Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (“DPA”) forms part of the agreement between the Pinglo service operator (“Pinglo” or “Processor”) and the business or organisation creating a Pinglo workspace (“Customer” or “Controller”). It applies when Pinglo processes personal data on the Customer’s behalf to provide the service. The Customer’s signup acceptance applies to the organisation the person represents and to its authorised workspace users.

For personal data that Pinglo processes to operate accounts, secure the service, and handle its own support or billing records, Pinglo may act as an independent controller. This DPA does not change that role.

2. Processing details

The subject matter is the provision of Pinglo’s messaging and business communication platform. Processing continues for the duration of the Customer’s use of the service and any limited period needed for return or deletion. Its nature and purpose are hosting, organising, viewing, transmitting, storing, and supporting customer data to provide the features the Customer configures.

Data may include contact and customer identifiers, phone numbers, email addresses, message content and attachments, conversation history, campaign and template details, customer profile and sales data, and automation records. Data subjects may include the Customer’s employees, business contacts, prospects, and customers. The Customer determines what information is submitted and must not submit sensitive or special-category data unless the service and applicable law permit it and appropriate safeguards are in place.

3. Customer instructions and responsibilities

The Customer instructs Pinglo to process personal data as needed to provide the service, as configured by the Customer, and as otherwise documented in the agreement or required by law. The Customer is responsible for the lawfulness, accuracy, and quality of the data; providing notices and obtaining permissions required for contact, messaging, automation, and integrations; responding to data subject requests; and setting appropriate access and retention rules. Pinglo will notify the Customer if, in its opinion, an instruction infringes applicable data protection law, unless prohibited by law.

4. Confidentiality and security

Pinglo will ensure that persons authorised to process Customer personal data are subject to confidentiality obligations and will implement reasonable technical and organisational measures appropriate to the nature of the processing and the risks. The Customer is responsible for securing its accounts, devices, credentials, integrations, and team access.

5. Subprocessors and integrations

The Customer gives general authorisation for Pinglo to use service providers necessary to operate the service, including infrastructure providers and, when configured by the Customer, Meta’s WhatsApp services and AI providers. Pinglo will make information about relevant subprocessors available on request, give notice of material changes where practicable, and impose data protection obligations on subprocessors appropriate to their role. Pinglo remains responsible for its subprocessors’ performance of those obligations to the extent required by applicable law.

The Customer’s selected deployment, WhatsApp connection, AI provider, and other integrations determine which third parties receive data and where it is processed. The Customer is responsible for reviewing and enabling those integrations and for any notices, permissions, or transfer measures required for its use.

6. Assistance and incidents

Taking into account the nature of processing and information available to Pinglo, Pinglo will provide reasonable assistance with requests from data subjects and with the Customer’s obligations concerning security, personal data breaches, impact assessments, and consultation with supervisory authorities. The Customer must promptly provide information reasonably needed for this assistance. Pinglo will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data and will provide information reasonably available to help the Customer meet its legal obligations.

7. Return, deletion, and verification

At the end of the service, the Customer may request an export or deletion of eligible Customer personal data by contacting Pinglo support; these full-account operations are currently support-assisted rather than self-service product controls. Pinglo will verify the request and coordinate return or deletion within a reasonable period, unless applicable law requires retention. Data in backups may remain until those backups are overwritten in the ordinary cycle and will remain protected in the meantime. On reasonable written request, Pinglo will provide information reasonably necessary to demonstrate compliance with this DPA; any audit must protect other customers’ information, security, and confidentiality. See the public Data Export & Account Deletion procedure.

8. International transfers and precedence

Where processing involves a transfer of personal data across borders, the parties will use safeguards required by applicable law. If this DPA conflicts with the main service agreement on processing of Customer personal data, this DPA controls for that subject matter. Changes to this DPA will be published here with a revised effective date; where required, Pinglo will notify the Customer and obtain renewed agreement.

9. Contact

Questions about this DPA can be sent to pinglosupport@gmail.com or by WhatsApp to +254 789 336944.