Data Processing Agreement

Subject matter: Processing of Personal Data contained in contact lists, campaign content, verification requests, and WhatsApp contacts and messages submitted by the Customer to, or received through, the Platform.

Duration: For as long as the Customer maintains an active account, plus the retention periods described in the Privacy Policy (§9) and this DPA (§6).

Nature of processing: Collection, storage, verification (MX/SMTP lookups), transmission (campaign sending, and WhatsApp messages through Meta's WhatsApp Business Platform), and deletion of the data described above.

Purpose: To provide the email verification, campaign management and WhatsApp Marketing services the Customer has subscribed to.

Data subjects are the Customer's contacts — the individuals whose email addresses and associated fields (name, company, custom attributes) appear in uploaded lists. Categories of Personal Data are limited to what the Customer includes in an uploaded list or campaign; Saproh does not request or require special categories of data (GDPR Art. 9) and the Customer warrants it will not upload such data without an independent, documented lawful basis of its own.

For WhatsApp Marketing, data subjects also include the people the Customer messages. Their Personal Data comprises phone numbers, names and fields the Customer adds, consent and opt-out records, message delivery records, and the replies they send.

• Process Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by applicable law.
• Ensure persons authorized to process the Personal Data have committed to confidentiality.
• Implement appropriate technical and organizational security measures (see Privacy Policy §12), including encryption at rest for credentials and access-controlled infrastructure.
• Assist the Customer, insofar as possible, in responding to data subject requests (access, rectification, erasure, portability) and in ensuring compliance with security, breach-notification, and impact-assessment obligations.
• Notify the Customer without undue delay after becoming aware of a Personal Data breach affecting the Customer's data.
• At the Customer's choice, delete or return all Personal Data at the end of the provision of services, and delete existing copies, except where retention is required by law (see §6).
• Make available information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits conducted by the Customer or an auditor mandated by the Customer, on reasonable notice.

The Customer authorizes Saproh to engage the sub-processors listed in the Privacy Policy (§10.1). Saproh will impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains liable to the Customer for a sub-processor's performance of those obligations. Saproh will give the Customer reasonable notice of any intended addition or replacement of a sub-processor, giving the Customer the opportunity to object.

Where Personal Data is transferred outside the Customer's jurisdiction, Saproh relies on appropriate safeguards (such as Standard Contractual Clauses, where applicable) consistent with the mechanism described in the Privacy Policy's international-transfers section.

On termination, and following any request under the account-deletion process described in the Privacy Policy, the Customer's Personal Data is deleted per the timelines in Privacy Policy §9 — except for records Saproh must retain to comply with a legal obligation (e.g., financial/tax records), which are retained only for the period required and then deleted.

Each party's liability under this DPA is subject to the limitations of liability set out in the Terms of Service.