Data Processing Agreement (DPA)
Last Updated: September 2026 · Effective for all BizWaz Enterprise & SaaS Customers
1. Scope and Roles
In providing our WhatsApp CRM and automation platform, BizWaz processes personal data on behalf of our customers:
- The Customer acts as the Data Controller (or Data Fiduciary), determining the purposes and lawful basis for collecting customer contact details and communicating via WhatsApp.
- BizWaz acts as the Data Processor (or Data Processor/Fiduciary partner), processing messages, catalog interactions, and metadata strictly under the Customer's verified instructions and in compliance with the Indian Digital Personal Data Protection (DPDP) Act, 2023 and international data privacy frameworks (e.g., GDPR where applicable).
2. Processing Details & Data Categories
The subject matter, duration, nature, and purpose of the processing are defined as follows:
Categories of Data Subjects
Prospective buyers, inbound Meta ad leads, e-commerce customers, and active WhatsApp contacts communicating with the Customer.
Types of Personal Data
Names, phone numbers (E.164 format), incoming conversation histories, qualification tags, AI chat logs, and order reference identifiers.
Nature of Processing: Ingestion, storage, retrieval, Large Language Model (LLM) intent classification, automated team routing, scheduled WhatsApp broadcasting, and in-chat payment link dispatch.
3. Authorized Sub-processors
BizWaz utilizes vetted enterprise sub-processors to deliver cloud hosting, AI computation, and official messaging connectivity. All sub-processors are bound by data protection obligations no less restrictive than those in this DPA:
| Sub-processor | Role / Service | Data Location |
|---|---|---|
| Meta Platforms, Inc. | Official Meta WhatsApp Business Cloud API (WABA) | USA / Global Tier-1 Data Centers |
| Amazon Web Services (AWS) | Primary Cloud Compute, Relational DB & Encrypted Backups | Asia-Pacific (Mumbai, India) |
| Cloudflare, Inc. | DDoS Protection, Edge CDN & Media Storage (R2) | Global Edge Network |
| Razorpay / Stripe | PCI-DSS Level 1 Payment Link & UPI Processing | India / Global |
| OpenAI / Anthropic / Google Vertex | Private Zero-Retention LLM Inference for AI Lead Qualification | Secure Enterprise Cloud |
4. Technical & Organizational Security Measures
BizWaz implements bank-grade security protocols to protect customer personal data from accidental loss, disclosure, or unauthorized alteration:
- Encryption in Transit & at Rest: All network communications use TLS 1.3 encryption. Customer databases and storage buckets are encrypted using AES-256 standards.
- Multi-Tenant Data Isolation: Strict workspace scoping ensures tenant data is partitioned and accessible solely to authorized team members with granular Role-Based Access Control (RBAC).
- Zero Unofficial Scrapers: BizWaz strictly communicates through official Meta Cloud API endpoints, preventing unauthorized session hijacking or third-party credential interception.
- Zero Public Model Training: Conversations processed by our LLM Gateway are never utilized to train foundation models or shared with other tenants.
5. Security Incident & Breach Notification
In the event of a confirmed security incident impacting customer personal data under BizWaz custody, BizWaz will notify the customer without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach. The notice will detail the nature of the incident, estimated categories of data affected, and remedial actions taken.
6. Data Subject Rights & Deletion
BizWaz provides self-serve export and deletion capabilities inside the dashboard. Upon subscription cancellation or upon written request, customers have a thirty (30) day window to retrieve contacts, after which customer personal data is permanently expunged from primary production storage.