Annex I — Data Processing Agreement
Version 2026-10-21.1 · Article 28 of Regulation (EU) 2016/679 (GDPR) and the Spanish LOPDGDD. Courtesy translation: the Spanish text prevails in case of discrepancy. Accepted together with the Service Agreement by ticking the box before paying; it forms part of it.
1. Parties
- Controller: the Customer who subscribes to the service, identified in the contract and in its onboarding form (the “Controller”).
- Processor: WAKANDA MARKETING SL, tax ID B55286579, Calle Santiago Ramón y Cajal, nº 32, L4, 17190 Salt (Girona), Spain, info@sirioreplai.com (the “Processor”).
2. Scope
This agreement applies to processing of personal data subject to the GDPR or the LOPDGDD. If the Controller is outside the European Economic Area and processes data subject to other laws (for example US state laws), the Processor will process it only on the Controller's documented instructions and with the same technical and organisational safeguards, as a service provider, without selling it or using it for its own purposes.
3. Subject matter, nature and purpose
The Processor processes personal data on behalf of the Controller solely to provide the Service: receiving, storing and organising the WhatsApp conversations that people start with the Controller's business, generating replies through an automated assistant, handing them over to a person at the Controller when appropriate, and capturing contact details of interested people (Professional plan). They will not be used for any other purpose of the Processor's own, nor disclosed.
4. Data and data subjects
| Data subjects | Customers, prospects and other people who write to the Controller's WhatsApp. |
| Data | Phone number, WhatsApp profile name, message content and attachments, voice notes and their transcription to text, date and time, and contact details the person provides in order to be served. |
| Special categories | Not expected. The assistant is configured not to ask for or repeat them, and people are asked not to send them. If the Controller is a clinic or another business where they might arrive, it will say so in writing so additional measures can be agreed. |
5. Duration
That of the Contract. On its termination, clause 11 applies.
6. Processor's obligations
a) To process the data only on the Controller's documented instructions (the Contract and this annex are such instructions; any other must be in writing). If it considers that an instruction infringes the law, it will say so.
b) To ensure that the people authorised to process the data are bound by confidentiality.
c) To apply the security measures in clause 8.
d) To respect the sub-processing conditions in clause 7.
e) To assist the Controller in the exercise of data subject rights (access, rectification, erasure, objection, restriction, portability): if a person contacts the Processor, it will forward the request within 3 business days at most and will not reply itself unless instructed. It will assist with impact assessments and prior consultations where relevant.
f) To notify without undue delay, and within 48 hours at most of becoming aware, any security breach affecting the Controller's data, with the information available (nature, data affected, likely consequences, measures), so that the Controller can notify the supervisory authority within 72 hours.
g) To keep a record of the processing activities carried out on behalf of the Controller.
h) To make available to the Controller the information needed to demonstrate compliance and to allow reasonable audits (with 15 days' notice, during business hours, subject to confidentiality and without compromising other customers' data), preferably by questionnaire or documentation.
i) To keep this Controller's data segregated from other customers' data.
7. Sub-processors
7.1. The Controller gives general authorisation to use sub-processors in the following categories, needed to provide the Service:
| Category | Function | Country / safeguards |
|---|---|---|
| Hosting and server infrastructure | Hosting the Service's systems and databases | Within the EEA or with equivalent safeguards; the specific country is given in the sub-processor list provided on request. |
| Artificial intelligence provider (language model) | Processing message content to generate the reply | United States. Transfer with Chapter V GDPR safeguards (standard contractual clauses and/or the applicable privacy framework). |
| Conversation management provider (service inbox) | Organising service and handover to people | Hosted on the Processor's servers. |
| Voice-note transcription service | Converting voice notes received on the Controller's WhatsApp into text | EU or United States, with Chapter V GDPR safeguards where relevant. |
| Email provider | Notifications and reports to the Controller | Given in the sub-processor list provided on request. |
| Encrypted backups | Keeping encrypted copies of the databases | Given in the sub-processor list provided on request. |
7.2. The WhatsApp channel is operated by Meta Platforms Ireland Limited, with which the Controller has its own relationship by accepting the WhatsApp Business terms; it is not a sub-processor of the Processor.
7.3. The Processor will inform the Controller by email of any addition or replacement of a sub-processor 15 days in advance; the Controller may object on reasonable grounds within that period. If this is not resolved, either party may terminate the Contract without penalty.
7.4. The Processor will impose on each sub-processor obligations equivalent to those in this annex and will remain liable to the Controller for their performance. On the Controller's request, and under confidentiality, it will provide the up-to-date list with names.
8. Security measures
The Processor applies, at a minimum:
- Access control: named access with strong passwords; least privilege; server access by key only; immediate revocation of access.
- Encryption: communications over HTTPS; secrets and access tokens (including those of the Controller's WhatsApp account) kept outside the code and encrypted; encrypted backups.
- Segregation: separate account and inbox per customer; the assistant only accesses the history of the conversation in progress.
- Resilience: daily backup of databases and attachments, kept for 30 days, plus an additional copy outside the server.
- Availability and monitoring: continuous service monitoring and alerts; firewall with only the necessary ports; request rate limiting.
- Minimisation: the assistant is not asked for sensitive data; technical logs are kept for a short period.
- People: contractual confidentiality for staff with access; access to conversations is limited to what is necessary for support or incidents.
- Review: periodic evaluation of these measures.
9. International transfers
Only those in clause 7 (artificial intelligence provider and, where applicable, transcription), with Chapter V GDPR safeguards. There will be no others without the Controller's authorisation.
10. Controller's obligations
a) To have informed people in accordance with Arts. 13-14 GDPR (the Processor supplies a text) and to have a legal basis for the processing.
b) To give clear instructions and not to send special categories of data without prior agreement.
c) To handle data subject rights and any notifications to the supervisory authority that fall to it.
d) To attend conversations handed over to a person.
11. End of the engagement: return and deletion
- When the Contract ends (or earlier, if the Controller asks), the Processor delivers to the Controller an export of its conversations in a readable format (CSV/JSON), within 15 days at most of the request.
- 30 days after termination, or after delivery of the export if later, the Processor deletes the data from its systems, unless a rule requires keeping it (blocking during the limitation periods for possible liabilities), and confirms in writing.
- Backups that still contain data are overwritten in their natural rotation of 30 additional days at most; until then they are not restored for any other purpose.
- Server technical logs are kept for the short period stated in the privacy policy.
- During the Contract, the Controller decides how long conversations are kept; unless it says otherwise, they are kept for the duration of the Contract.
- The Controller's own contact, billing and proof-of-acceptance data are processed by the Processor as controller, under its privacy policy (invoices: commercial and tax retention period).
12. Liability
Each party is liable for breaches of its obligations under Art. 82 GDPR and within the limits of the Contract where legally permissible.
13. Governing law
Spanish law; jurisdiction as in the Contract.