Skip to content

Legal information

Data Processing Agreement (DPA)

Last updated: 29 October 2026

This Data Processing Agreement ("DPA" or "Agreement") forms part of the Terms of Service between the customer ("Controller") and TidyChat ("Processor") and governs the processing of personal data that TidyChat carries out on the Controller's behalf, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR").

In the event of a conflict between this Agreement and the Terms of Service, this Agreement prevails with respect to the processing of personal data. If the Controller and TidyChat have separately executed a written data processing agreement, that agreement prevails over the version published here, unless it states otherwise.

1. Definitions

"Personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in Article 4 GDPR. In addition:

  • "Service" means the TidyChat platform, including the AI assistant for WhatsApp and website chat, the shared inbox and the contact and lead management features, as described in the Terms of Service.
  • "Sub-processor" means any third party engaged by the Processor to process personal data on the Controller's behalf.
  • "Authorised Users" means the members of the Controller's team to whom the Controller grants access to the Service.

2. Subject matter, nature and purpose of processing

Subject matter: the provision of the Service to the Controller.

Nature: the operations required to operate the Service, in particular collection, recording, storage, organisation, retrieval, use, disclosure to the Controller and its Authorised Users, generation of automated replies using artificial intelligence, transcription of voice messages and interpretation of files sent by data subjects, and erasure.

Purpose: solely the provision of the Service in accordance with the Controller's documented instructions. The Processor does not process the Controller's personal data for its own purposes and does not sell it to third parties.

3. Duration of processing

Processing continues for as long as the Controller uses the Service and for as long as the Controller maintains an active account or personal data within the Service. On termination, Section 12 (Deletion or return of data) applies.

4. Categories of data subjects

Data subjects are determined by how the Controller uses the Service and may include:

  • the Controller's customers and prospective customers;
  • persons who contact the Controller via WhatsApp or the chat on the Controller's website;
  • the Controller's Authorised Users;
  • any other persons whose personal data the Controller or its Authorised Users enter into the Service.

5. Types of personal data

The types of data processed depend on how the Controller configures and uses the Service and may include:

  • identification and contact data (for example name, WhatsApp phone number, email address, profile picture);
  • the content of messages exchanged with the Controller, including voice messages, images, documents and shared locations;
  • conversation metadata (for example message timestamps, channel used, conversation stage);
  • information about prospective customers that the Controller chooses to collect or record in the Service (for example expressed interest, budget, appointments);
  • the data of Authorised Users required to administer the account.

The Service is not intended for the processing of special categories of personal data under Article 9 GDPR. The Controller is responsible for not entering such data into the Service and for not asking data subjects to provide it, unless it has an appropriate legal basis.

6. Controller's instructions

The Processor shall process personal data only on the Controller's documented instructions, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject.

Where processing is required by such law, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

The Controller's documented instructions include this Agreement, the Terms of Service, and the configurations, settings, and instructions established by the Controller within the Service, including AI assistant instructions, data fields, and automated messaging rules.

The Processor shall promptly inform the Controller if, in its opinion, an instruction infringes the GDPR or other applicable Union or Member State data protection law.

The Controller is responsible for ensuring the lawfulness of its processing activities, including establishing an appropriate legal basis, providing required privacy notices, obtaining necessary consents, and complying with applicable messaging platform requirements.

7. Confidentiality

The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access to personal data is limited to what is necessary to provide the Service.

8. Technical and organisational security measures

The Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. As at the date of this version, these measures include:

  • encryption of traffic (TLS) between users' devices and the Service's content delivery network;
  • application-level encrypted storage of credentials and access keys (for example channel credentials, API keys, two-factor authentication secrets);
  • logical isolation of each workspace's (customer account's) data, enforced in application code and verified by automated tests for the core entities;
  • role-based access control for both Authorised Users (owner, administrator, agent, viewer) and TidyChat staff, following the principle of least privilege;
  • mandatory two-factor authentication for TidyChat staff accounts;
  • an append-only audit log of relevant operations with cryptographically chained entries, whose integrity is verified daily;
  • access to media files only through signed, time-limited URLs;
  • removal of message content, phone numbers and email addresses from automated error reports;
  • hosting of the database and other internal services on a private network with no direct exposure to the internet.

The Processor reviews and improves these measures periodically and may replace a measure with one that is at least equivalent.

9. Sub-processors

The Controller grants the Processor general written authorisation to engage sub-processors as necessary to provide and maintain the Service.

The Processor shall maintain an up-to-date list of authorised sub-processors, specifying their identities, processing activities, and relevant processing locations. The list shall be made available on the Service's Sub-processor page.

The Processor shall:

a. Provide the Controller with prior notice of any intended addition or replacement of a sub-processor before that sub-processor begins processing the Controller's personal data.

b. Allow the Controller 15 days from such notice to object to the proposed change on reasonable data protection grounds.

c. Make reasonable efforts to address any objections. Where an objection cannot reasonably be resolved, the Controller may discontinue the affected Service or terminate the relevant processing services in accordance with the applicable contractual terms.

d. Impose on each sub-processor, through a written agreement or other legally binding arrangement, data protection obligations providing substantially the same level of protection as those imposed on the Processor under this Agreement, including appropriate technical and organisational security measures.

e. Remain fully liable to the Controller for the performance of each sub-processor's data protection obligations, in accordance with Article 28(4) GDPR.

The engagement of sub-processors shall not reduce the Processor's obligations under this Agreement.

Where a sub-processor processes personal data outside the European Economic Area, the Processor shall ensure that the relevant transfer complies with Chapter V GDPR, as further described in Section 14.

10. Assistance with data subject rights

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR (for example access, rectification, erasure, restriction, portability, objection). The Service allows the Controller to view, correct, export and delete its contacts' data.

If a data subject contacts the Processor directly about data processed on the Controller's behalf, the Processor forwards the request to the Controller without undue delay and does not respond on the merits except on the Controller's instructions or where required by law.

11. Assistance with security obligations and personal data breaches

The Processor assists the Controller in meeting its obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it, including with data protection impact assessments and prior consultation of the supervisory authority.

In the event of a personal data breach affecting the Controller's data, the Processor notifies the Controller without undue delay after becoming aware of it and provides, as it becomes available, the information the Controller needs to meet its own notification obligations: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

12. Deletion or return of data

The Controller may request the return or deletion of personal data processed on its behalf, subject to applicable law and the technical capabilities of the Service.

The Processor shall make available appropriate data export functionality or other reasonable means of returning personal data in a structured, commonly used, machine-readable format.

Upon termination of the processing services, the Processor shall, at the Controller's choice, return or delete the personal data processed on the Controller's behalf and delete existing copies, unless Union or Member State law requires continued retention.

Workspace deletion

When an authorised workspace owner or TidyChat administrator initiates a workspace deletion request:

a. The workspace is suspended and access is restricted.

b. A 30-day recovery period begins, during which the authorised workspace owner may cancel the deletion request.

c. If the request is not cancelled, the workspace and its associated personal data, including contacts, conversations, messages, leads, attachments, and other operational records, are permanently deleted from active production systems at the end of the 30-day period, subject to applicable legal retention requirements.

d. Data remaining in backup copies is deleted or overwritten through the regular backup rotation process within a maximum of 30 additional days following deletion from active production systems.

e. During the backup retention period, such data shall be protected against routine access or use. Where a backup is restored, applicable deletion requests shall be reapplied.

Account and service termination

The discontinuation of a paid feature, expiration of a prepaid balance, or disconnection of a messaging channel does not, by itself, constitute a workspace deletion request.

Deletion of an individual user account shall be handled separately from deletion of workspaces belonging to or shared with other users.

Where termination requires the deletion or return of workspace personal data, the Processor shall provide the Controller with an appropriate means to exercise its choice under this Section.

Legal retention exceptions

The Processor may retain personal data where required by applicable Union or Member State law or where another lawful retention obligation applies.

Any retained data shall be limited to what is necessary, protected by appropriate safeguards, and deleted or anonymised when the applicable retention requirement expires.

The Processor shall not retain the Controller's personal data for unrelated purposes.

13. Audits and compliance information

The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

Audits normally take place no more than once per year, on reasonable prior written notice, during business hours, without unreasonably disrupting the Processor's operations and subject to the confidentiality of information relating to other customers. This limitation does not apply in the event of a personal data breach, a requirement of a supervisory authority, or where there are reasonable grounds to suspect material non-compliance with this Agreement.

14. International transfers

The Service's core infrastructure is hosted within the European Union. Certain authorised sub-processors and service providers may process or access personal data from locations outside the European Economic Area (EEA), including the United States.

The Processor shall not transfer personal data processed on behalf of the Controller to a country outside the EEA, or permit access to such data from outside the EEA, unless the transfer complies with Chapter V GDPR.

Where applicable, international transfers shall be supported by one or more of the following lawful mechanisms:

a. An adequacy decision adopted by the European Commission under Article 45 GDPR, including transfers to eligible organisations certified under the EU–US Data Privacy Framework where applicable.

b. The Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46 GDPR, using the appropriate modules and completed annexes, together with supplementary safeguards where necessary.

c. Another valid transfer mechanism permitted under applicable data protection law.

The Processor shall ensure that appropriate transfer arrangements are established with relevant sub-processors before transferring personal data.

Where the Processor relies on contractual safeguards, including SCCs, those safeguards shall be incorporated into legally binding arrangements between the relevant parties as required by applicable law.

The Processor shall make available, upon reasonable request and subject to applicable confidentiality restrictions, information concerning the relevant international transfers and safeguards.

Details of authorised sub-processors, their processing roles, and relevant processing locations shall be maintained on the Service's Sub-processor page.

Where personal data is processed through connected third-party messaging platforms, including WhatsApp, the Controller acknowledges that the relevant platform may process data in accordance with its own applicable terms and privacy arrangements. Such processing shall be assessed according to the parties' respective data protection roles and obligations.

Nothing in this Section limits the Controller's rights or the Processor's obligations under applicable data protection law.

15. Liability and final provisions

The parties' liability under this Agreement is subject to the limitations set out in Section 8 of the Terms of Service, to the extent permitted by law. This Agreement may be amended in accordance with the Terms of Service, and the Controller is informed in advance of material changes. No amendment may reduce the Processor's obligations under Article 28 GDPR or the level of protection of personal data provided by this Agreement; changes to sub-processors follow the notice and objection procedure in Section 9. This Agreement is published in Romanian, English and Hebrew; the Romanian version is the legally binding text and prevails in case of inconsistency.

Effective from: 2026-10-29 · V003