This Data Processing Agreement ("DPA") sets out how WAO handles personal data on behalf of a restaurant using its service. It forms part of the Terms of Service and applies automatically to every WAO subscription. It is written for India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025.
Parties: M/s WAO, a partnership firm constituted under the Indian Partnership Act, 1932 and operating from Delhi NCR, India ("WAO", "Processor"), and the restaurant or food business subscribing to the service ("Restaurant", "Data Fiduciary").
Why this exists. Your customers' data is yours, not ours. Under the DPDP Act that makes you the Data Fiduciary and us the Data Processor. This document records that split, and binds us to process your customers' data only as you instruct.
1. Roles
- The Restaurant is the Data Fiduciary for the personal data of its customers. It determines why and how that data is processed.
- WAO is the Data Processor. It processes that data only on the Restaurant's documented instructions, which include the Terms of Service, this DPA, and configuration choices the Restaurant makes in the service.
- WAO is an independent Data Fiduciary only for data about the Restaurant's own business contacts , the owner and staff who use the service, and billing records. That is governed by WAO's Privacy Policy, not this DPA.
2. Scope of processing
| Item | Detail |
|---|---|
| Subject matter | Taking, confirming and recording food orders placed over WhatsApp, and maintaining the Restaurant's customer database. |
| Duration | For the term of the subscription, plus the deletion window in section 10. |
| Nature and purpose | Receiving and interpreting messages, generating replies, recording orders, notifying the Restaurant, sending order updates, sending opt-in promotional messages, review requests, and analytics for the Restaurant. |
| Categories of Data Principals | Customers who message the Restaurant's WAO-powered ordering line. |
| Categories of personal data | WhatsApp phone number; WhatsApp profile name; message content sent to the ordering line; order details and special instructions; order history, frequency and value; pickup or delivery details; in-chat interaction data; entry point (which QR code or link was used). |
| Excluded data | The service is not designed for and must not be used to collect identity numbers, financial account details, health information or other sensitive categories. |
3. The Restaurant's obligations
As Data Fiduciary, the Restaurant is responsible for:
- Lawful basis. Ensuring there is a valid consent or permitted legitimate use for every processing activity it instructs.
- Notice. Ensuring customers are given the notice the DPDP Act requires. WAO provides an in-chat notice on first contact as part of the service; the Restaurant must not disable, alter or bypass it.
- Uploaded lists. Warranting that any existing customer list it gives WAO was lawfully collected, that those customers received the required notice, and that consent covers the use intended. This is the Restaurant's risk, not WAO's.
- Promotional messages. Sending marketing only to customers who have opted in, honouring opt-outs, and complying with the WhatsApp Business Messaging Policy.
- Accuracy and instructions. Giving WAO accurate information and lawful instructions, and not instructing WAO to do anything that would breach the DPDP Act.
- Its own security. Controlling who in its business can access the ordering line, the management chat and exported data.
4. WAO's obligations
WAO will:
- Process only on instructions. Process customer personal data only as needed to provide the service or as the Restaurant directs, and not for any purpose of its own.
- Never sell or share. Never sell customer data, never make one Restaurant's customer data available to another Restaurant, and never use it for WAO's own marketing.
- Limit access. Ensure only personnel who need access have it, and that they are bound by confidentiality obligations that survive their engagement.
- Apply reasonable security safeguards as set out in section 7.
- Assist with Data Principal requests as set out in section 8.
- Report breaches as set out in section 9.
- Return and delete data as set out in section 10.
- Keep records of its processing sufficient to demonstrate compliance, and make them available to the Restaurant on reasonable request.
- Use aggregated data only. Where WAO uses information to operate and improve the service, it uses aggregated and de-identified data that does not identify the Restaurant or any customer.
5. Sub-processors
The Restaurant authorises WAO to engage the sub-processors below. Each is bound by obligations no less protective than this DPA.
| Sub-processor | Function | Location |
|---|---|---|
| Meta Platforms (WhatsApp Business Platform) | Message transmission and delivery | Outside India |
| Supabase | Database and application backend | India region |
| DigitalOcean | Application hosting and automation | India region |
| OpenAI | Interpreting order messages and generating replies | Outside India |
| Formspree | Website enquiry forms (business contacts only, not customer data) | Outside India |
WAO will give the Restaurant at least 30 days' notice before adding or replacing a sub-processor that handles customer personal data. If the Restaurant reasonably objects on data protection grounds and the objection cannot be resolved, the Restaurant may terminate the subscription without penalty and receive a pro-rata refund of prepaid fees.
WAO remains responsible to the Restaurant for its sub-processors' performance of these obligations.
6. AI processing
Message content sent to the ordering line is processed by a large language model provider to interpret orders and generate replies. WAO instructs its provider not to use this content to train models, and configures the service so that only the content needed to handle the order is sent. No decision producing a legal or similarly significant effect on a customer is made by this system.
7. Security measures
WAO applies reasonable security safeguards, including:
- Encryption of data in transit, and encryption at rest by its hosting providers.
- Role-based access control, with production data access limited to named personnel and reviewed periodically.
- Separation of each Restaurant's data, so no Restaurant can access another's records.
- Credential management and rotation, with secrets held outside source code.
- Logging of administrative access to production systems.
- Regular backups and a documented restoration process.
WAO may update these measures as the service evolves, provided protection is not materially reduced.
8. Data Principal requests
- If a customer contacts WAO directly with an access, correction, erasure or consent-withdrawal request, WAO will not decide it independently. It will either act on the Restaurant's standing instruction or refer the request to the Restaurant, and will tell the customer which.
- WAO provides tools within the service to action these requests, and will assist the Restaurant in responding within the statutory timeline at no additional charge for reasonable volumes.
- Opt-outs from promotional messages are actioned by the service directly, since honouring them promptly protects both parties and the Restaurant's WhatsApp number.
9. Personal data breach
- WAO will notify the Restaurant without undue delay, and in any case within 24 hours of becoming aware of a personal data breach affecting the Restaurant's customer data.
- The notification will describe what happened, the categories and approximate volume of data involved, the likely consequences, and the measures taken or proposed.
- WAO will provide the information and cooperation the Restaurant reasonably needs to meet its own obligations to affected individuals and to the Data Protection Board of India, and will notify the Board or individuals directly where that duty falls on WAO or where the Restaurant instructs it to.
- WAO will keep a record of breaches and remedial action taken.
- Neither party will make a public statement identifying the other in connection with a breach without prior consultation, except where required by law.
10. Return and deletion of data
- During the subscription, the Restaurant can export its customer database and order history at any time, in a standard machine-readable format.
- On termination, the Restaurant has 30 days to export its data. WAO will provide a final export on request within that window.
- After 30 days, WAO will delete or irreversibly anonymise the Restaurant's customer data from its production systems, and from backups in the ordinary backup rotation cycle.
- WAO may retain data where the law requires it, for as long as required, and will keep it protected by this DPA while it does.
- WAO will confirm deletion in writing on request.
11. Cross-border transfers
Customer data is stored on infrastructure in India. Certain sub-processors named in section 5 process data outside India as an inherent part of their service. Such transfers are limited to what the service requires, subject to the sub-processor's contractual commitments, and subject to any restrictions the Central Government notifies under the DPDP Act. If a transfer becomes unlawful, WAO will change its arrangements or notify the Restaurant so it can terminate without penalty.
12. Audit
On reasonable written notice, and not more than once in any 12-month period unless a breach has occurred, WAO will provide the Restaurant with information reasonably necessary to demonstrate compliance with this DPA. Any on-site or third-party audit is at the Restaurant's cost, must not disrupt WAO's operations, and must not expose any other Restaurant's data.
13. Liability and term
This DPA takes effect when the subscription begins and continues while WAO processes the Restaurant's customer data. Liability under this DPA is subject to the limitation of liability in section 12 of the Terms of Service, except where the DPDP Act imposes liability that cannot be limited by contract.
Where the parties have signed a separate written data processing agreement, that agreement prevails over this one to the extent of any conflict.
14. Governing law
This DPA is governed by the laws of India, and disputes are resolved as set out in section 18 of the Terms of Service.
15. Contact
Data protection queries: info@getwao.com, addressed to the Grievance Officer, M/s WAO.