Data Processing Agreement
This DPA describes how Surya Narayana Enterprises LLP ("WhaBuzz", "we", "processor") processes data on behalf of a business using WhaBuzz ("customer", "controller") to send and receive WhatsApp messages.
| Processor | Surya Narayana Enterprises LLP |
|---|---|
| Registered address | F.No.5301, Tower 5, Prestige High Field, Gachibowli, Gachibowli, Seri Lingampally, K.V.Rangareddy - 500032, Telangana, India |
Roles
The customer is the data controller for its own contacts' data. WhaBuzz acts as a data processor, processing data only on the customer's instructions, as configured through the WhaBuzz console and API.
Scope of processing
- WhatsApp message content (text, template content, media references)
- Contact phone numbers and WhatsApp profile names
- Template content submitted for Meta's review
- Delivery metadata (message status, timestamps, provider message identifiers)
This data is processed only to provide the WhaBuzz service: sending and receiving WhatsApp messages, template management, and delivery tracking on the customer's behalf.
Sub-processors
| Meta Platforms, Inc. | WhatsApp Business Platform — delivers and receives the messages themselves. |
|---|---|
| Cloudflare, Inc. | Hosting and network — runs the WhaBuzz application and API. |
| Supabase | Database (hosted on AWS ap-south-1, Mumbai) — stores WhaBuzz's application data. |
Security measures
- Encryption in transit (HTTPS/TLS) for all traffic to and from WhaBuzz
- Access tokens and other secrets stored encrypted, never in plain text
- Tenant isolation enforced at the database level via row-level security, so one customer's data is never readable in another customer's request context
- Access to the WhaBuzz console requires an account created by an administrator; there is no public sign-up
Confidentiality
WhaBuzz treats all customer data as confidential and limits access to what is needed to operate and support the service.
Breach notification
If WhaBuzz becomes aware of a security incident affecting a customer's data, we will notify the customer without undue delay after becoming aware of it.
Assistance with data-subject requests
WhaBuzz will reasonably assist the customer in responding to requests from individuals to access, correct, or delete their data. See our data deletion page for the process WhaBuzz itself uses.
Deletion or return of data
On termination of a customer's use of WhaBuzz, or on request, WhaBuzz will delete or return the customer's data, except where retention is required by law.
Governing law
This DPA is governed by the laws of India.
Contact
Questions about this DPA: support@whabuzz.com.