TAM Inbox

Data Processing Agreement (template)

This Data Processing Agreement (“DPA”) forms part of the agreement between [Customer Company Name] (“Controller”) and TAM (“Processor”, operating the TAM Inbox service) governing the Processor’s processing of personal data on the Controller’s behalf. This is a template - fill in the bracketed fields and have it reviewed by your own legal counsel before relying on it as a signed agreement.

1. Subject matter and duration

The Processor processes personal data on behalf of the Controller for the duration of the Controller’s subscription to TAM Inbox, for the purpose of providing a WhatsApp Business team inbox, broadcast messaging, and related automation services.

2. Categories of data subjects and personal data

• Data subjects: the Controller’s own contacts/customers who message or are messaged via WhatsApp.
• Personal data categories: phone numbers, display names, message content, delivery/read status, and any custom contact fields the Controller configures.

3. Nature and purpose of processing

The Processor processes this data solely to provide the Service as directed by the Controller: sending and receiving WhatsApp messages, storing conversation history, running the Controller’s own configured automations and campaigns, and nothing beyond that purpose.

4. Sub-processors

The Controller authorizes the Processor to engage the following categories of sub-processors, each bound by appropriate data protection obligations:

• Meta Platforms, Inc. - the WhatsApp Business Platform (Cloud API) itself, required to send/receive messages.
• Infrastructure/hosting providers - to host the Service and its database.
• Payment processors - for billing (do not process message/contact data).

5. Security measures

The Processor implements appropriate technical and organizational measures as described in our Security & Compliance page, including encryption of credentials at rest, encrypted connections in transit, tenant-level data isolation, and access controls scoped per user role.

6. Data subject rights

The Processor will reasonably assist the Controller in responding to requests from data subjects exercising their rights (access, correction, deletion, portability) under applicable data protection law, to the extent the Controller cannot reasonably fulfill such requests through the Service’s own tools.

7. International transfers

Where personal data is transferred outside the Controller’s jurisdiction, the Processor will rely on appropriate safeguards (such as Standard Contractual Clauses or an equivalent legal mechanism) as required by applicable law.

8. Data deletion / return

Upon termination of the underlying service agreement, the Processor will delete or return the Controller’s personal data within a reasonable period, except where retention is required by law.

9. Breach notification

The Processor will notify the Controller without undue delay upon becoming aware of a personal data breach affecting the Controller’s data, and will provide reasonably available information to help the Controller meet its own notification obligations.

TAM · TAM Inbox · Questions about this template? Contact taminbox@tamcons.com