Authoritative contractual version.Table of contents

1. 1. Scope
2. 2. Definitions
3. 3. Roles of the parties
4. 4. Customer responsibilities
5. 5. Processing instructions
6. 6. Details of processing
7. 7. Confidentiality
8. 8. Security
9. 9. Subprocessors
10. 10. Third parties that are not Subprocessors
11. 11. International transfers
12. 12. Data Subject requests
13. 13. Assistance with compliance
14. 14. Personal Data Breaches
15. 15. Security incident communications
16. 16. Audit and compliance information
17. 17. Regulatory cooperation
18. 18. Government and legal requests
19. 19. Return and deletion
20. 20. Data portability and exit
21. 21. Records
22. 22. Conflict and precedence
23. 23. Liability
24. 24. Duration
25. Schedule 1 — Processing details
26. Schedule 2 — Technical and organisational measures

1. Scope
This DPA applies where WatsBridge processes Personal Data on behalf of the Customer in connection with the WatsBridge Service.It applies only to processing for which the Customer acts as Controller and WatsBridge acts as Processor, or equivalent roles under applicable data protection law.Processing for which WatsBridge independently determines the purposes and essential means is outside this DPA and is governed by the WatsBridge Privacy Policy and applicable law.

2. Definitions
For this DPA:Applicable Data Protection Law means the data protection legislation applicable to the relevant processing, including where applicable:

• the Swiss Federal Act on Data Protection (“FADP” / “LPD”);
• the EU General Data Protection Regulation (“GDPR”);
• applicable implementing or supplementary legislation.

Controller, Processor, Personal Data, Processing, Personal Data Breach, Data Subject and equivalent terms have the meaning given by Applicable Data Protection Law.Customer Personal Data means Personal Data processed by WatsBridge on behalf of the Customer under this DPA.Subprocessor means a third party engaged by WatsBridge to process Customer Personal Data on behalf of the Customer.

3. Roles of the parties
For Customer Personal Data processed under this DPA:

• the Customer is the Controller;
• WatsBridge is the Processor.

The Customer determines the purposes of the relevant processing and is responsible for ensuring that its instructions to WatsBridge comply with Applicable Data Protection Law.WatsBridge processes Customer Personal Data only on documented instructions from the Customer, except where processing is required by applicable law.The Customer’s configuration and use of the Service, together with the applicable contractual documents, constitute documented instructions.

4. Customer responsibilities
The Customer is responsible for:

• having an appropriate legal basis for the processing;
• providing required notices to Data Subjects;
• obtaining consent where required;
• ensuring the lawfulness of Customer Personal Data supplied to WatsBridge;
• determining appropriate retention requirements;
• configuring the Service consistently with its legal obligations;
• responding as Controller to Data Subject and supervisory-authority requirements.

WatsBridge does not determine the Customer’s legal basis merely by providing technical functionality.

5. Processing instructions
WatsBridge will process Customer Personal Data only as reasonably necessary to:

• provide the Service;
• execute functionality configured or requested by the Customer;
• maintain the security, integrity and reliability of the Service;
• provide support requested by the Customer;
• comply with documented Customer instructions;
• comply with a legal obligation applicable to WatsBridge.

If WatsBridge reasonably believes that an instruction infringes Applicable Data Protection Law, it may suspend execution of that instruction and inform the Customer unless legally prohibited from doing so.

6. Details of processing
The subject matter, nature, purposes, categories of Personal Data and categories of Data Subjects are described in Schedule 1.The Customer may modify the processing through its lawful configuration and use of supported Service functionality without requiring a new DPA each time, provided the processing remains within the scope of the Service and applicable contractual documents.

7. Confidentiality
WatsBridge will ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.Access must be limited to persons who reasonably require it for authorised operational, support, security or legal purposes.

8. Security
WatsBridge will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against:

• unauthorised or unlawful processing;
• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• unauthorised disclosure.

Measures will be proportionate to the risks, the nature of the processing and the state of the art.Additional information concerning applicable security measures may be maintained in the WatsBridge Security Addendum and Technical and Organisational Measures documentation.The existence of a capability offered by a third-party provider does not mean that capability is part of WatsBridge’s contractual security commitments unless expressly incorporated into the Service.

9. Subprocessors
The Customer grants WatsBridge general authorisation to engage Subprocessors necessary to provide the Service.WatsBridge will maintain an applicable Subprocessor List or equivalent register identifying relevant Subprocessors and their processing roles.WatsBridge will impose data protection obligations on its Subprocessors appropriate to the processing they perform.Where Applicable Data Protection Law requires notice of a new or replacement Subprocessor, WatsBridge will provide an appropriate mechanism for such notice.Where the Customer has a legally recognised right to object, an objection must be based on reasonable and documented data protection grounds.The parties will seek in good faith to identify a reasonable solution. If no reasonable solution is available, either party may discontinue the affected functionality or terminate the affected Service in accordance with the contractual framework.

10. Third parties that are not Subprocessors
Not every third party involved in delivery of the Service necessarily acts as a Subprocessor of WatsBridge.Certain providers, platforms or regulated service providers may process Personal Data in their own legal capacity, for example as independent controllers or other separate recipients.Such parties may include, depending on the Service used:

• payment service providers;
• e-commerce platforms;
• Meta or other communication platforms;
• other providers whose legal role is determined by their applicable service and contractual relationship.

The applicable role will be documented where reasonably necessary in the relevant privacy, DPA, provider or data-flow documentation.

11. International transfers
WatsBridge’s primary infrastructure is hosted in Switzerland.Customer Personal Data may nevertheless be processed in other jurisdictions where required for selected functions, integrations or authorised Subprocessors.Where Applicable Data Protection Law requires additional safeguards for an international transfer, WatsBridge will implement an appropriate recognised transfer mechanism.Such safeguards may include, where applicable:

• an adequacy decision;
• recognised standard contractual clauses;
• contractual clauses adapted as permitted for Swiss data protection law;
• another legally recognised transfer mechanism.

Where EU Standard Contractual Clauses are required, the applicable WatsBridge International Transfer Addendum may incorporate the relevant module and selections.Nothing in this DPA represents that all Customer Personal Data necessarily remains exclusively in Switzerland.

12. Data Subject requests
Taking into account the nature of the processing, WatsBridge will provide reasonable assistance to enable the Customer to respond to requests from Data Subjects where the Customer cannot reasonably fulfil the request using available Service functionality.Unless required by law, WatsBridge will not independently respond to a Data Subject request concerning Customer-controlled processing except to:

• direct the requester to the Customer;
• acknowledge receipt;
• take necessary steps to preserve security or legal compliance.

The Customer remains responsible for determining the appropriate substantive response.

13. Assistance with compliance
Taking into account the nature of the processing and information available to WatsBridge, WatsBridge will provide reasonable assistance where required under Applicable Data Protection Law concerning:

• security of processing;
• Personal Data Breach obligations;
• data protection impact assessments;
• prior consultation with supervisory authorities;
• Data Subject rights.

Assistance requiring substantial work outside ordinary Service functionality may be subject to reasonable charges where permitted by the contractual framework, unless the assistance is necessary because of WatsBridge’s own breach.

14. Personal Data Breaches
WatsBridge will notify the Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.The notification will include information reasonably available to WatsBridge that is relevant to the Customer’s legal obligations.Where complete information is not immediately available, WatsBridge may provide information progressively as it becomes available.WatsBridge may take immediate proportionate action to contain, investigate, remediate and secure the affected systems.Notification of an incident does not constitute an admission of liability.

15. Security incident communications
Where appropriate to the severity and configuration of the Service, WatsBridge may use one or more authorised channels for security communications.These may include:

• the WatsBridge portal;
• email or other Customer-provided contact mechanisms;
• SMS or WhatsApp where configured;
• other authorised emergency channels.

The Customer is responsible for maintaining current security contact information.WatsBridge may retain evidence of security notifications, delivery attempts, acknowledgements and incident-handling actions for security, compliance and evidentiary purposes.

16. Audit and compliance information
WatsBridge will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA.Where required by Applicable Data Protection Law, the Customer may conduct or commission a reasonable audit concerning processing under this DPA.Audits must:

• be proportionate;
• avoid unnecessary disruption;
• protect other customers’ confidential information;
• comply with reasonable security requirements;
• avoid access to data unrelated to the Customer.

WatsBridge may satisfy audit requests, where appropriate, through existing independent reports, certifications, assessments, security documentation or other reasonable evidence.Unless an incident, supervisory authority or material compliance concern reasonably requires otherwise, duplicative audits should be avoided.

17. Regulatory cooperation
WatsBridge will reasonably cooperate with competent supervisory authorities in relation to processing governed by this DPA where required by Applicable Data Protection Law.The Customer remains responsible for its own regulatory obligations as Controller.

18. Government and legal requests
If WatsBridge receives a legally binding request from a public authority concerning Customer Personal Data, WatsBridge may disclose data where legally required.Where legally permitted and reasonably practicable, WatsBridge will inform the Customer before disclosure.WatsBridge will seek to limit disclosure to what is legally required.

19. Return and deletion
Upon termination of the affected Service, WatsBridge will delete or return Customer Personal Data in accordance with:

• the Customer’s applicable instructions;
• available export functionality;
• the contractual retention framework;
• legal obligations;
• applicable backup cycles.

Data deleted from active systems may remain temporarily in backup copies until those copies are overwritten or expire in accordance with applicable backup procedures.WatsBridge may retain data where required by law, for security evidence or for the establishment, exercise or defence of legal claims, but such retained data will no longer be processed for ordinary Customer Service purposes.

20. Data portability and exit
Where supported by the Service, WatsBridge will make reasonable mechanisms available for the Customer to export relevant Customer Data before final deletion.This provision does not require WatsBridge to provide:

• proprietary WatsBridge software;
• internal security information;
• another customer’s data;
• data WatsBridge is legally prohibited from disclosing.

Customer-owned Meta assets remain governed by the ownership and portability principles in the Master Terms.

21. Records
WatsBridge may maintain processing, security, access, audit and compliance records necessary to demonstrate performance of this DPA and comply with applicable law.Such records must themselves be protected by appropriate access and confidentiality controls.

22. Conflict and precedence
For matters concerning WatsBridge’s processing of Customer Personal Data as Processor, this DPA prevails over inconsistent provisions of the Master Terms or Commercial Terms.An applicable International Transfer Addendum or mandatory transfer mechanism prevails to the extent necessary for the relevant international transfer.

23. Liability
Liability under this DPA is subject to the liability framework applicable to the WatsBridge contractual relationship, except to the extent Applicable Data Protection Law prohibits such limitation.Nothing in this DPA limits any right, remedy or liability that cannot lawfully be limited.

24. Duration
This DPA remains in effect for as long as WatsBridge processes Customer Personal Data on behalf of the Customer.Relevant confidentiality, deletion, audit, evidentiary and legal-compliance obligations survive termination to the extent necessary for their purpose.

SCHEDULE 1 — PROCESSING DETAILS

A. Subject matter
Provision of the WatsBridge Service and functionality configured by the Customer.
B. Duration
For the duration of the relevant Service relationship and any applicable limited retention, backup or legal-retention period following termination.
C. Nature and purposes
Processing may include, depending on Customer configuration:

• collection;
• receipt;
• storage;
• organisation;
• retrieval;
• transmission;
• synchronisation;
• analysis;
• communication;
• suppression;
• deletion;
• other processing necessary to provide configured WatsBridge functionality.

Purposes may include:

• CRM;
• customer communications;
• transaction and order notifications;
• newsletters and campaigns;
• abandoned cart workflows;
• marketing automation;
• consent and suppression management;
• analytics;
• template management;
• e-commerce integration;
• AI-assisted functionality where activated;
• Voice AI where activated;
• support and security operations relating to the Customer-controlled Service.

D. Categories of Data Subjects
Depending on Customer configuration:

• Customer end users;
• customers and purchasers;
• prospective customers;
• newsletter subscribers;
• business contacts;
• users communicating with the Customer;
• Customer employees, representatives or authorised agents;
• other persons whose data the Customer lawfully processes through the Service.

E. Categories of Personal Data
Depending on configuration:

• names;
• telephone numbers;
• email addresses;
• language preferences;
• business/contact information;
• delivery or billing information where synchronised;
• customer identifiers;
• order and transaction references;
• product and cart information;
• communication content;
• conversation metadata;
• template and campaign data;
• consent and opt-out records;
• engagement and delivery information;
• referral or campaign-attribution metadata;
• technical identifiers;
• other Personal Data submitted or generated through configured Service functionality.

F. Special categories / sensitive data
The Service is not intended as a general-purpose repository for sensitive or special-category Personal Data.The Customer must not intentionally use the Service to process such data unless:

• the relevant Service functionality supports it;
• the processing is lawful;
• appropriate safeguards have been implemented.

Incidental sensitive information contained in communications may nevertheless be processed where users voluntarily include it in ordinary communications.
G. Processing frequency
Continuous or intermittent according to Customer use and configuration of the Service.

SCHEDULE 2 — TECHNICAL AND ORGANISATIONAL MEASURES
WatsBridge maintains technical and organisational measures proportionate to the risks applicable to the Service.The detailed and current implementation may be documented separately in versioned Technical and Organisational Measures documentation.Relevant control areas include, as appropriate:

• identity and access management;
• authentication and privileged access controls;
• tenant separation;
• credential and secret management;
• encryption in transit;
• protection of appropriate stored secrets and sensitive data;
• network and infrastructure security;
• logging and auditability;
• vulnerability and dependency management;
• backup and restoration procedures;
• incident detection and response;
• secure development and change management;
• data minimisation;
• retention and deletion controls;
• Subprocessor governance;
• business continuity measures.

WatsBridge does not represent that every possible security control or every feature offered by an underlying provider is implemented for every Customer or Service configuration.