Data Processing Agreement

Draft template – the operator has not completed these terms yet.

This DPA forms part of the Terms between the business using WhatsApp Commerce ("Controller") and [Your Company Ltd] ("Processor") and reflects Article 28 UK GDPR.

1. Subject matter

Processing of shoppers' personal data (WhatsApp number, name, messages, order, address, marketing preferences) to provide WhatsApp commerce, messaging, AI assistance and analytics, for the duration of the Terms.

2. Processor obligations

• Process only on the Controller's documented instructions (configuring and using the Service).
• Ensure staff are bound by confidentiality.
• Implement appropriate technical and organisational measures (encryption of credentials, access control, backups, logging).
• Engage sub-processors only as listed in the Privacy Policy, with equivalent obligations, and give notice of changes.
• Assist with data-subject requests and DPIAs.
• Notify personal data breaches without undue delay (target 48 hours).
• Delete or return data at the end of the service (export available for 30 days).
• Make available information needed to demonstrate compliance.

2a. Historical conversations

Where the Controller connects a number already used with the WhatsApp Business app ("coexistence"), the Controller instructs the Processor to import and process that number's existing contacts and up to 180 days of message history, under the same terms, retention and deletion rules as other conversation data. Imported contacts are not treated as having given marketing consent.

3. Controller obligations

The Controller is responsible for a lawful basis, opt-ins for marketing messages, privacy notices to shoppers and the accuracy of instructions.

4. International transfers

Where data leaves the UK, transfers rely on adequacy regulations or the UK International Data Transfer Agreement / Addendum.

Last updated: 2026-11