Data processing agreement

Version: 1.0 · Effective date: 16 October 2026

This Data Processing Agreement ("DPA") is between:

• Customer: the business that accepts the Terms of Service or signs the order form ("Customer"); and
• Processor: Aviral Techlab Private Limited ("Aviral Techlab", "we"), registered office H-89, 2nd Floor, Ashok Vihar Phase-1, Delhi 110052, India.

It forms part of the Aviral WhatsApp Platform Terms of Service or the signed order form (the "Agreement"). If this DPA and the Agreement conflict on data protection, this DPA wins.

Customers accept this DPA by accepting the Terms of Service. A countersigned copy, with the Customer's own details filled in, is available on request from privacy@aviraltechlab.com.

1. Definitions

• Applicable Data Protection Law: India's Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 ("DPDP"), the Information Technology Act, 2000 and its rules, and, where they apply, the EU GDPR and UK GDPR.
• Customer Personal Data: personal data we process for the Customer in providing the Service. Annex 1 describes it.
• Controller / Data Fiduciary: the party that decides the purpose and means of processing. Here, the Customer.
• Processor / Data Processor: the party that processes data for the Controller. Here, Aviral Techlab.
• Sub-processor: a third party we engage to process Customer Personal Data.
• Personal Data Breach: unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to Customer Personal Data, that compromises its confidentiality, integrity or availability.
• Data Principal / Data Subject: the person the data is about.

Other terms have the meaning in Applicable Data Protection Law.

2. Roles and scope

2.1 The Customer is the Data Fiduciary / Controller. Aviral Techlab is the Data Processor / Processor for Customer Personal Data.

2.2 This DPA doesn't cover data we process as a fiduciary for our own purposes, such as account, billing and security data. Our privacy policy covers that.

2.3 The Customer is responsible for:

• having a lawful basis for all processing, including valid WhatsApp opt-in and any notice and consent DPDP requires;
• the accuracy and lawfulness of Customer Personal Data;
• its instructions complying with the law.

2.4 Meta (WhatsApp) provides the Cloud API under terms the Customer accepts directly with Meta. Meta's own processing of message data is governed by those terms. We list Meta as a sub-processor in Annex 3 for transparency, because our Service sends data to and receives data from Meta.

3. Instructions

3.1 We process Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA, and the Customer's use and configuration of the Service are the instructions.

3.2 We may process data otherwise only if the law requires. Where allowed, we tell the Customer first.

3.3 We tell the Customer at once if we think an instruction breaks Applicable Data Protection Law. We may pause that processing until the Customer confirms or changes it.

3.4 We don't sell Customer Personal Data. We don't use it for our own purposes, except to create aggregated, de-identified statistics that identify no Customer or person.

3.5 AI processing. If the Customer turns on AI features, Customer Personal Data is sent to our AI sub-processor only to produce outputs for the Customer. Neither we nor that sub-processor use it to train models.

4. Confidentiality

4.1 Everyone we authorise to process Customer Personal Data is bound by confidentiality, by contract or law.

4.2 We grant access on a need-to-know, least-privilege basis. We remove it promptly when no longer needed.

4.3 Our staff with access receive data protection and security training.

5. Security

5.1 We maintain the technical and organisational measures in Annex 2. They are designed to give a level of security right for the risk.

5.2 We may update the measures, as long as we don't reduce the overall level of protection.

6. Sub-processors

6.1 The Customer gives general authorisation for the sub-processors in Annex 3. The current list is always at https://whatsapp.aviraltechlab.com/legal/subprocessors.

6.2 Notice of changes. We give at least 30 days' notice before adding or replacing a sub-processor. We email account admins and update the list page. Customers can subscribe to updates.

6.3 Objection. The Customer may object on reasonable data protection grounds within that notice period. We'll discuss it in good faith. If we can't resolve it, the Customer may end the affected part of the Service and get a pro-rata refund of prepaid fees for the unused period.

6.4 Emergency replacement. If we must replace a sub-processor urgently for security or continuity, we give notice as soon as we can.

6.5 We impose data protection terms on each sub-processor at least as protective as this DPA. We remain responsible for their performance.

7. Assistance with Data Principal rights

7.1 The Service lets the Customer find, export, correct and delete Customer Personal Data, and record opt-outs and consent withdrawals.

7.2 If a Data Principal contacts us directly about Customer Personal Data, we pass the request to the Customer within 5 business days, where we can identify the Customer. We don't respond ourselves unless the Customer tells us to or the law requires.

7.3 Where the self-service tools aren't enough, we help the Customer respond to requests for access, correction, completion, updating, erasure, nomination and grievance redressal under DPDP, and equivalent GDPR rights.

7.4 We also give reasonable help with data protection impact assessments and consultations with regulators, where needed for the Service.

8. Personal Data Breach

8.1 We notify the Customer without undue delay, and in any case within 72 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data. This lets the Customer meet its own duties, including:

• intimating the Data Protection Board of India and affected Data Principals under DPDP (including the detailed report to the Board within 72 hours);
• notifying a supervisory authority within 72 hours under the GDPR, where it applies.

8.2 The notice includes, as far as known:

• what happened, when, and when we found out;
• the categories and approximate number of Data Principals and records affected;
• the likely consequences;
• what we've done and will do to contain and fix it;
• a contact person.

We send more information as we learn it.

8.3 We take prompt steps to contain the breach, reduce harm and prevent a repeat.

8.4 We report incidents to CERT-In as Indian law requires.

8.5 We don't notify Data Principals or regulators about Customer Personal Data on the Customer's behalf unless the Customer asks or the law requires.

8.6 Notifying a breach isn't an admission of fault.

9. Deletion and return

9.1 During the Agreement, the Customer can export and delete Customer Personal Data with the Service's tools.

9.2 When the Agreement ends, the Customer has 30 days to export Customer Personal Data.

9.3 After that, we delete Customer Personal Data within 30 days. Encrypted backups are overwritten within a further 35 days. We confirm deletion in writing on request.

9.4 We may keep data only where the law requires, for the period required, and protected under this DPA.

9.5 When the Customer disconnects a WhatsApp Business Account, we delete its access token within 24 hours.

10. Audits and information

10.1 We make available the information needed to show we comply with this DPA. This includes:

• our latest third-party VAPT summary;
• security policies (summaries);
• any certifications we hold (for example ISO 27001 or SOC 2 reports, once obtained);
• answers to a reasonable security questionnaire, once a year.

10.2 If that isn't enough, or a regulator requires it, the Customer may audit us (or appoint an independent auditor bound by confidentiality):

• with at least 30 days' written notice;
• no more than once a year, unless after a Personal Data Breach or regulator demand;
• during business hours, without disrupting our operations or other customers' data;
• at the Customer's cost.

10.3 Meta may also audit our use of Platform Data under the Meta Platform Terms. The Customer agrees we may cooperate with such audits.

11. Cross-border transfers

11.1 We host the Service in India (AWS Mumbai, ap-south-1).

11.2 Some sub-processors process data outside India, as Annex 3 shows. The Customer authorises those transfers.

11.3 We won't transfer Customer Personal Data to a country the Central Government restricts under section 16 of the DPDP Act.

11.4 For data subject to the GDPR, transfers outside the EEA/UK use the EU Standard Contractual Clauses (Module 2 or 3, as fits) and the UK Addendum, which are incorporated by reference.

11.5 Data localisation option. The Customer may ask us to enable Meta's local storage option (India) for its phone numbers at registration, where Meta supports it.

12. Liability

12.1 Each party's liability under this DPA is subject to the exclusions and limits in the Agreement.

12.2 The limits don't restrict a party's liability to Data Principals where the law doesn't allow it, or penalties a regulator imposes directly on that party for its own breach.

12.3 Where the Data Protection Board or another regulator penalises a party because of the other party's breach of this DPA, the responsible party bears that cost, to the extent of its responsibility, subject to the Agreement's cap.

13. Term

This DPA lasts while we process Customer Personal Data under the Agreement. Clauses that by their nature should survive (confidentiality, deletion, liability) survive.

14. Governing law

This DPA is governed by the laws of India. Courts at New Delhi have exclusive jurisdiction, except where the Standard Contractual Clauses require otherwise for GDPR transfers.

Signatures

Complete this block only for a countersigned copy. Accepting the Terms of Service is enough for this DPA to apply.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

Encryption

• TLS 1.2 or higher for all data in transit, including to Meta and between our services.
• AES-256 encryption at rest for databases, object storage and backups.
• WhatsApp access tokens, two-step PINs and other secrets encrypted with per-tenant data keys (envelope encryption in AWS KMS). Secrets in AWS Secrets Manager. Tokens never sent in URL query strings.

Tenant isolation

• PostgreSQL row-level security (RLS) on every tenant table, set per request or transaction.
• Every query also passes through tenant-scoped repositories (defence in depth).
• Automated cross-tenant access tests run in CI and before each release.
• Realtime connections authenticated at handshake; room access checked per permission.

Access control

• Role-based access in the product, with custom roles and per-number permissions.
• Optional PII masking and phone-number hiding by role.
• Staff access on least privilege, with 2FA and SSO. Production access is time-bound and approved.
• Support impersonation needs a reason and is logged.
• Joiner-mover-leaver process; access reviews every quarter.

Logging and monitoring

• Audit logs for admin actions, data exports, logins and support impersonation.
• Access and security logs kept for at least 1 year, protected from tampering.
• Centralised monitoring and alerting for errors, unusual access and webhook anomalies.

Application security

• Inbound Meta webhooks verified with X-Hub-Signature-256 (HMAC-SHA256, constant-time). Unsigned or invalid requests rejected.
• Outbound webhooks to Customers signed with HMAC.
• Rate limits per tenant and per API key. Web application firewall in front of public endpoints.
• Secure development: code review, dependency scanning, secrets scanning, OWASP ASVS Level 2 checks.

Testing

• VAPT by an independent tester before general availability and at least once a year, plus after major changes. Critical and high findings fixed before release.

Availability and backups

• Managed, multi-availability-zone database in AWS Mumbai.
• Automated encrypted backups with point-in-time recovery. Retention up to 35 days.
• Restore tests at least every quarter.
• Documented incident response and business continuity plans.

People and organisation

• Confidentiality agreements for all staff and contractors.
• Security and privacy training at joining and every year.
• A named owner for security and a named Grievance Officer (Grievance Officer, Aviral Techlab Private Limited).

Data minimisation

• Inbound media copied to our storage only for the Customer's use. Retention configurable.
• Aggregated analytics de-identified.

Annex 3: Sub-processors

The live list is at https://whatsapp.aviraltechlab.com/legal/subprocessors. This table is the list on the effective date.

We add any further provider to this list before it goes live, and give 30 days' notice, as section 6 of the Data processing agreement describes.