Data Processing Agreement

Last updated: October 3, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Tec-ads LTD, Mersin, Türkiye, which operates Waslo at waslo.io ("Waslo", "Processor", "we", "us"), and the customer ("Controller", "you") and governs the processing of personal data that Waslo carries out on your behalf when you use the Waslo platform. Where this DPA conflicts with the Terms of Service on the subject of data protection, this DPA prevails.

1. Roles of the Parties

You are the data controller and Waslo (Tec-ads LTD) is the data processor. You determine the purposes and means of processing the personal data of your leads and customers; Waslo processes that data only to provide the service and only on your documented instructions, including those given through the dashboard and your configuration.

2. Subject Matter and Duration

Waslo processes personal data for the duration of your subscription and for the limited period afterwards described in Section 9. The subject matter is the operation of an AI agent that receives, answers, qualifies, and routes conversations across the channels you connect.

3. Nature and Purpose of Processing

  • Receiving and storing inbound messages from connected channels (WhatsApp QR and Cloud API, Telegram, Instagram, Messenger, Email/Outlook, and the website chat widget).
  • Generating AI replies, classifying leads, scheduling follow-ups, and booking appointments.
  • Retaining a per-lead memory and conversation history to provide continuity.
  • Producing analytics and operator notifications.
  • Running a bot check (Cloudflare Turnstile) when a website visitor first opens the chat.
  • Deleting anonymous website visitors and their conversations on the retention schedule you choose (Section 9).
  • Crawling the public pages of your website that you ask us to scan, and importing the pages you approve into your knowledge base.

4. Categories of Data Subjects

Your leads, prospects, and customers who contact you on a connected channel; visitors who open the chat widget on your website; and your own team members who use the dashboard.

5. Types of Personal Data

Contact identifiers (phone number, email, social handle, name where provided), message content, conversation metadata (timestamps, channel, delivery status), lead classification and notes, and any personal data your customers voluntarily include in their messages. For website chat: the visitor token (stored only as a hash on our side), the website origin the chat was opened on, contact details the visitor chooses to give, satisfaction ratings, and the IP address and browser signals that Cloudflare Turnstile processes transiently for the bot check. You must not use Waslo to process special categories of data (health, biometric, etc.) unless you have a lawful basis and have configured the service accordingly.

6. Sub-processors

You authorize Waslo to engage sub-processors to deliver the service. The current list of sub-processors, with the purpose of each, is published in the sub-processor table of our Privacy Policy. Integrations you connect yourself (such as HubSpot or Shopify) receive data only once you enable them. Waslo imposes data-protection obligations on each sub-processor no less protective than those in this DPA and remains liable for their performance. We will give reasonable notice of any new sub-processor and give you the opportunity to object on reasonable data-protection grounds.

7. Security Measures

Waslo maintains technical and organizational measures appropriate to the risk, including encryption of credentials and channel tokens at rest (AES-256-GCM), encryption in transit (TLS), access controls and role-based permissions, tenant isolation by organization, account lockout and rate limiting, optional two-step verification (authenticator-app codes) for user accounts, and a security audit trail of refused and suspicious access kept for 180 days. A fuller description is available in our Security page.

8. Confidentiality

Personnel authorized to process personal data are bound by confidentiality obligations.

9. Retention, Return and Deletion

  • Conversation and lead data is kept while your account is active.
  • Anonymous website visitors (no name, email or phone given, and not marked as qualified or booked) are deleted with their conversations and ratings 30, 90, 180 or 365 days after their last message, as you choose (180 days by default), or kept if you choose "never". Website visitors who shared contact details are kept as leads while your account is active.
  • Empty website chat sessions are deleted a day after they expire. Website scan results are deleted after 30 days; imported pages stay in your knowledge base until you delete them.
  • On termination, or on your request, Waslo will delete or return your personal data within a reasonable period, save where retention is required by law. You may also trigger deletion yourself through the dashboard and the account deletion request flow.

10. Data Subject Rights and Assistance

You are responsible for informing the people whose data Waslo processes for you — including visitors to your website chat — through your own privacy notice, and for obtaining any consent that the law applicable to you requires.

Taking into account the nature of the processing, Waslo provides reasonable assistance to help you respond to data-subject requests (access, rectification, erasure, portability, objection) and to meet your obligations regarding security, breach notification, and data-protection impact assessments.

11. Personal Data Breaches

Waslo will notify you without undue delay after becoming aware of a personal data breach affecting your data, and will provide the information reasonably needed for you to meet your own notification obligations.

12. International Transfers

Waslo stores your personal data in the European Union (the Netherlands). AI replies and classifications are generated by our AI sub-processor, Google LLC: to produce a reply, the message text (and any media the agent needs to understand) is sent to Google LLC, which processes it to generate the reply and may process it outside the European Union.

Where personal data is transferred outside the European Union, including to the AI model provider, Waslo relies on an appropriate transfer mechanism (such as the Standard Contractual Clauses) and applies supplementary measures where required.

13. Audits

Waslo will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable confidentiality and scheduling conditions.

14. Governing Language

This DPA is published in English. Any translation is provided for convenience only; in the event of a discrepancy between a translated version and this English text, the English version governs.

15. Contact

Data-protection questions and requests under this DPA can be sent to hello@waslo.io.

This DPA is a standard processor agreement provided for transparency. For a signed DPA or enterprise terms, contact us at hello@waslo.io.