WhatsAppBox is a software product operated by My-Conect Enterprise, a business registered in Kenya (BN-9PCKJ599).

Data Processing Addendum

Effective date: 20 September 2026

This Data Processing Addendum ("DPA") forms part of the Terms between the Merchant ("Controller") and Platform operator ("Processor") where we process personal data in Merchant Data on the Merchant's behalf.

Processing details

Processing supports provision of the Services for the subscription term plus authorized retention and deletion periods. It may include collection, recording, organization, storage, retrieval, consultation, transmission through WhatsApp and integrations, analytics, restriction and deletion.

Data subjects may include customers, prospects, staff, suppliers and contacts. Data may include names, numbers, messages and media, metadata, consent status, CRM data, order and delivery information, surveys, support records and identifiers. Do not provide sensitive data unless expressly authorized, necessary and lawful.

Instructions and compliance

We process personal data only on documented Merchant instructions—including the Terms, product configuration and authorized support requests—unless law requires otherwise. Where permitted, we will flag an instruction that appears to violate applicable data law.

The Merchant is responsible for lawful instructions, transparency, legal bases, consent, accuracy, minimization, retention, data-subject responses and regulatory compliance.

Confidentiality and security

Authorized personnel are subject to confidentiality. We maintain safeguards proportionate to risk, including access controls, tenant separation, authentication, logging, vulnerability management, backups and supported encryption or masking.

Subprocessors and transfers

The Merchant generally authorizes subprocessors needed for hosting, infrastructure, communications, email, security, support, payments and enabled integrations. Meta and WhatsApp are necessary recipients for WhatsApp functionality and may also act independently. We impose suitable protection duties on our subprocessors.

Where cross-border transfers require safeguards, the parties will use a recognized mechanism. The Merchant authorizes transfers needed for Meta, WhatsApp and enabled providers and assesses integrations it independently selects.

Assistance and incidents

Taking account of the processing and available information, we provide reasonable assistance with data-subject requests, security duties, impact assessments and regulator consultations where required. We will notify the Merchant without undue delay after confirming a personal-data breach affecting Merchant Data and provide reasonably available information. The Merchant handles regulatory and individual notices unless law assigns that duty to us.

Return, deletion and audit

After termination or documented request, we delete or return Merchant Data as the Services provide, except where law, security, backup integrity or disputes require retention. Data independently held by Meta, WhatsApp or integrations follows their terms.

We will provide reasonably necessary compliance information. Audits must be legally justified, scoped, confidential, protect other customers and avoid unreasonable disruption. Existing reports or questionnaires may be used first.

If this DPA conflicts with the Terms on Merchant personal data, this DPA controls. Mandatory law prevails. The WhatsApp Business Data Processing Terms may separately govern WhatsApp processing.