Data processing agreement (summary)

1. Roles

You are the controller of your customers' data; Webgrup is the processor. Webgrup processes the data only on your documented instructions, which are the use of the service features you configure.

2. Subject matter

Data: WhatsApp phone numbers, profile names, message content and media, consent records, and order or booking details. Data subjects: your customers and contacts. Duration: while your account is open, then deletion within 30 days.

3. Our commitments

• Process data only on your instructions and not for our own purposes.
• Ensure staff with access are bound by confidentiality and limited by role.
• Apply appropriate security: encryption of secrets, TLS, tenant isolation, audit logs.
• Help you answer data subject requests and notify you of a personal data breach without undue delay.
• Delete or return data when the service ends, and allow audits through reasonable information requests.

4. Subprocessors and transfers

You authorise the subprocessors listed on the subprocessors page. We bind each of them to equivalent data protection obligations and tell you about additions or replacements in advance so you can object. Transfers abroad rely on the safeguards required by KVKK Article 9 and, where it applies, GDPR Chapter V.

5. Responsibilities of the controller

You decide why and how your customers' data is used, you need a lawful basis (including opt-in consent) for each message you send, and you must tell your customers that you use 24msg and WhatsApp to message them.