Data Processing Agreement

Last updated: 8/9/2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between WABox ("Data Processor") and the Customer ("Data Controller").

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person processed on behalf of the Customer.
"Sub-processor" means any third party engaged by WABox to process Personal Data.

2. Processing of Personal Data

WABox shall process Personal Data only on documented instructions from the Customer, including with regard to transfers of personal data to a third country or an international organization, unless required to do so by applicable law.

3. Security Measures

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, WABox shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

4. Sub-processors

The Customer provides general authorization for WABox to engage Sub-processors. WABox will inform the Customer of any intended changes concerning the addition or replacement of Sub-processors.

Our current Sub-processors include:

• Supabase: Database and infrastructure hosting
• Meta (WhatsApp Cloud API): Message transmission and delivery

5. Data Subject Rights

WABox shall, insofar as this is possible, assist the Customer by appropriate technical and organizational measures for the fulfilment of the Customer's obligation to respond to requests for exercising the data subject's rights.

6. Deletion or Return of Data

Upon termination of the provision of services, WABox shall, at the choice of the Customer, delete or return all the Personal Data to the Customer, unless applicable law requires storage of the Personal Data.