--- title: "Data Processing Terms (DPA) | ConvoBox" description: "ConvoBox Inc data processing terms for business customers: scope, instructions, confidentiality, security, sub-processors, data requests, audits and deletion." url: https://www.convobox.in/data-processing-addendum/ publisher: ConvoBox Inc --- [Legal](https://www.convobox.in/legal/) · Policy # Data Processing Terms (DPA) Processor terms for business customers who upload contact data. **Last updated:** 8 November 2026**Effective:** 8 November 2026**Provider:** ConvoBox Inc, Bengaluru and Salem, India Contents 1. [Scope and roles](#scope) 2. [Processing on instructions](#instructions) 3. [Confidentiality](#confidentiality) 4. [Security measures](#security) 5. [Sub-processors](#subprocessors) 6. [Assisting with data principal requests](#requests) 7. [Personal data breach](#breach) 8. [Return and deletion](#return) 9. [Information and audits](#audit) 10. [Liability and law](#liability) 11. [Contact](#contact) You are the data fiduciary and ConvoBox is your data processor. We process contact data only on your instructions, keep it confidential, apply sensible security controls, use listed categories of sub-processors, help with data principal requests, and return or delete data when you leave. ## Scope and roles These Data Processing Terms ("DPA") apply to personal data that a business customer ("Customer") uploads to or exchanges through ConvoBox, such as customer phone numbers, names, custom fields and WhatsApp message content ("Customer Personal Data"). They form part of the [Terms and Conditions](https://www.convobox.in/terms-and-conditions/). The Customer is the data fiduciary (controller). ConvoBox Inc ("ConvoBox") is the data processor. If these terms conflict with the Terms about the processing of Customer Personal Data, this DPA applies. This DPA does not cover ConvoBox's own account, billing and website data, which is covered by the [Privacy Policy](https://www.convobox.in/privacy-policy/). ## Processing on instructions - ConvoBox processes Customer Personal Data only to provide the Services and on the Customer's documented instructions, which include use of the platform features, the Terms and this DPA. - ConvoBox does not sell Customer Personal Data or use it for advertising. - If ConvoBox believes an instruction breaks applicable law, it will tell the Customer. - The Customer is responsible for having a lawful basis and valid opt-in for the data it uploads and the messages it sends. See the [Acceptable Use and WhatsApp Messaging Policy](https://www.convobox.in/acceptable-use-policy/). ## Confidentiality ConvoBox allows access to Customer Personal Data only to people who need it to provide the Services, and who are bound by confidentiality duties. ## Security measures ConvoBox applies reasonable technical and organisational measures to protect Customer Personal Data. In general terms, these include access controls, role-based access, and encryption of data in transit. See [Security at ConvoBox](https://www.convobox.in/security/). ConvoBox may update its measures over time but will not reduce overall protection in a material way. ## Sub-processors The Customer agrees that ConvoBox may use sub-processors to deliver the Services. They fall into these categories: - Cloud hosting providers - Payment processors - Analytics providers - Meta Platforms, Inc. (WhatsApp), which delivers WhatsApp messages The current list is available on request at [info@convobox.in](mailto:info@convobox.in). ConvoBox remains responsible for its sub-processors and requires them to protect data under terms no less protective than this DPA. If the Customer has a reasonable objection to a new sub-processor, it can raise it with us at the same address. ## Assisting with data principal requests If a person asks ConvoBox to access, correct or erase Customer Personal Data, ConvoBox will refer them to the Customer where it can, and will give the Customer reasonable help to respond within the time the law allows. The Customer can also manage its contacts inside the platform. See [Data Protection and DPDP Act](https://www.convobox.in/data-protection-and-dpdp/). ## Personal data breach If ConvoBox becomes aware of a personal data breach affecting Customer Personal Data, it will notify the Customer without undue delay and give the information it has to help the Customer meet its legal duties. ## Return and deletion When the Customer's account ends, the Customer can ask for a copy of its data before closure. After that, ConvoBox will delete or anonymise Customer Personal Data within a reasonable period, unless the law requires it to keep some. Backups are removed on their normal cycle. To ask for confirmation of deletion, write to [info@convobox.in](mailto:info@convobox.in). ## Information and audits On reasonable written request, ConvoBox will give the Customer information needed to show compliance with this DPA. Where that is not enough, the Customer may request an audit. Audits must be agreed in advance, happen during business hours, avoid disrupting service, protect other customers' data, and be at the Customer's cost. ## Liability and law The limits of liability in the Terms apply to this DPA. Indian law governs it, and the courts in Tamil Nadu, India have exclusive jurisdiction. ## Contact Write to [info@convobox.in](mailto:info@convobox.in) for a signed copy of this DPA, the sub-processor list or any question. Legal notices go to the same address. **Related:** [Data Protection and DPDP Act](https://www.convobox.in/data-protection-and-dpdp/) [Privacy Policy](https://www.convobox.in/privacy-policy/) [Security at ConvoBox](https://www.convobox.in/security/) [Terms and Conditions](https://www.convobox.in/terms-and-conditions/) Write to us and we will reply. You can also reach ConvoBox Inc at [info@convobox.in](mailto:info@convobox.in), or call or WhatsApp [+91 73385 19445](https://wa.me/917338519445). This page is a plain-language document written in good faith. It is general information and not legal advice. --- Source: https://www.convobox.in/data-processing-addendum/ · © ConvoBox Inc