Data Processing Agreement

Last updated: 20 October 2026

This Data Processing Agreement ("DPA") forms part of the agreement between the business using Zooqq ("Customer", "you") and Gempluse infotech pvt. ltd., which operates Zooqq ("Zooqq", "we"), made up of our Terms of Service and any order you place (the "Agreement"). It applies whenever Zooqq processes personal data on your behalf while providing the Service. You accept it when you tick the DPA box at sign-up or use the Service.

1. Definitions

• Customer Personal Data: personal data of your contacts and other individuals that you, or your contacts, put into the Service, such as names, phone numbers, emails, messages, media, notes, Flow responses and data from apps you connect.
• Data Protection Laws: India's Digital Personal Data Protection Act, 2023 and its rules, the Information Technology Act, 2000 and its rules, and, where they apply to you, the GDPR and similar laws.
• Sub-processor: a third party Zooqq engages to process Customer Personal Data.
• Personal Data Breach: a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Customer Personal Data.

"Controller" includes a "data fiduciary", and "processor" includes a "data processor", as those terms are used in the DPDP Act.

2. Roles

You are the controller of Customer Personal Data and decide why and how it is processed. Zooqq is your processor and processes it only on your documented instructions. Your instructions are given by the Agreement, by how you configure and use the Service (for example, sending campaigns, enabling AI features or connecting apps), and by any further written instructions we agree.

Zooqq is a separate controller for the account, billing and usage data of your own team members, as described in our Privacy Policy.

3. Details of processing

• Subject matter and purpose: providing the Service: WhatsApp messaging through Meta's Cloud API, team inbox, campaigns, chatbots and Flows, AI features, contact management, integrations, support and security.
• Duration: the term of the Agreement, plus the deletion period in section 10.
• Data subjects: your contacts, customers and leads, and other people whose data you add.
• Categories of data: names, phone and WhatsApp numbers, email addresses, profile pictures, message content and media, shared locations, Flow form responses, opt-in and opt-out status, notes, order or appointment data from connected apps, and AI-generated summaries, sentiment and lead scores.
• Sensitive data: the Service is not designed for special categories of data (such as health, financial account or government ID data). If you choose to process it, you are responsible for the additional safeguards the law requires.

4. Your responsibilities

• You have a lawful basis, including any notice and consent required, to collect Customer Personal Data and to message your contacts on WhatsApp, and you honour opt-out requests.
• Your instructions to us comply with Data Protection Laws and Meta's WhatsApp policies.
• You tell your contacts where required that you use AI features and third-party apps to process their data.
• You obtain verifiable parental consent before processing children's data where the law requires it.

5. Zooqq's obligations

• Process Customer Personal Data only on your instructions, and tell you if we believe an instruction breaks Data Protection Laws.
• Not sell Customer Personal Data or use it for our own advertising or to train general-purpose AI models.
• Ensure our staff with access are bound by confidentiality and access only what they need for their role, such as to provide support you request.
• Apply the security measures in section 6.
• Help you meet your obligations for data subject requests, security, breach notification and impact assessments, as described in this DPA.

6. Security measures

• Encryption in transit (HTTPS/TLS) for the app, API and webhooks.
• Encryption at rest for credentials and secrets, including two-factor authentication secrets, AI provider keys, storage and email credentials, webhook signing secrets and connected-app tokens. Passwords are stored as salted hashes.
• Logical separation of each customer's data in its own database.
• Role-based permissions inside each account, two-factor authentication and passkeys, and rate limiting on sign-in and sensitive actions.
• Signed webhooks to your endpoints, and masking of email addresses and phone numbers in AI usage records.
• Automatic deletion of raw WhatsApp webhook logs after 30 days.

We may update these measures as long as the overall level of protection is not reduced.

7. Sub-processors

You authorise Zooqq to use the following categories of Sub-processors. Some apply only when you use the related feature:

• Meta Platforms: WhatsApp Business Platform (Cloud API) for sending and receiving messages.
• Hosting and infrastructure: Railway and Amazon Web Services (including message queues in the Mumbai region), databases, caching and a vector database for the AI knowledge base.
• File storage: Amazon S3 or Microsoft Azure Blob Storage, for media and documents.
• Email delivery: Amazon SES or Mailgun, for notification emails such as conversation exports.
• AI model providers (only if AI features are enabled): Google (Gemini), OpenAI, DeepSeek, or models through OpenRouter. If you connect your own AI provider key, that provider acts under your own agreement with it.

Apps you choose to connect (such as Shopify, CRMs, calendars or Microsoft Teams) receive data on your instructions under your own agreements with them and are not our Sub-processors.

We bind each Sub-processor to data protection terms no less protective than this DPA and remain responsible for its performance. We will update this list before adding or replacing a Sub-processor. If you have a reasonable data protection objection, tell us within 30 days at [email protected]. If we cannot resolve it, you may stop using the affected feature or end the Agreement.

8. International transfers

Customer Personal Data may be processed in India and other countries where Zooqq and its Sub-processors operate. WhatsApp messages pass through Meta's Cloud API, which runs in data centres outside India. We transfer data only as permitted by Data Protection Laws, including any restrictions the Government of India sets under the DPDP Act, and, where the GDPR applies, with appropriate safeguards such as standard contractual clauses.

9. Data subject requests

Requests from your contacts to access, correct, erase or stop processing their data are yours to answer. You can handle most of them yourself in the Service, for example by editing or permanently deleting a contact. Opt-out replies such as STOP or UNSUBSCRIBE are recorded on the contact automatically. If a request comes to us directly, we will pass it to you without undue delay and not answer it ourselves unless you ask us to. We will give you reasonable help with requests you cannot handle in the Service.

10. Return and deletion

When the Agreement ends, or when you ask us to delete your account, we will delete Customer Personal Data within 30 days, as described on our Data Deletion page. Before then, you can save conversations and campaign reports from the Service, or ask us for help exporting data. We may keep data the law requires us to keep, and copies in backups until they expire, protected under this DPA.

11. Personal Data Breaches

If we become aware of a Personal Data Breach affecting your Customer Personal Data, we will notify you without undue delay, and in any case in time for you to meet your own legal notification duties. We will share the information we have about what happened, the data affected and the steps taken, update you as we learn more, and take reasonable steps to contain the breach and reduce its effects.

12. Audits and information

On reasonable written request, and no more than once a year unless a regulator requires it or a breach has occurred, we will provide information needed to show we comply with this DPA, such as answers to security questionnaires and descriptions of our measures. Any on-site audit must be agreed in advance, at your cost, under confidentiality, and without access to other customers' data.

13. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms of Service on the processing of Customer Personal Data, this DPA prevails.

14. Contact

Questions about this DPA, or requests under it: [email protected]. Postal address: Gempluse infotech pvt. ltd., 7/449, Sector 7, Opposite The Lalit hotel, Malviya Nagar, Jaipur.