Status of this document
This DPA is a customer-facing draft for review before onboarding. It should be reviewed by counsel before Zenkoo represents it as a final executed agreement.
1. Roles
- Customer is the controller for WhatsApp conversations, contacts, sales notes, pipeline data, follow-ups, and other personal data submitted to Zenkoo by the customer or its users.
- Zenkoo acts as a processor for customer content processed through the service, and processes that data only to provide, secure, support, and improve Zenkoo as instructed by the customer.
- Zenkoo acts as an independent controller for limited business data such as account administration, security logs, service communications, and product analytics where applicable.
2. Processing details
Providing a WhatsApp-first sales workspace, shared inbox, pipeline, follow-ups, team management, and reporting.
For the term of the customer account, plus any retention period needed for backups, security, legal compliance, or dispute handling.
Customer users, WhatsApp contacts/leads, team members, and people who communicate with connected WhatsApp numbers.
Names, email addresses, phone numbers, WhatsApp identifiers, messages, media, conversation metadata, notes, labels, assignments, follow-ups, and usage/security logs.
3. Customer instructions
Zenkoo processes customer personal data only according to the customer’s documented instructions, including the product configuration, account settings, support requests, and this DPA. Zenkoo may refuse instructions that appear unlawful or outside the service scope.
4. Customer responsibilities
- Customer must have a lawful basis for messaging contacts and using Zenkoo with WhatsApp data.
- Customer must provide any privacy notices and obtain any consents required for its team members, leads, and contacts.
- Customer is responsible for complying with WhatsApp, Meta, marketing, consent, and local privacy rules that apply to its messaging.
5. Security measures
- HTTPS in production for data in transit.
- HttpOnly secure session cookies in production, session expiry, rotation, and server-side revocation.
- Per-account authorization checks before returning conversations, media, or team data.
- bcrypt password hashing and rate limits on sensitive endpoints.
- Authenticated media routes, file size/type checks, defensive content headers, and account-scoped media storage.
- OAuth token encryption when OAuth integrations are configured.
6. Subprocessors
Zenkoo may use subprocessors listed on the Subprocessors page to provide infrastructure, authentication, transactional email, and optional analytics. Zenkoo will update that page when subprocessors materially change.
7. Data subject requests
Zenkoo will reasonably assist the customer with access, correction, deletion, export, restriction, objection, and portability requests related to customer data processed through Zenkoo. Requests can be sent through the privacy request workflow.
8. Return and deletion
At termination or upon verified request, Zenkoo will delete or return customer personal data unless continued retention is required for legal, security, backup, or legitimate business purposes. Backup copies are deleted according to normal backup cycles.
9. International transfers
If customer personal data subject to GDPR is transferred outside the EEA to a country without an adequacy decision, Zenkoo will use an appropriate transfer mechanism such as the European Commission Standard Contractual Clauses, where required.
10. Incident support
Zenkoo will notify affected customers without undue delay after becoming aware of a personal data breach involving customer personal data, and will provide reasonable information to support the customer’s own notification obligations.