Data Processing Agreement (DPA)
Who needs this DPA?
This DPA applies to every Chatzen client who uses the Platform to process personal data of third parties (i.e., your customers, contacts, or end-users). Under the Digital Personal Data Protection Act, 2023 (India), businesses that determine the purpose and means of processing personal data are “Data Fiduciaries” (Controllers); Chatzen, which processes data solely on your instructions, is a “Data Processor” (Consent Manager / Processor).
If you require a wet-signed hard copy of this DPA for your compliance records, contact legal@chatzen.in. We will provide a countersigned version within 5 business days.
1. Definitions
2. Scope & Application
This DPA applies to all personal data that Chatzen processes on behalf of the Controller in connection with the provision of the Platform, including but not limited to:
- Personal data of the Controller's customers who send or receive WhatsApp messages via the Platform
- Personal data contained in bulk campaign contact lists uploaded by the Controller
- Personal data contained in knowledge base documents uploaded by the Controller
- Personal data of the Controller's team members who are granted access to the Platform
- Personal data collected through website chat widgets deployed by the Controller
This DPA does not apply to personal data that Chatzen processes as a Controller for its own purposes (e.g., Controller's account information for billing and service administration), which is governed by the Privacy Policy.
3. Roles & Responsibilities
3.1 Controller's Responsibilities
As the Data Controller / Fiduciary, you are solely responsible for:
- Establishing and maintaining a lawful basis for collecting and processing your customers' personal data (e.g., valid WhatsApp opt-in consent)
- Providing adequate privacy notices to your customers explaining how their data is processed
- Responding to data subject requests from your customers in a timely manner
- Ensuring all data you provide to Chatzen has been collected lawfully and with appropriate consent
- Ensuring your instructions to Chatzen comply with applicable data protection laws
- Notifying Chatzen of any changes to your processing instructions that may affect our obligations
- Maintaining a record of processing activities as required by applicable law
3.2 Processor's Responsibilities
As the Data Processor, Chatzen will:
- Process personal data only on the documented instructions of the Controller (as set out in this DPA and the Terms of Service) and for no other purpose
- Not process personal data for our own commercial purposes, including advertising, model training, or selling data to third parties
- Maintain the technical and organizational security measures described in Section 7
- Ensure all personnel with access to personal data are bound by contractual confidentiality obligations
- Assist the Controller in meeting its obligations to data subjects and regulatory authorities
- Notify the Controller promptly of any data breach affecting their data
4. Details of Data Processing
| Category of Personal Data | Data Subjects | Purpose of Processing | Retention |
|---|---|---|---|
| WhatsApp phone numbers and display names | Controller's customers / contacts | Identify, route, and deliver WhatsApp messages; display in inbox | 12 months from last message |
| WhatsApp message content (text, images, documents, audio, video) | Controller's customers / contacts | Display in shared inbox; AI-powered auto-response generation; campaign delivery | 12 months from message date |
| Conversations belonging to a channel the Controller disconnects (WhatsApp number, Facebook, Instagram) | Controller's customers / contacts | Retained briefly to allow the Controller to recover them by reconnecting the channel | Archived on disconnect; permanently deleted after 30 days unless reconnected or deleted immediately by the Controller |
| Contact metadata (tags, labels, notes, lead status, custom fields) | Controller's customers / contacts | CRM management and lead tracking within the Platform | Duration of account |
| Campaign contact lists and opt-in status records | Controller's opted-in contacts | Broadcast messaging campaign delivery and compliance records | 12 months from campaign |
| Knowledge base content (may contain personal data depending on what Controller uploads) | Varies - determined by Controller | Training AI agents; generating AI responses to customer queries | Until deleted by Controller |
| Team member names, email addresses, and role assignments | Controller's team members | Authentication, access control, and audit logging within the Platform | Duration of account + 30 days |
| Website chat widget visitor messages and session IDs | Visitors to Controller's website | AI-powered chat responses; conversation logging for Controller review | 12 months from session |
5. Processor Obligations
Chatzen commits to the following obligations as Data Processor:
5.1 Instruction-Based Processing
We will process personal data only on the documented instructions of the Controller, as set out in this DPA and the Terms of Service. If we receive a legal obligation requiring us to process personal data for other purposes, we will inform the Controller before complying (unless prohibited by law from doing so).
5.2 Confidentiality
We will ensure that all employees, contractors, and agents who process personal data under this DPA are: (a) authorized to do so, (b) bound by contractual confidentiality obligations, and (c) granted access only to the minimum personal data necessary to perform their duties (least-privilege principle).
5.3 Assistance with Controller Obligations
We will assist the Controller, taking into account the nature of the processing, in fulfilling:
- Data subject access, correction, portability, and deletion requests - we will provide the necessary data export or deletion within 5 business days of the Controller's instruction
- Data Protection Impact Assessments (DPIAs) where required
- Notifications to supervisory authorities following a data breach
5.4 No Independent Use
We will not use personal data processed under this DPA to: build audience profiles for advertising; train foundational AI models; sell to any third party; or process for any purpose beyond providing the Platform to the Controller.
6. Sub-processors
We currently engage the following approved sub-processors. We will provide the Controller with at least 14 days' advance written notice of any intended change to this sub-processor list (addition, replacement, or removal). The Controller may object to the change within 14 days with written notice to privacy@chatzen.in. If no resolution is reached, the Controller may terminate the Agreement on 30 days' notice.
| Sub-processor | Role | Personal Data Transferred | Country | Legal Safeguard |
|---|---|---|---|---|
| Meta Platforms, Inc. | WhatsApp Business Cloud API - message delivery and management | Phone numbers, message content, media, WABA tokens | USA | Standard Contractual Clauses (SCCs) |
| OpenAI, L.L.C. | AI inference - GPT model API | Message content and knowledge base text required for response generation | USA | Enterprise DPA / SCCs - no model training on our data |
| Anthropic, PBC (optional) | AI inference - Claude model API (alternate) | Message content and knowledge base text required for response generation | USA | Enterprise DPA / SCCs - no model training on our data |
| Amazon Web Services, Inc. | Cloud infrastructure, database hosting (RDS), object storage (S3) | All Platform data including personal data | India (ap-south-1) / USA | AWS DPA / SCCs |
| Google Cloud Platform (optional) | Cloud infrastructure and compute (alternate) | All Platform data including personal data | India / USA | Google Cloud DPA / SCCs |
| Vector DB Provider (Pinecone / Qdrant) | Storage and retrieval of knowledge base embedding vectors | Embedding vectors (derived from knowledge base content) | USA / EU | Provider DPA / SCCs |
| Razorpay Software Pvt. Ltd. | Payment processing and subscription billing | Billing email, organization name, transaction amounts | India | RBI-compliant; Razorpay DPA |
| SendGrid / Amazon SES | Transactional email delivery (OTPs, invoices, notifications) | Email address, name, email message content | USA | Provider DPA / SCCs |
Each sub-processor is bound by a data processing agreement that requires them to implement data protection measures at least as stringent as those required by this DPA.
7. Technical & Organizational Security Measures
Chatzen implements and maintains the following security measures to protect personal data processed under this DPA, in accordance with Article 32 of the GDPR and the DPDP Act 2023:
🔒 Encryption
- ✓TLS 1.3 for all data in transit
- ✓AES-256 for all data at rest
- ✓Encrypted storage of Meta API tokens and refresh tokens
- ✓Bcrypt (cost factor 12) for all password hashes
🛡️ Access Control
- ✓Role-Based Access Control (RBAC) with least-privilege
- ✓JWT access tokens with 15-minute expiry
- ✓HTTP-only, Secure, SameSite refresh token cookies
- ✓Multi-factor authentication available for all accounts
- ✓Admin access to production requires separate credentials
🏗️ Infrastructure
- ✓VPC network isolation - database not internet-accessible
- ✓Web Application Firewall (WAF) on all public endpoints
- ✓DDoS protection and API rate limiting
- ✓Automated daily database backups with point-in-time recovery
- ✓Separate production and staging environments
📋 Monitoring & Governance
- ✓Audit logs for all sensitive data access and admin actions
- ✓Anomaly detection for login and API activity
- ✓Incident response plan with defined SLAs
- ✓Regular internal security reviews
- ✓Third-party penetration testing (annual minimum)
- ✓Staff data security training
8. Data Subject Rights Assistance
We will provide commercially reasonable assistance to the Controller in responding to data subject requests. When a data subject exercises their rights under the DPDP Act 2023 or GDPR, and you submit a corresponding instruction to us:
| Data Subject Right | How We Assist | Our Response Time |
|---|---|---|
| Right to Access | Export all personal data for a specific phone number or contact ID in JSON format | 5 business days |
| Right to Correction | Update contact records (name, tags, custom fields) as instructed; or you can update directly in the Platform | Immediate (direct) / 2 business days (via us) |
| Right to Erasure | Permanently delete all data for a specific contact from our databases and backups (within backup rotation cycle) | 30 days from instruction |
| Right to Data Portability | Export conversations and contact data in CSV or JSON format (available via Settings → Export Data, or on request) | Immediate (self-serve) / 5 business days (request) |
| Right to Restrict Processing | Place a processing hold on specific contact records upon written instruction | 2 business days |
| Right to Object | Stop processing personal data for specific purposes as instructed | 2 business days |
All requests should be submitted to privacy@chatzen.in by the Controller with the subject line "Data Subject Assistance Request - [Right Type]" and the relevant contact identifier (phone number or contact ID).
9. Data Breach Notification
9.1 Our Notification Obligation
In the event of a personal data breach affecting data we process on your behalf, Chatzen will:
- Notify the Controller at the registered account email address within 72 hours of becoming aware of the breach
- Provide in the notification (or as soon as reasonably practicable thereafter): the nature of the breach; the categories and approximate number of data subjects and records affected; the likely consequences of the breach; the measures taken or proposed to address the breach and mitigate its effects
- Provide reasonable cooperation to the Controller in any regulatory notification the Controller is required to make
- Take prompt steps to contain, remediate, and prevent recurrence of the breach
9.2 Your Reporting Obligations
Depending on your jurisdiction, you may have independent obligations to notify supervisory authorities and/or data subjects of certain breaches. We will assist you with such notifications but are not responsible for making them on your behalf.
9.3 Reporting a Suspected Incident
To report a suspected security incident or potential breach involving your data, contact us immediately at security@chatzen.in. We have a 24-hour response SLA for security incident reports.
10. International Data Transfers
Some processing under this DPA involves transfers of personal data outside India, primarily to the USA (via AI providers and infrastructure sub-processors). We ensure all such transfers are protected by appropriate legal safeguards:
- Standard Contractual Clauses (SCCs): We have executed SCCs with all sub-processors located outside India where required
- Adequacy: Where a sub-processor is located in a country recognized as providing adequate protection, we rely on that adequacy determination
- No Model Training: AI providers (OpenAI, Anthropic) process message content solely for inference (generating responses) under our enterprise agreements. They contractually commit not to use this data to train their foundational models.
- Data Minimization: We transmit only the minimum context necessary for each AI inference call - we do not send complete conversation histories unless required for context
11. Audit Rights
The Controller has the right to audit Chatzen's compliance with this DPA. To exercise this right:
- Submit a written audit request to privacy@chatzen.in with at least 30 days' advance notice
- Audits must be conducted during our normal business hours (Monday–Friday, 9am–6pm IST) and must not unreasonably disrupt our operations
- The Controller may conduct audits personally or through an independent third-party auditor who has signed a non-disclosure agreement with Chatzen
- Audit costs (including our staff time) are borne by the Controller, unless the audit reveals a material breach of this DPA attributable to Chatzen
- We may, at our discretion, satisfy audit requests by providing: third-party security audit reports; penetration test summaries (redacted where necessary); or relevant compliance certifications
- Audits are limited to data and systems related to the Controller's own data; access to other clients' data is strictly prohibited
12. Return & Deletion of Personal Data
Upon termination of the Agreement (for any reason) or upon the Controller's written request:
- We will provide a full export of the Controller's personal data in JSON format within 14 days of the termination or request date
- All personal data processed under this DPA will be permanently and irreversibly deleted from our active systems within 30 days of the termination or deletion instruction
- Backup snapshots containing the Controller's data will be overwritten within 60 days of the deletion date as part of the normal backup rotation cycle
- Financial records (invoices, payment records) required by Indian statutory law will be retained for 7 years but are isolated from operational data and inaccessible for any other purpose
- We will provide a written certificate of deletion within 5 business days of completing the deletion process, upon the Controller's request
13. Term & Termination
This DPA is effective from the date the Controller first accepts the Terms of Service and remains in force for as long as Chatzen processes personal data on behalf of the Controller.
This DPA automatically terminates upon the earlier of: (a) termination of the Terms of Service; or (b) completion of the deletion process described in Section 12, after which Chatzen processes no further personal data on behalf of the Controller.
Sections 5.4 (No Independent Use), 7 (Security Measures), 9 (Breach Notification), 12 (Return & Deletion), and 14 (Governing Law) survive termination of this DPA.
14. Governing Law
This DPA is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, and any regulations thereunder. Any disputes arising under this DPA shall be resolved in accordance with the dispute resolution provisions of the Terms of Service (Section 17 of the ToS - Governing Law & Dispute Resolution).
Where the Controller is based in the European Economic Area (EEA) and this DPA involves the processing of personal data of EEA data subjects, this DPA is also intended to comply with the requirements of the GDPR (Regulation (EU) 2016/679). In the event of conflict between the DPDP Act and the GDPR requirements for EEA data, the higher standard of protection applies.
15. Contact
DPA & Privacy
privacy@chatzen.inData rights requests, DPA inquiries, sub-processor changes. Response within 30 days.
Security Incidents
security@chatzen.inData breaches and security vulnerabilities. 24-hour response SLA.
Legal & Signed DPA
legal@chatzen.inRequest a wet-signed countersigned DPA for your compliance records.
DPA Acceptance
By accepting the Chatzen Terms of Service, you (as the Data Controller / Fiduciary) confirm that you have read, understood, and agree to this Data Processing Agreement. Your acceptance is electronically recorded with timestamp and stored with your account record.
If you require a physical countersigned copy of this DPA for your GDPR, DPDP Act, or enterprise compliance records, email legal@chatzen.inwith the subject “Signed DPA Request - [Your Organization Name]”.