Skip to content
WaCRM

Data Processing Agreement

This Data Processing Agreement (DPA) applies when your shop uses WaCRM to process personal data belonging to your own contacts and staff. It supplements the Terms of Service and sets out each party's obligations as controller and processor of that data.

Effective date · Version 1.0

1. Scope

This DPA applies to personal data you (the “Customer”, acting as controller) submit to or process through WaCRM — your contacts' names and phone numbers, message content, order data, and staff accounts. It does not cover data WaCRM collects about you as a visitor to wacrm.co, which is covered by the Privacy Policy.

2. Roles

For data you submit to WaCRM about your own contacts and staff, you are the controller and Netbase Enterprise Solutions and Applications Joint Stock Company (Netbase JSC) is the processor. For data WaCRM collects about you directly (your account, billing, and support requests), Netbase is the controller, as described in the Privacy Policy.

3. Subject matter and duration

Netbase processes personal data on your instructions, for the purpose of providing the WaCRM inbox, AI assist, automation and related features, for as long as your subscription is active plus any retention period described in the Privacy Policy.

4. Processor obligations

  • Process personal data only on your documented instructions (as configured in your workspace).
  • Keep staff who access the data under confidentiality obligations.
  • Implement the security measures described in section 6.
  • Assist with data subject requests and security incidents as described in section 7.
  • Delete or return data on termination, as described in section 8.

5. Sub-processors

Netbase uses the sub-processors listed in the Privacy Policy (section 5), including Meta's WhatsApp Business Platform for message delivery and Cloudflare for hosting. We will give notice before adding a new sub-processor that materially changes how your data is processed.

6. Security measures

Encryption of data in transit, role-based access control limiting staff access to what their role requires, and Cloudflare's edge network security. We review these measures as the product grows.

7. Assistance and audits

We will assist you in responding to a verified data subject request affecting your workspace's contacts, and will notify you without undue delay of a confirmed personal data breach affecting your data. Audit requests can be sent to [email protected] and will be handled reasonably, given WaCRM's size as an early-access product.

8. Deletion on termination

On termination of your subscription, we delete or anonymise your workspace's contact and message data within 90 days, unless you ask for an export first or the law requires a longer retention period (see the Data Deletion page).