Data Processing Agreement

1. Roles and scope

Customer is the data controller (or equivalent) for personal data submitted to the platform, including contacts, conversations and message content. ClickMaker is the processor. ClickMaker remains a controller for account, billing and website data described in the Privacy Policy.

ClickMaker processes personal data only to provide the platform, secure it, support the customer and comply with law. Processing includes storage, transmission to Meta for WhatsApp delivery, event processing, logging and tenant-level analytics.

2. Customer instructions and confidentiality

The customer instructs ClickMaker to process data as needed to deliver the service and as configured in the dashboard and API. ClickMaker will notify the customer if an instruction appears unlawful, unless prohibited by law.

ClickMaker restricts access to personnel who need it, requires confidentiality obligations and maintains role-based access controls. Credentials and Meta tokens are not exposed to unauthorized staff or customers.

3. Security measures

• Encryption in transit using HTTPS.
• Encryption at rest for Meta access tokens and other secrets.
• Hashed API keys and passwords.
• Tenant-scoped authorization and database access patterns.
• Audit logging for sensitive actions and rate limiting.
• Secure file upload validation and retention controls.

4. Subprocessors and international transfers

The customer authorises ClickMaker to engage subprocessors for hosting, database, cache, storage, email, payments and monitoring. ClickMaker remains responsible for their performance and imposes data-protection obligations. A current list is available on request; material changes will be notified.

Where personal data is transferred across borders, the parties will rely on appropriate safeguards required by applicable law, such as standard contractual clauses, and will cooperate on transfer impact assessments where required.

5. Data subject requests and breach notification

ClickMaker will assist the customer in responding to access, correction, deletion and objection requests, taking into account the nature of processing. Where ClickMaker receives a request directly, it will redirect the requester to the customer unless legally required to act.

ClickMaker will notify the customer without undue delay after becoming aware of a personal data breach affecting customer data, and will provide information reasonably available to help the customer meet its own notification obligations. Notification is not an admission of fault.

6. Return, deletion and audits

On termination, ClickMaker will make available or delete customer data according to the agreement and the customer's configuration, subject to legal retention requirements and suppression records needed to honour opt-outs.

ClickMaker will provide information reasonably necessary to demonstrate compliance and will allow audits at a reasonable frequency, scope and time, subject to confidentiality and security controls. Enterprise audit terms may be defined in an order form.