Data Processing Agreement

Effective date: May 25, 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between Equitysoft Technologies Pvt. Ltd. (“Processor”) and the customer (“Controller”) that subscribes to WapNotify. It governs the processing of Personal Data carried out by the Processor on behalf of the Controller in connection with the WapNotify Service.

1. Definitions

Personal Data: any information relating to an identified or identifiable natural person handled through the Service.
Data Subject: the end user / contact whose Personal Data is processed.
Sub-processor: a third party engaged by Equitysoft to process Personal Data on its behalf.
Applicable Laws: the Digital Personal Data Protection Act, 2023 (DPDP Act, India) and any other privacy laws applicable to the Controller’s use of the Service.

2. Roles & Responsibilities

The Controller determines the purpose and means of processing Personal Data through WapNotify (e.g. which contacts to import, which messages to send, which templates to use).

Equitysoft acts as a Processor and processes Personal Data only on documented instructions from the Controller. The Controller is responsible for the lawful basis of processing and for honoring Data Subject rights.

3. Nature & Purpose of Processing

Storing and indexing contacts, conversations, templates, broadcasts, and related metadata.
Routing inbound and outbound WhatsApp messages via the Meta Cloud API.
Generating analytics reports for the Controller.
Operating, maintaining, and supporting the Service.

4. Categories of Data Subjects & Data

Personal Data processed may include: name, phone number, email address, conversation content, tags, and custom fields of the Controller’s contacts; and account credentials of the Controller’s authorized users.

5. Security Measures

Encryption in transit via TLS 1.2+.
Database encryption at rest.
Bcrypt-hashed passwords; never stored in plaintext.
Role-based access control inside each workspace.
Multi-tenant isolation enforced at the application and query layer.
Audit logging of privileged super-admin actions.
Limited employee access on a need-to-know basis.

6. Sub-processors

To provide the Service, Equitysoft engages the following Sub-processors:

Meta Platforms, Inc. — WhatsApp Cloud API (message transit).
Hostinger / VPS provider — application hosting (India region).
Razorpay — payment processing (no contact/conversation data is shared).
Resend — transactional email delivery (recipient email + email body only).

We will notify the Controller of any planned addition or replacement of Sub-processors with reasonable advance notice.

7. Data Subject Rights

Equitysoft will, to the extent legally permitted, assist the Controller in responding to Data Subject requests for access, correction, deletion, or portability. Most rights can be exercised directly by the Controller using the Service (contact export, contact delete, etc.).

8. Data Breach Notification

If Equitysoft becomes aware of a Personal Data breach affecting the Controller’s data, it will notify the Controller without undue delay (no later than 72 hours after discovery) and provide reasonable information to support the Controller’s own notification obligations.

9. Data Location

Personal Data processed via WapNotify is stored on servers located in India. Some Sub-processors (e.g. Meta, Razorpay, Resend) may process data outside India in accordance with their own privacy notices.

10. Return or Deletion of Data

On termination of the subscription, the Controller may export all Personal Data within 30 days. After 30 days, Equitysoft will delete all Personal Data from active systems within 60 days, except where retention is required by law.

11. Audit

The Controller may request, no more than once per year and with 30 days’ written notice, a summary of Equitysoft’s security and data-protection practices. On-site audits are not currently offered.

12. Contact

Data protection contact: sales@wapnotify.com

See also: Privacy Policy · Terms of Service · Refund Policy · SLA