Data Processing Agreement

1. Roles & Scope

You are the controller of End User personal data (for example phone numbers, names, message content) that you upload or generate through integrations such as Shopify, WhatsApp, or CSV import. Under India’s DPDP Act you are the data fiduciary for that End User data. Under GDPR / UK GDPR (if you offer goods or services to people in the EEA or UK) you remain the controller and we act as processor. Under other regimes (Malaysia PDPA, Indonesia UU PDP, PIPEDA, CCPA/CPRA service-provider rules, UAE PDPL) we process only on your documented instructions as set out in the Terms, this DPA, and your use of the Services.

2. Categories of Data & Subjects

• Data subjects: your customers, subscribers, and store visitors in any country you message.
• Personal data: contact details (phone with country code, email, name), message content and metadata, order and checkout data from connected stores, consent/opt-out status, and technical logs necessary to operate the Services.
• Special categories: we do not require you to provide special-category data. You must not upload such data unless you have a lawful basis and appropriate safeguards under the laws that apply to those people.

3. Processing Purposes

We process personal data solely to:

• Send and receive WhatsApp messages and campaigns on your behalf.
• Operate automations, flows, order alerts, and abandoned-cart recovery you configure.
• Sync data from integrations you enable (for example Shopify or WooCommerce).
• Provide analytics, support, security monitoring, and billing for the Services.
• Comply with legal obligations and platform requirements (including Shopify GDPR webhooks and Meta’s WhatsApp Business Platform terms).

4. Controller Obligations

You agree to:

• Provide required privacy notices and obtain valid consents where applicable in each country you message.
• Honor End User rights requests and opt-out/unsubscribe decisions.
• Configure integrations and messaging only for lawful purposes.
• Not instruct us to process data in violation of applicable law or Meta / WhatsApp policies.

5. Processor Obligations

We will:

• Process personal data only on your instructions as described in this DPA and the Terms.
• Implement appropriate technical and organizational security measures (see our Security Policy).
• Ensure personnel with access are bound by confidentiality obligations.
• Assist you with reasonable data-subject and regulator requests where applicable.
• Notify you without undue delay if we become aware of a personal data breach affecting your data.
• Delete or return personal data upon termination, subject to legal retention requirements in India and other applicable jurisdictions.

6. Sub-processors

We use infrastructure and service providers (cloud hosting, messaging APIs, payment processors) to deliver the Services. A current list includes Supabase (database & functions), Vercel (application hosting), Meta/WhatsApp (messaging worldwide), and payment or commerce providers you connect. We require sub-processors to protect personal data under contractual obligations consistent with this DPA.

7. International Transfers

Personal data may be processed in India (where Furiq is established) and in countries where our sub-processors and Meta operate. If you are in the EEA, UK, Malaysia, Indonesia, Canada, the United States, the UAE, or another country with transfer rules, you instruct us to make those transfers as needed to provide the Services. Where required, we implement reasonable safeguards for cross-border transfers.

8. Retention & Deletion

We retain data for as long as your account is active and as needed to provide the Services, resolve disputes, and meet legal obligations. You may delete or export certain data through the platform. After account closure, we delete or anonymize data within a reasonable period unless law requires longer retention.

9. Audits

Upon reasonable written request, we will provide information necessary to demonstrate compliance with this DPA. Onsite audits may be conducted no more than once per year with reasonable notice, subject to confidentiality and security restrictions.

10. Order of Precedence

If there is a conflict between this DPA and the Terms regarding personal data processing, this DPA prevails. Other Terms provisions continue to apply.