Data Processing Information
Last updated:
Template — this document is pending completion and legal review by WakilSmart. Details in [brackets] are provided by the company.
Roles
For conversations between a business and its customers, the business is the controller and WakilSmart processes the data on its behalf and on documented instructions.
Categories of data
Customer names, phone numbers, message content, appointment details, lead details, media sent by the business.
Technical and organisational measures
- Encryption in transit (TLS).
- Strict tenant isolation: every query is scoped to one business.
- Secrets stored server-side only.
- Role-based access for customers, staff and admins.
- Audit logs of administrative actions (without conversation content).
- Rate limiting and abuse protection.
- Database backups per hosting provider schedule.
Sub-processors
[Hosting, database, AI model provider, WhatsApp Business Platform (Meta), email, payments — list actual providers and locations.]
Retention and deletion
[Retention periods; deletion on contract end within [x] days unless legally required otherwise.]
Signed agreement
A signed data processing agreement is available on request: [contact].