Wapadesk Data Processing Agreement

Status: second draft, 12 October 2026. Reviewed by the engineering agent against the UK GDPR Article 28(3) requirements and the ICO's "Contracts and liabilities between controllers and processors" guidance (see docs/legal/review-2026-10-12.md for the points that still need a solicitor). Not in force until the owner approves and publishes it. Bracketed items are the owner's decisions or details.

This Data Processing Agreement ("DPA") forms part of the Wapadesk Terms of Service ("Terms") between the Clinic and Ege Digital Ltd. It applies whenever Wapadesk processes personal data on the Clinic's behalf. Where this DPA and the Terms conflict on data protection, this DPA prevails.

1. Parties and roles

• Controller: the business that holds a Wapadesk account (the "Clinic").
• Processor: Ege Digital Ltd, a company registered in England and Wales, company number 15137795, registered office 24-26 Arcadia Avenue Fin009, London, United Kingdom, N3 2JU, trading as Wapadesk ("Wapadesk").
• Law: UK GDPR and the Data Protection Act 2018 ("Data Protection Law"). Terms such as controller, processor, personal data, special category data, data subject and personal data breach have the meaning given there.

Wapadesk acts as a processor for lead data. Wapadesk acts as an independent controller for the Clinic's account data (staff names, emails, billing details) and for its own website, as described in the Wapadesk Privacy Notice.

2. Subject matter, nature and purpose of processing

Wapadesk provides a website widget that collects pre-consultation enquiries from the Clinic's prospective patients and a dashboard in which the Clinic's staff manage those enquiries ("leads"). The processing consists of collecting, storing, displaying, searching, exporting and deleting lead records; generating the WhatsApp message the patient sends; sending notification emails to Clinic staff that contain no health data; sending outgoing webhooks to systems the Clinic connects; and producing usage statistics that contain no answer values.

Wapadesk does not read, send or store WhatsApp conversations. Only the intake record and the first message the patient is given to send are stored.

3. Categories of data subjects and personal data

• Data subjects: prospective patients of the Clinic who use the widget on the Clinic's website; the Clinic's staff who use the dashboard.
• Personal data about patients: name, phone number, email address, age or date of birth, gender, location, the answers the patient gives, uploaded photos and documents, the page and device from which the enquiry was made, consent records.
• Special category data: health information contained in answers, uploads and the Clinic's notes. The patient gives explicit consent inside the widget before any personal data is stored (Article 9(2)(a)); the consent wording, its version, the time and the language are recorded with the lead. The Clinic is responsible for the wording of the questions and the consent text it configures.
• Personal data about staff: name, email address, role, sign-in metadata, actions taken in the dashboard (audit trail).

4. Duration

This DPA applies for the term of the Clinic's subscription and for as long as Wapadesk holds the Clinic's data afterwards: the retention periods the Clinic configures (defaults: 24 months for completed leads, 6 months for abandoned ones), then 30 days of read-only access after the subscription ends so the Clinic can export its data, then deletion under section 11.

5. Processor obligations

Wapadesk shall:

1. Instructions. Process personal data only on the Clinic's documented instructions, which are: the Terms, this DPA, the settings the Clinic chooses in the dashboard (questions, retention, notifications, webhooks, support access) and written instructions sent to hello@wapadesk.com; unless required to do otherwise by UK law, in which case Wapadesk will inform the Clinic before processing unless the law prohibits it.
2. Unlawful instructions. Inform the Clinic immediately if, in Wapadesk's opinion, an instruction infringes Data Protection Law.
3. Confidentiality. Ensure that every person authorised to process the data is bound by a contractual or statutory duty of confidentiality, and that by default Wapadesk staff cannot see patient data (section 9).
4. Security. Implement the technical and organisational measures in Annex 1 and keep them under review.
5. Sub-processors. Engage sub-processors only under section 8.
6. Data subject rights. Taking into account the nature of the processing, assist the Clinic with appropriate technical and organisational measures to respond to data subject requests: the dashboard provides search, export (full record with files) and deletion of individual leads; where that is not enough Wapadesk assists by email within 5 working days.
7. Articles 32 to 36. Assist the Clinic in meeting its obligations on security, personal data breaches, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to Wapadesk.
8. Breach notification. Notify the Clinic without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Clinic's data, with the information available at the time (nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, measures taken) and further information as it becomes available, so that the Clinic can meet its 72-hour obligation to the ICO.
9. End of service. Delete or return the data under section 11.
10. Demonstrating compliance. Make available all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by the Clinic or an auditor mandated by the Clinic, on at least 30 days' written notice, no more than once in any 12 months unless required by a supervisory authority or following a personal data breach, during business hours, without disrupting the service, and subject to reasonable confidentiality undertakings. Wapadesk may first satisfy an audit request by providing its most recent security documentation and test results.
11. Own responsibilities. Nothing in this DPA relieves Wapadesk of its own direct responsibilities and liabilities under Data Protection Law.

6. Controller obligations

The Clinic shall:

1. provide its own privacy notice to patients, covering the widget (Wapadesk supplies a paragraph the Clinic may use: docs/legal/widget-data-statement.md);
2. decide the questions it asks, the consent wording, the retention periods and the notification and webhook settings, and ensure they are lawful and proportionate;
3. ensure it has a lawful basis under Article 6 and a condition under Article 9 for the processing, including explicit consent for health data collected through the widget, and keep marketing consent separate;
4. respond to data subject requests and complaints as controller;
5. keep its staff accounts secure, remove leavers promptly and use the roles provided;
6. not instruct Wapadesk to process data in a way that infringes Data Protection Law.

7. International transfers

Lead data (records, answers, files, notes) is stored and processed in Google Cloud's London region (europe-west2) and does not leave the United Kingdom.

Transfers that do take place, and their safeguards:

• Firebase Authentication stores Clinic staff account data (email address, display name, sign-in metadata) in the United States. No patient data is held there. Safeguard: Google's Cloud Data Processing Addendum with the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Brevo processes notification emails to Clinic staff in the European Union (adequacy regulations apply). Those emails contain no patient data beyond a first name and last initial, a reference code and a link that requires login.
• Cloudflare routes traffic through its global network; content is encrypted in transit and nothing is stored. Safeguard: Cloudflare's Data Processing Addendum with the UK Addendum.
• Stripe processes the Clinic's payments; no patient data.

Wapadesk will not transfer lead data outside the United Kingdom without the Clinic's prior written consent and appropriate safeguards.

8. Sub-processors

The Clinic gives general written authorisation to the sub-processors listed in Annex 2. Wapadesk will give the Clinic at least 30 days' notice by email before adding or replacing a sub-processor that processes the Clinic's data, with a description of the processing. The Clinic may object in writing on reasonable data protection grounds within that period; if the objection cannot be resolved, the Clinic may terminate the subscription for the affected service and receive a pro-rata refund for the unused period. Wapadesk imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains fully liable to the Clinic for the sub-processor's performance.

9. Platform support access

Wapadesk support staff may open a Clinic's account to provide support. Patient-identifying and health fields are hidden by default. Revealing them requires a typed reason, is logged, lasts for that session only (at most 60 minutes), and the Clinic owner is emailed who revealed data, when and why. The Clinic can switch support access off in its dashboard at any time. Support sessions cannot delete leads or export data.

10. Records and cooperation with the ICO

Wapadesk keeps a record of the categories of processing carried out on behalf of the Clinic (Article 30(2)) and will cooperate with the Information Commissioner on request. Wapadesk's data protection contact is the Director, Abdurrahman Simsek, hello@wapadesk.com.

11. Return and deletion

When the subscription ends, the dashboard stays readable for 30 days so the Clinic can export every lead with its files. After that period Wapadesk deletes the Clinic's lead data, files, notes and audit trail from the live system, and from backups within 35 days, unless UK law requires longer storage, in which case Wapadesk stores the data only for that purpose. On written request Wapadesk will confirm deletion. The Clinic may also delete individual leads at any time from the dashboard, and automated retention deletes leads after the periods the Clinic configures.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except that nothing limits a party's liability for breach of Data Protection Law to data subjects or to a supervisory authority where the law does not permit such limitation. [Owner decision with solicitor: whether to add a specific cap for data protection claims, for example two times the annual fee.]

13. Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, as set out in the Terms.

Annex 1: Technical and organisational security measures

• Encryption. TLS 1.2 or higher in transit; encryption at rest on Google Cloud (platform default, AES-256).
• Tenant isolation. Every clinic's data lives under its own record; database security rules enforce that staff can read and write only their own clinic, and these rules are tested automatically on every change.
• Access control. Role-based access for Clinic staff (owner, admin, PA, doctor); doctors see only leads assigned to them; multi-factor sign-in is available; sessions time out after eight hours of inactivity.
• Minimisation. No patient data in email, logs, error reports or analytics events; request bodies are not logged; analytics events carry question identifiers and timings only.
• Uploads. File types verified by content, location metadata removed from images, files served only through short-lived signed links after login.
• Perimeter. Web application firewall and rate limiting in front of all public endpoints; origin checks on the widget API; the application servers are not reachable except through the edge.
• Platform staff. Access to production restricted to named staff with multi-factor authentication; patient data masked in support sessions (section 9); every support action logged.
• Change control. All changes deployed through version control with automated tests (unit, security-rule and end-to-end); separate staging and production environments.
• Retention and deletion. Automated deletion after the Clinic's configured periods; export and deletion of individual records by the Clinic; deletion of all data at the end of the service (section 11).
• Backups and resilience. Managed, replicated database with point-in-time recovery; budget and abuse alarms that cut off the environment rather than exposing data.
• Breach response. Documented procedure: contain, assess, notify the Clinic within 48 hours (section 5.8), remediate, record.

Annex 2: Sub-processors

Changes to this list are notified under section 8 and the current list is published at [wapadesk.com/legal/sub-processors].