Data Processing Addendum

Last updated: 1 May 2026 · Version 2.0

1. Roles

You are the Data Controller for personal data submitted to WA-B. WA-B is the Data Processor, processing that data only on your documented instructions. Where required by law, this DPA satisfies the obligations of GDPR Art. 28 and Ghana's Data Protection Act 2012 (Act 843).

2. Categories of data & data subjects

• Subjects: your end customers (people who message your bot) and your staff users.
• Data: phone numbers, names, message content, delivery addresses, payment metadata.

3. Processing purposes

Strictly to provide the Service: routing WhatsApp messages, processing orders, charging payments, generating receipts, providing analytics, and supporting you.

4. Sub-processors

Current authorized sub-processors:

• Meta Platforms Ireland Ltd.: WhatsApp, Instagram, and Messenger messaging (Ireland)
• Paystack Payments Ltd.: card and MoMo payment processing (Nigeria)
• Hubtel Ltd.: legacy MoMo processor, kept only to settle any in-flight charge from before we switched to Paystack (Ghana)
• Clerk, Inc.: merchant dashboard authentication (USA)
• Google LLC (Firebase): push notifications to the WA-B mobile app (USA)
• Oracle Corporation (Oracle Cloud Infrastructure): hosting (Morocco West / Casablanca region)

We give 30 days' notice before adding or changing any sub-processor. You may object in writing. If we can't accommodate, you can terminate without penalty.

5. Security measures

• TLS 1.2+ for all data in transit.
• AES-256 encryption at rest, including backups.
• SHA-256 hashed API keys, never stored in plaintext.
• HMAC-verified webhook callbacks (no spoofed payments).
• Role-based access; staff access is logged and audited.
• SSO + 2FA for all WA-B internal accounts.
• Penetration tests annually; quarterly internal reviews.

6. International transfers

Personal data is primarily stored on Oracle Cloud Infrastructure (Morocco West / Casablanca region). Sub-processors listed above (Meta, Paystack, Clerk, Google/Firebase) may process data outside Ghana as part of providing their service to us, under appropriate contractual safeguards consistent with Ghana's Data Protection Act.

7. Data subject rights

WA-B will assist you in fulfilling data subject access, rectification, erasure, portability, and objection requests. Standard requests are returned in CSV/JSON within 7 business days at no extra charge.

8. Breach notification

We notify affected customers within 72 hours of confirming a personal data breach, with details on scope, root cause, and remediation. We coordinate with you on regulator notification if required.

9. Audits

You may audit our compliance once per year on 30 days' notice, subject to mutually agreed scope and an NDA. We provide our latest SOC 2-aligned controls report on request.

10. Return / deletion

On termination, you may export all personal data within 30 days. After that, we permanently delete or anonymize it within 60 days, except where law requires retention (e.g. tax records).

11. Liability

This DPA is governed by the same liability cap and law (Ghana) as the underlying Terms.