Data Processing Addendum (DPA)

1. Introduction and Scope

This DPA applies whenever Customer's personal data is processed by Bridgeware Technologies (“the Processor”) on behalf of the Customer (“the Controller”) during the provision of the WhatsApp/Instagram/Telegram CRM platform and Parlario AI Agent services. This agreement forms an integral part of the Main Agreement between the parties.

2. Definitions

• «Applicable Data Protection Law»: means all laws and regulations applicable to the processing of personal data under the Agreement, including Colombia's Law 1581 of 2012 and its implementing decrees, the Australian Privacy Act 1988 and its Australian Privacy Principles (APPs), the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and Brazil's General Data Protection Law (LGPD).
• «Customer Personal Data»: means any personal data (including WhatsApp phone numbers, Instagram identifiers and usernames, Telegram user IDs and usernames, names, chat histories, and messaging metadata) processed by Bridgeware Technologies on behalf of the Customer in connection with the WhatsApp/Instagram/Telegram CRM platform and Parlario AI Agent services.
• «Data Controller» or «Controller»: means the entity that determines the purposes and means of the processing of Customer Personal Data.
• «Data Processor» or «Processor»: means Bridgeware Technologies, which processes Customer Personal Data on behalf of the Controller.
• «Data Subject»: means an identified or identifiable natural person whose personal data is subject to processing.
• «Personal Data Breach»: means a breach or failure of security leading to the accidental or unlawful destruction, loss, or alteration of, or the unauthorized disclosure of or access to, Customer Personal Data transmitted, stored, or otherwise processed.
• «Sub-processor»: means any third party engaged by Bridgeware Technologies to assist in providing the services and fulfilling its obligations under the Agreement.
• «Standard Contractual Clauses (SCCs)»: means the standard data protection clauses approved by the European Commission under Decision (EU) 2021/914.

3. Roles of the Parties and Processing Instructions

3.1 Roles: The Customer acts as the Data Controller (or Processor acting on behalf of a third-party Controller), and Bridgeware Technologies acts as the Data Processor with respect to Customer Personal Data.

3.2 Instructions: Bridgeware Technologies will process Customer Personal Data solely in accordance with the Customer's documented instructions, as set out in this DPA, the main Terms of Service, and the configurations made within the WhatsApp/Instagram/Telegram CRM platform and Parlario AI Agent. If Bridgeware Technologies is required by law to process data outside the Customer's instructions, it will notify the Customer before carrying out such processing, unless legally prohibited from doing so on public-interest grounds.

4. Confidentiality and Security Measures

4.1 Confidentiality: Bridgeware Technologies ensures that all personnel authorized to process Customer Personal Data are bound by strict confidentiality and non-disclosure commitments.

4.2 Technical and Organizational Measures (TOMs): Bridgeware Technologies will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against destruction, loss, accidental or unlawful alteration, or unauthorized access, as detailed in Annex 2. These measures include:

• Encryption in transit: Encryption of data in transit using TLS 1.2 or higher protocols.
• Encryption at rest: Encryption of data at rest using the AES-256 standard.
• Access control: Role-based access control (RBAC), and optional restriction of each team member to specific connected WhatsApp numbers or Instagram accounts.
• Security assessments: Ongoing security assessments, vulnerability scanning, and disaster recovery testing.

5. Sub-processors

5.1 General Authorization: The Customer grants a general authorization for Bridgeware Technologies to engage Sub-processors that assist in providing the WhatsApp/Instagram/Telegram CRM platform and Parlario AI Agent services. The active list of Sub-processors is available at Service Providers and Sub-processors.

5.2 Sub-processor Obligations: Bridgeware Technologies will enter into a written agreement with each Sub-processor imposing data protection obligations no less restrictive than those set out in this DPA. Bridgeware Technologies will remain fully liable to the Customer for that Sub-processor's performance of its obligations.

5.3 Changes to Sub-processors: Bridgeware Technologies will notify the Customer of any intended change or addition of Sub-processors at least 15 days in advance. The Customer may object on justified data protection grounds by written notice within 10 business days of receiving the notification.

5.4 Telegram: Telegram (Telegram FZ-LLC and/or Telegram Messenger Inc.) is a customer-managed direct platform channel and third-party service, not a Sub-processor appointed by Bridgeware Technologies. Parlario is software that lets the Customer connect its own Telegram bot by pasting that bot's token; the Customer creates, owns and controls the bot, holds the primary account relationship with Telegram and accepts Telegram's terms directly with Telegram. Data that flows through Telegram is governed by those direct terms between the Customer and Telegram. Telegram is listed on the service providers page for transparency only, because messages sent over the optional Telegram channel pass through its Bot API; sections 5.2 and 5.3 do not apply to it.

6. Data Subject Rights and Assistance

6.1 Data Subject Requests: Bridgeware Technologies will provide reasonable technical assistance through the WhatsApp/Instagram/Telegram CRM platform and Parlario AI Agent to enable the Customer to respond to Data Subject requests exercising their rights (including the rights of access, rectification, erasure, objection, restriction, and portability). If Bridgeware Technologies receives a request directly from a Data Subject, it will forward it to the Customer promptly and without undue delay.

6.2 Impact Assessments and Prior Consultations: Bridgeware Technologies will provide reasonable assistance to the Customer in carrying out Data Protection Impact Assessments (DPIAs), as well as in prior consultations with the competent supervisory authorities, taking into account the nature of the processing and the information available to Bridgeware Technologies.

7. Personal Data Breach Management

In the event a Personal Data Breach affecting Customer Personal Data is confirmed, Bridgeware Technologies will:

• Timely notification: Notify the Customer without undue delay, and in any event within 72 hours of becoming aware of the incident.
• Detailed information: Provide information on the nature of the breach, the approximate number and categories of data affected, the likely consequences or estimated impact, and the corrective measures taken or proposed.
• Mitigation and containment: Immediately take the measures necessary to contain, mitigate, and minimize the effects of the breach or security failure.

8. International Data Transfers

8.1 Transfer Mechanisms: To the extent that processing involves a transfer of Customer Personal Data outside the European Economic Area (EEA), the United Kingdom, Switzerland, or other jurisdictions applicable to countries without an adequate level of data protection, the parties agree to incorporate and apply the Standard Contractual Clauses (SCCs) approved by the European Commission under Decision (EU) 2021/914:

• Module 2 (Controller to Processor): Will apply when the Customer acts as Data Controller and Bridgeware Technologies acts as Data Processor.
• Module 3 (Processor to Processor): Will apply when the Customer acts as Data Processor on behalf of a third party and Bridgeware Technologies acts as Sub-processor.

8.2 Australian Transfers: For the transfer of personal data from Australia, Bridgeware Technologies will comply with Australian Privacy Principle 8 (APP 8), taking reasonable steps to ensure that overseas recipients do not breach the Australian Privacy Principles (APPs).

8.3 Telegram channel: Where the Customer connects a Telegram bot (optional), messages sent and received through that bot are processed by Telegram (Telegram FZ-LLC and/or Telegram Messenger Inc.), which operates from the United Arab Emirates with global infrastructure. The bot belongs to the Customer, who accepts Telegram's Bot Platform terms directly with Telegram; the transfer safeguards applicable to Telegram's own processing therefore arise from the Customer's own relationship with Telegram. The Standard Contractual Clauses described in 8.1 apply between the parties to this DPA and do not bind Telegram.

9. Data Retention, Deletion, and Return

Upon the completion or expiration of the provision of the WhatsApp/Instagram/Telegram CRM platform and Parlario AI Agent services, or upon the Customer's written request, Bridgeware Technologies will delete or return all Customer Personal Data in its possession within 30 days of such termination or request, unless applicable law requires its retention. Data deletion requests may also be submitted in accordance with our Parlario Data Deletion Policy.

9.2 Retention of WooCommerce order data

Where the Customer connects a WooCommerce store (optional, Business and Advanced plans), the order records received from that store — which contain the name, phone number, email and postal address of the store's customers — are retained under the same rule as in 9.1: a maximum of 90 days from receipt, after which their content is permanently erased and only the derived record described above remains.

9.1 Retention of Shopify protected customer data

Where the Customer connects a Shopify store (optional, Business and Advanced plans), the raw order and fulfilment records received from that store — which contain the name and phone number of the store's customers — are retained for a maximum of 90 days from receipt, after which they are permanently erased. Ninety days corresponds to the return and post-sale support window during which a customer is likely to contact the business about a recent purchase, which is the sole purpose for which this data is held.

After that period, Bridgeware Technologies keeps only a derived record of the event — the type of event, the date it was received, the related order reference, and the contact within the Customer's CRM that it relates to. That derived record contains no protected customer data: the contact already exists in the Customer's CRM because they messaged the business themselves, and the record of a sale having occurred is the Customer's own commercial record. It is retained for the life of the Customer's account and deleted with it, in accordance with clause 9 above.

10. Audits and Compliance Verification

Upon reasonable written request, Bridgeware Technologies will make available to the Customer the information necessary to demonstrate compliance with this DPA, including third-party audit reports or certifications (for example, ISO 27001, SOC 2, or PCI-DSS) relating to its cloud infrastructure.

ANNEX 1: Details of Data Processing

A. Categories of Data Subjects

Customer employees, account administrators, prospective customers (leads), and WhatsApp, Instagram and Telegram contacts who communicate with the Customer's business through the WhatsApp/Instagram/Telegram CRM platform and Parlario AI Agent.

B. Categories of Personal Data Processed

• Contact identifiers: WhatsApp phone numbers, Instagram identifiers and usernames, Telegram user IDs and usernames (Telegram provides no phone number), and profile details.
• Communications content: Chat conversation records, text messages, media attachments, and voice messages, including, where the Customer connects a WhatsApp number that remains on the WhatsApp Business app (“Coexistence”), the messages the Customer sends from that app after connecting. The chat history of that app, which Meta requires Bridgeware Technologies to request, is discarded on receipt and never stored. For Telegram contacts, photos, voice notes and files are not downloaded or stored: only a short text placeholder and the caption, if any, are kept.
• Contacts added by the Customer: names and phone numbers the Customer imports from a CSV file, and, in Coexistence, the name the Customer saved for each phone number in the WhatsApp Business app's address book — used to name existing contacts and, only where the Customer chooses so when connecting, to create the rest. The Customer is responsible for having a lawful basis for the contacts it imports. No message is sent to them as a result.
• Sales/CRM management data: Sales pipeline stage metadata, lead tags, and custom CRM fields.
• AI Agent data: AI agent prompts, knowledge base training files, and evaluation scores (only when the Customer activates the Parlario AI Agent).
• Account registration data: Names of the administrator and team members, email addresses, and payment records (team member accounts are created directly by the organization owner and are limited to the number of licenses/seats included in the Customer's subscription plan), and, where the owner configures it, which connected WhatsApp numbers or Instagram accounts each team member may access.
• Ad campaign attribution and conversion data (Meta Ads): the originating ad's identifier and headline and a click identifier (ctwa_clid) captured from the first message of a contact arriving from a “Click to WhatsApp” or “Click to Instagram” ad; if the Customer connects Meta Conversions API, a contact identifier (the hashed phone number for WhatsApp contacts, or the Instagram account ID for Instagram contacts) and that click identifier are additionally transmitted to Meta when reporting a purchase. Where the purchase comes from a Shopify store the Customer has connected, the total and currency of that order are transmitted with it, so that the Customer's own Ads Manager can measure return and not merely count conversions. Telegram conversations are not reported to Meta Conversions API.
• WhatsApp credentials: WhatsApp Business account connection credentials (access tokens) for each WhatsApp number the Customer connects, encrypted at rest, together with the name the Customer gives each number.
• Instagram credentials: Connection credentials (Page access token) for each professional Instagram account the Customer connects, encrypted at rest, together with the name the Customer gives each account, if the Customer chooses to connect this optional integration.
• Telegram credentials: The bot token of the Telegram bot the Customer creates with Telegram's @BotFather, encrypted at rest, if the Customer chooses to connect this optional integration. The secrets that authenticate Telegram's webhook calls to Parlario (a per-bot secret URL segment and Telegram's secret-token header) are stored only as SHA-256 hashes.
• Meta Ads credentials: The Customer's Meta Conversions API Pixel ID and access token, encrypted at rest, if the Customer chooses to configure this optional integration.
• Google Calendar credentials and data: The Customer's Google Calendar access token (refresh token), encrypted at rest, and the data of appointments created (date, time, and the contact name used as the event title), if the Customer's Owner chooses to configure this optional integration (available on the Business and Advanced plans).
• Shopify credentials: the Client ID and Client secret of the private app the Customer creates in its own Shopify account, the Customer's store webhook signing key, and the short-lived access token obtained with them — the secret, the key and the token encrypted at rest — if the Customer chooses to configure this optional integration (available on the Business and Advanced plans).
• Shopify store data (received, not sent): order and fulfilment data received from the Customer's own Shopify store — including the name and phone number of the store's customers, order contents, amounts and currency, and shipping status. Bridgeware Technologies deliberately does not request access to the customers' email addresses or postal addresses, as no feature of the service requires them. Unlike the integrations above, data flows from the Customer's store to Parlario: Bridgeware Technologies holds read-only access and never creates, modifies or cancels anything in the store. This data is used to identify the contact in the Customer's CRM, to send that contact messages about their own order through the Customer's WhatsApp account, and to display that contact's recent orders to the Customer's team inside the Inbox. Where the Customer has also connected Meta Conversions API, the order's total and currency are additionally reported to the Customer's own Meta ad account, as described for that integration above. It is used for no other purpose.
• WooCommerce credentials: the consumer key and consumer secret that the Customer's own WordPress issues when the Customer approves the connection (Read access only), and the secret that signs the Customer's webhooks — all encrypted at rest — if the Customer chooses to configure this optional integration (available on the Business and Advanced plans).
• WooCommerce store data (received, not sent): order data received from the Customer's own WooCommerce store through its webhooks, or read from it every 15 minutes to recover orders a webhook did not deliver — including the name and phone number of the store's customers, order contents, amounts and currency, order status and, when a plugin on the store saves it, the tracking number. Unlike Shopify, WooCommerce's Read access cannot exclude fields, so the order as received also contains the customer's email and postal address; Bridgeware Technologies does not use them. Data flows from the Customer's store to Parlario, and is used for exactly the purposes described for Shopify above and for no other.
• AI credentials: The Customer's own (Bring Your Own Key) key for its AI provider, encrypted at rest, if the Customer chooses to configure one instead of using the account managed by Bridgeware Technologies.

C. Special Categories of Data

Bridgeware Technologies does not knowingly request or require special or sensitive categories of data (for example, health data, biometrics, political opinions, or religious beliefs). The Customer is advised not to configure the platform to collect or process sensitive data.

D. Nature and Purpose of Processing

Processing of Customer Personal Data to operate the Parlario WhatsApp/Instagram/Telegram CRM platform, automate interactions through AI agents, simulate and test conversation flows, manage leads, and provide technical support.

E. Duration of Processing

For the term of the Main Agreement plus the retention and deletion period following termination (30 days).

ANNEX 2: Technical and Organizational Security Measures (TOMs)

Bridgeware Technologies maintains the following security controls for the WhatsApp/Instagram/Telegram CRM platform and Parlario AI Agent:

• Access Control: Strict identity management through authentication with encrypted passwords (secure hashing — never stored in plain text) and role-based access control (RBAC): owners and members of each organization have distinct permissions within the platform. The owner can additionally restrict each member to specific connected WhatsApp numbers or Instagram accounts, in which case that member can only access the conversations, contacts and metrics of those channels.
• Data Encryption: All data in transit is encrypted using TLS 1.2 or higher protocols. Database records are encrypted at rest using the AES-256 standard, and sensitive credentials (WhatsApp, Instagram and Telegram connection tokens and the customer's API keys) are additionally encrypted at the field level using AES-256-GCM.
• Network Security: Rate limiting on authentication entry points (endpoints) to mitigate brute-force and credential-stuffing attacks; cloud firewall filtering and DDoS attack mitigation built in by default through the hosting infrastructure (AWS Amplify Hosting or Google Cloud Run, depending on the deployment).
• System Resilience: Automated daily database backups, encrypted at rest and retained according to the database provider's retention policy. The application layer runs on managed, auto-scaling infrastructure.
• Incident Response: Retention of application and access logs through the hosting platform's logging systems. Detected or suspected security incidents are investigated in accordance with the notification commitments set out in Section 7 of this DPA.

ANNEX 3: Approved Sub-processors

The updated list of Approved Sub-processors and the applicable international transfer mechanisms is available for review at Service Providers and Sub-processors.

Contact

For any questions about this DPA or privacy compliance, contact us at privacy@parlario.co.