This Data Processing Addendum ("DPA") forms part of the agreement between Whatsoza — a brand operated by Ozavion Limited, a company registered in England and Wales (company no. 16814450) ("Processor", "we") — and the client that engages our Services ("Controller", "you"), and applies where we process personal data on your behalf under applicable data-protection law, including the EU and UK GDPR ("Data Protection Law").
This page is a reference version. For a specific engagement, a countersigned DPA (and any Standard Contractual Clauses) between you and Whatsoza will govern; where that signed DPA conflicts with this page, the signed DPA prevails.
1. Definitions
"Personal data", "processing", "controller", "processor", "data subject", "sub-processor" and "personal data breach" have the meanings given in Data Protection Law. "Services" means the WhatsApp Business API, automation, integration and managed services we provide to you.
2. Roles and scope
You are the controller (or a processor acting for your own customer) and Whatsoza is your processor (or sub-processor) for personal data processed to deliver the Services. Each party will comply with its obligations under Data Protection Law. The WhatsApp Business Platform is operated by Meta Platforms, Inc., which acts as a separate processor/controller under its own terms.
3. Our processing obligations
As your processor, Whatsoza will:
- process personal data only on your documented instructions (including this DPA and the Services Agreement), unless required by law — in which case we will notify you where permitted;
- ensure personnel authorised to process personal data are bound by appropriate confidentiality obligations;
- implement appropriate technical and organisational security measures (see Annex II / Article 32);
- respect the conditions for engaging sub-processors set out below;
- assist you, by appropriate measures, to respond to data-subject rights requests;
- assist you with security, breach notification, data-protection impact assessments and prior consultation (Articles 32–36), taking into account the information available to us;
- at your choice, delete or return personal data at the end of the Services and delete existing copies, unless retention is required by law;
- make available information reasonably necessary to demonstrate compliance and allow for and contribute to audits as described below.
4. Your obligations
You warrant that you have a valid legal basis and all necessary consents/opt-ins for the personal data you provide and for the messaging we send on your behalf, that your instructions are lawful, and that you comply with the WhatsApp Business Messaging Policy and applicable law.
5. Sub-processors
You provide general authorisation for Whatsoza to engage sub-processors to deliver the Services. We will impose data-protection terms on each sub-processor no less protective than this DPA and remain responsible for their performance. Current categories and key sub-processors include:
| Sub-processor | Purpose | Location |
|---|---|---|
| Meta Platforms, Inc. | WhatsApp Business Platform messaging | USA / global |
| Google LLC | Website analytics & tag management | USA / global |
| [Hosting provider] | Application & database hosting | [Region] |
| [CRM / email provider] | Communications & records | [Region] |
| [Other sub-processors] | [Purpose] | [Region] |
We will give you advance notice of any intended addition or replacement of a sub-processor, giving you the opportunity to object on reasonable data-protection grounds.
6. International transfers
Where processing involves transferring personal data outside the EEA/UK, the parties will put in place an approved transfer mechanism — such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum — or rely on an adequacy decision.
7. Security measures (Annex II summary)
Taking into account the state of the art and the risks of processing, we maintain measures that may include: access controls and least-privilege permissions; encryption of data in transit (and at rest where supported); network and application security controls; logging and monitoring; secure development and change management; vendor due diligence; and staff confidentiality and awareness. Specific measures for an engagement are set out in the signed DPA / Annex II. [Complete with your actual measures.]
8. Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process for you, and provide information reasonably available to help you meet your own notification obligations.
9. Audits
We will make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable prior notice, subject to confidentiality and to not compromising other clients' security. Where available, we may satisfy audit requests by providing relevant third-party reports or documentation.
10. Processing details (Annex I)
- Subject matter & duration: provision of the Services for the term of the Services Agreement.
- Nature & purpose: setting up and operating WhatsApp Business messaging, automation, integrations and related support on your behalf.
- Types of personal data: contact identifiers (name, phone number, email), message content and metadata, and other data you choose to process through the Services. [Refine per engagement; exclude special-category data unless expressly agreed.]
- Categories of data subjects: your customers, prospects, end-users and staff who interact via the Services.
11. Liability and term
This DPA is effective for as long as we process personal data for you and is subject to the liability provisions of the Services Agreement. Governing law and jurisdiction are as set out in the Services Agreement (or England and Wales if not stated).
12. Contact
To request a signed DPA or ask about our processing, email privacy@whatsoza.com # privacy / legal / cookies / DPA contact. See also our Privacy Policy and Security & Compliance page.