1. Parties and Scope
This Data Processing Agreement ("DPA") governs the processing of personal data by MSEB SOLUTIONS LLC
("Processor", "Autosay") on behalf of the customer ("Controller") who subscribes to the Autosay
platform.
This DPA supplements and forms part of the Terms of Service. In case of conflict between this DPA and
the Terms, this DPA shall prevail regarding data processing matters.
2. Definitions
- Personal Data: Any information relating to an identified or identifiable
natural person as defined by GDPR Article 4(1) and KVKK Article 3
- Processing: Any operation performed on personal data, including collection,
recording, storage, retrieval, use, disclosure, and erasure
- Sub-processor: Any third party engaged by the Processor to process personal
data on behalf of the Controller
3. Scope of Processing
Categories of Data Subjects
- End customers who communicate via WhatsApp
- Business users (agents, admins) of the Autosay platform
Types of Personal Data
- Contact information (name, phone number, email)
- WhatsApp message content and metadata
- Conversation history and interaction data
- Product catalog browsing and purchase history
- Agent activity logs and session data
Purpose of Processing
Personal data is processed solely to provide the Autosay platform services, including WhatsApp
messaging, AI-powered conversations, CRM functionality, and analytics as described in the Terms of
Service.
4. Processor Obligations
- Process personal data only on documented instructions from the Controller
- Ensure persons authorized to process data are bound by confidentiality
- Implement appropriate technical and organizational security measures
- Assist the Controller in responding to data subject access requests
- Delete or return all personal data upon termination of services
- Make available all information necessary to demonstrate compliance
5. Security Measures
The Processor implements the following technical measures:
- Encryption at Rest: Industry-standard encryption for all personal data
- Encryption in Transit: All data transfers are encrypted using current best
practices
- Access Control: Role-based access with secure token authentication
- Tenant Isolation: Complete data isolation between tenants
- Audit Logging: Immutable audit logs for all data access
- Backup: Daily encrypted backups with 30-day retention
6. Sub-processors
The following sub-processors are currently engaged:
- Meta Platforms, Inc. — WhatsApp Cloud API message delivery (USA, EU SCCs apply)
- OpenAI, Inc. — AI language processing for chatbot responses (USA, DPA in place)
- Hetzner Online GmbH — Cloud infrastructure and hosting (Germany, EU)
The Controller will be notified of any intended changes to sub-processors with a 30-day notice
period.
7. Data Subject Rights
The Processor assists the Controller in fulfilling data subject requests including: access,
rectification, erasure (right to be forgotten), portability, restriction, and objection to
processing.
Requests should be directed to [email protected] and will be processed within 30 days.
8. Audit Rights
The Controller has the right to audit the Processor's compliance with this DPA. Audits may be
conducted annually with 30 days written notice. The Processor shall provide reasonable cooperation.
9. International Transfers
When personal data is transferred outside the EEA, the Processor ensures adequate safeguards through
EU Standard Contractual Clauses (SCCs) as approved by the European Commission.
10. Term and Termination
This DPA remains in effect for the duration of the service agreement. Upon termination, all personal
data will be securely deleted within 30 days, unless legally required retention applies.