WappBlaster - AI-Powered WhatsApp Business Automation
Last Updated: January 2025
WappBlaster data processing agreement in brief
The WappBlaster data processing agreement, effective from January 2025, sets the roles for personal data handled across WappBlaster services: the customer is the data controller who decides why and how data is processed, and WappBlaster is the processor acting on that customer's behalf. Its scope runs across ten service areas, including WhatsApp marketing automation, the auto dialer, call logs and leads, attendance with selfies and location, field team monitoring, catalogues, file storage and the WhatsApp Business API. The most useful part for a business is the retention schedule: communication records for 24 months, selfie and GPS attendance data for 3 years, device information for 2 years, and payment and work records for 7 years. Biometric and location processing needs explicit consent that can be withdrawn at any time. The agreement is governed by the Information Technology Act, 2000 and the 2011 Reasonable Security Practices Rules, and the privacy team answers data subject requests within 30 days and security incidents within 24 hours.
A data processing agreement sets who controls personal data and who only processes it. The WappBlaster data processing agreement also fixes retention periods and consent rules.
WappBlaster acts as the data processor for its customers and keeps each data category for a stated period, from 2 years to 7.
The controller, the processor and the data subject are each defined, so responsibility is not left open.
Every category, from contact details to payment records, has a stated period.
Six processing activities are matched to the ground the agreement relies on, such as contract or consent.
Explicit, separate and withdrawable consent is required before biometric or location data is processed.
Fixed windows are given for rights requests, security incidents and general questions.
The Indian statutes behind the agreement are listed by name and year.
Data Processing Agreement: This agreement governs how WappBlaster processes personal data for all our services. We are committed to protecting your privacy and complying with applicable data protection laws. All legal matters are subject to the exclusive jurisdiction of Bikaner Court, Rajasthan, India.
This agreement applies to all personal data processing activities conducted through WappBlaster services, including:
| Data Category | Data Types | Purpose | Retention |
|---|---|---|---|
| Contact Information | Names, phone numbers, emails | Service provision, communication | Account lifetime + 2 years |
| Communication Records | WhatsApp messages, call logs, SMS | Automation, analytics, compliance | 24 months |
| Business Information | Company details, industry, size | Service customization, support | Account lifetime + 5 years |
| Transaction Data | Payment details, billing history | Billing, compliance, fraud prevention | 7 years (legal requirement) |
| Data Category | Data Types | Purpose | Retention |
|---|---|---|---|
| Biometric Data | Selfie photos for attendance | Identity verification, attendance tracking | 3 years |
| Location Data | GPS coordinates, timestamps | Attendance verification, field tracking | 3 years |
| Work Records | Attendance logs, task completion | Performance tracking, payroll | 7 years |
| Device Information | Device ID, app usage, system info | Security, performance optimization | 2 years |
Enhanced Protection Required: The following data categories require explicit consent and enhanced security measures:
Primary Legal Bases:
| Processing Activity | Legal Basis | Data Categories | Retention |
|---|---|---|---|
| WhatsApp Message Automation | Contract Performance | Contact info, message content | 24 months |
| Call Log Management | Contract Performance | Phone numbers, call duration | 24 months |
| Attendance Tracking | Consent + Employment Law | Biometric, location data | 3 years |
| Payment Processing | Contract + Legal Obligation | Financial information | 7 years |
| Customer Support | Legitimate Interest | Contact info, support tickets | 3 years |
| Analytics and Improvement | Legitimate Interest | Usage data, performance metrics | 2 years |
This Data Processing Agreement is governed by the laws of India, specifically:
Exclusive Jurisdiction: All disputes arising from this agreement shall be subject to the exclusive jurisdiction of the courts in Bikaner, Rajasthan, India.
Response Times:
This Personal Data Processing Agreement is effective as of January 2025 and applies to all data processing activities conducted after this date.
By using WappBlaster services, you acknowledge that you have read, understood, and agree to be bound by this Personal Data Processing Agreement.
Teams reviewing data handling usually read the WappBlaster privacy policy alongside the terms of service and the page for contacting the privacy team.
| Feature | Who or what | Rule | Timeline |
|---|---|---|---|
| Data controller | You, the customer | Decide the purposes and means of processing | No period stated |
| Data processor | WappBlaster | Processes personal data on the controller's behalf | No period stated |
| Contact information | Names, phone numbers, emails | Used for service provision and communication | Account lifetime + 2 years |
| Communication records | WhatsApp messages, call logs, SMS | Used for automation, analytics and compliance | 24 months |
| Biometric and location data | Selfie photos, GPS coordinates | Explicit consent, which can be withdrawn at any time | 3 years |
| Transaction and work records | Payment details, attendance logs | Billing, compliance and payroll | 7 years |
| Data subject rights requests | WappBlaster privacy team | Reply to the request | 30 days |
| Security incidents | WappBlaster privacy team | Respond to the incident | 24 hours |
| Disputes | Both parties | Negotiation, mediation, arbitration, then court | Ending in Bikaner courts |
A data processor. The agreement makes you, the customer, the data controller who decides the purposes and means of processing, and WappBlaster processes personal data on your behalf.
Link to this answerThree years. Selfies used for attendance are treated as biometric data, which needs explicit consent and enhanced security.
Link to this answerThree years. GPS coordinates and timestamps are kept for attendance verification and field tracking, and precise location data needs explicit consent.
Link to this answerSeven years, which the agreement marks as a legal requirement. Payment details and billing history are kept for billing, compliance and fraud prevention.
Link to this answerThe laws of India, specifically the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices) Rules, 2011, the Personal Data Protection Bill once enacted, and other applicable Indian data protection laws.
Link to this answerWithin 30 days. The privacy team responds to security incidents within 24 hours and to general inquiries within 48 hours.
Link to this answerYes. The agreement includes a right to withdraw consent at any time, and consent is collected separately for different processing activities.
Link to this answerAll of them, including WhatsApp marketing automation, the auto dialer, call logs and lead management, reminders, attendance and location tracking, field team management, digital catalogues and reviews, file storage and WhatsApp Business API services.
Link to this answerFive bases are listed: contract performance, legitimate interest, consent for special categories, legal obligation and vital interest in emergencies. Attendance tracking, for example, rests on consent plus employment law.
Link to this answerIn the courts of Bikaner, Rajasthan, India, which have exclusive jurisdiction. Court is the final resort after good faith negotiation, mediation through a data protection mediator and binding arbitration.
Link to this answerStill not answered?
Ask a real person. We reply on WhatsApp, usually within the hour.