable.

Appendix C - Subprocessors