Data Processing Terms (DPA)

Scope and roles

These Data Processing Terms ("DPA") apply to personal data that a business customer ("Customer") uploads to or exchanges through ConvoBox, such as customer phone numbers, names, custom fields and WhatsApp message content ("Customer Personal Data"). They form part of the Terms and Conditions. The Customer is the data fiduciary (controller). ConvoBox Inc ("ConvoBox") is the data processor. If these terms conflict with the Terms about the processing of Customer Personal Data, this DPA applies.

This DPA does not cover ConvoBox's own account, billing and website data, which is covered by the Privacy Policy.

Processing on instructions

• ConvoBox processes Customer Personal Data only to provide the Services and on the Customer's documented instructions, which include use of the platform features, the Terms and this DPA.
• ConvoBox does not sell Customer Personal Data or use it for advertising.
• If ConvoBox believes an instruction breaks applicable law, it will tell the Customer.
• The Customer is responsible for having a lawful basis and valid opt-in for the data it uploads and the messages it sends. See the Acceptable Use and WhatsApp Messaging Policy.

Confidentiality

ConvoBox allows access to Customer Personal Data only to people who need it to provide the Services, and who are bound by confidentiality duties.

Security measures

ConvoBox applies reasonable technical and organisational measures to protect Customer Personal Data. In general terms, these include access controls, role-based access, and encryption of data in transit. See Security at ConvoBox. ConvoBox may update its measures over time but will not reduce overall protection in a material way.

Sub-processors

The Customer agrees that ConvoBox may use sub-processors to deliver the Services. They fall into these categories:

• Cloud hosting providers
• Payment processors
• Analytics providers
• Meta Platforms, Inc. (WhatsApp), which delivers WhatsApp messages

The current list is available on request at info@convobox.in. ConvoBox remains responsible for its sub-processors and requires them to protect data under terms no less protective than this DPA. If the Customer has a reasonable objection to a new sub-processor, it can raise it with us at the same address.

Assisting with data principal requests

If a person asks ConvoBox to access, correct or erase Customer Personal Data, ConvoBox will refer them to the Customer where it can, and will give the Customer reasonable help to respond within the time the law allows. The Customer can also manage its contacts inside the platform. See Data Protection and DPDP Act.

Personal data breach

If ConvoBox becomes aware of a personal data breach affecting Customer Personal Data, it will notify the Customer without undue delay and give the information it has to help the Customer meet its legal duties.

Return and deletion

When the Customer's account ends, the Customer can ask for a copy of its data before closure. After that, ConvoBox will delete or anonymise Customer Personal Data within a reasonable period, unless the law requires it to keep some. Backups are removed on their normal cycle. To ask for confirmation of deletion, write to info@convobox.in.

Information and audits

On reasonable written request, ConvoBox will give the Customer information needed to show compliance with this DPA. Where that is not enough, the Customer may request an audit. Audits must be agreed in advance, happen during business hours, avoid disrupting service, protect other customers' data, and be at the Customer's cost.

Liability and law

The limits of liability in the Terms apply to this DPA. Indian law governs it, and the courts in Tamil Nadu, India have exclusive jurisdiction.

Contact

Write to info@convobox.in for a signed copy of this DPA, the sub-processor list or any question. Legal notices go to the same address.