Data processing agreement.
For Enterprise customers — supplements Terms of Service and Privacy Policy.
1. Parties and purpose
Customer («Controller») appoints Yexa Pro («Processor») to process personal data on its behalf to deliver WhatsApp services.
2. Scope of processing
- WhatsApp conversations and contacts
- Customer staff data (agents)
- Technical metadata (logs, IP)
3. Processor obligations
- Process only per Controller instructions
- Security safeguards (SOC 2, ISO 27001)
- Notify Controller within 72 hours of any breach
- Assist Controller with DSR requests
4. Sub-processors
Meta (WhatsApp), AWS (infrastructure). Updated list at yexa.pro/subprocessors. 30 days notice before adding new sub-processor.
5. Data transfers
Processing in GCC. Any transfer outside the region requires SCCs or Controller consent.
6. Termination
On termination: delete or return data within 90 days per Controller request.
7. Contact
For signed DPA: legal@yexa.pro