Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Muhammad Hassaan Sarfraz, a sole trader (enskild firma) trading as "Watzup" ("Processor", "we"), and the customer that has accepted it ("Controller", "you"). It governs our processing of personal data that you, as controller, put through the Watzup platform about your own end-customers.

1. Roles and subject matter

You are the controller and Watzup is the processor of the personal data described in Annex 1. Each party will comply with its obligations under applicable data protection law, including the GDPR.

2. Processing scope and instructions

We will process personal data only on your documented instructions — which include using the platform’s features and this DPA — and as needed to provide and secure the service, unless required by law (in which case we will tell you, unless the law forbids it). We will inform you if, in our opinion, an instruction infringes data protection law.

3. Duration

We will process personal data for the duration of your subscription and until deletion or return as described in Section 10.

4. Confidentiality

We ensure that persons authorised to process the personal data are bound by an appropriate duty of confidentiality.

5. Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex 2 (GDPR Art. 32).

6. Sub-processing

You give general authorisation for us to engage the sub-processors listed in Annex 3 and our published Sub-processor List. We will impose data-protection obligations on each sub-processor no less protective than those in this DPA, and we remain fully liable to you for their performance. We will notify you before adding or replacing a sub-processor and give you a reasonable period to object on reasonable data-protection grounds.

7. Assisting with data-subject requests

Taking into account the nature of the processing, we will assist you with appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection).

8. Assisting with security, breaches and impact assessments

We will assist you in ensuring compliance with your obligations under GDPR Articles 32 to 36, taking into account the nature of processing and the information available to us.

9. Personal data breach

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide the information you reasonably need to meet your own notification obligations.

10. Return or deletion

On termination, and at your choice, we will delete or return the personal data and delete existing copies, unless law requires storage. The platform’s account-deletion flow erases tenant data after a 30-day grace period.

11. Audits

We will make available to you the information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable confidentiality and security conditions.

12. International transfers

Personal data is hosted in the EU (Frankfurt, Germany). Where a sub-processor processes data outside the EEA, such transfers are made under the European Commission’s Standard Contractual Clauses or another valid transfer mechanism.

13. Liability and governing law

Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. This DPA is governed by the laws of Sweden.

Annex 1 — Details of the processing

Swipe sideways to see the whole table →

Annex 2 — Technical and organisational measures

• Encryption: TLS for data in transit; encryption of sensitive secrets at rest (e.g. 2FA secrets and recovery codes).
• Access control: role-based permissions; optional two-factor authentication; single active session per user; passwords stored hashed.
• Tenant isolation: every record is scoped to a tenant and access is checked on every request, preventing cross-tenant access.
• Accountability: audit log of sensitive actions (team, role, billing, impersonation, 2FA changes).
• Resilience & location: EU-based hosting (Frankfurt, Germany); regular backups.
• Sub-processor governance: written data-processing contracts with all sub-processors.

Annex 3 — Approved sub-processors

Swipe sideways to see the whole table →