Personal data processing agreement¶
Version 1.0 — in force from 20 August 2026
1. The parties¶
This Agreement is entered into between:
The Client, the natural or legal person subscribing to the Wably service, hereinafter the Controller.
Marco Santucci, NIF Y0814119W, with registered office at Calle Agustina de Aragón 92, Barcelona, Spain, trading under the business name Wably, hereinafter the Processor.
2. Subject matter and acceptance¶
This Agreement governs the processing of personal data carried out by the Processor on behalf of the Controller in the course of providing the Wably service, pursuant to Article 28 of Regulation (EU) 2016/679 (hereinafter the GDPR).
It forms an integral part of the Terms of Service and is accepted by the Controller electronically upon registration for the service. Acceptance is recorded by the Processor together with the date, the time and the version of the Agreement accepted.
In the event of any conflict between this Agreement and the Terms of Service on matters of data protection, this Agreement prevails.
3. Roles of the parties¶
The Controller determines the purposes and means of the processing of the data of its own clients or patients. It is responsible for the lawfulness of the collection, for informing data subjects and, where required, for obtaining consent.
The Processor processes personal data solely on behalf of the Controller and in accordance with its documented instructions, as set out in this Agreement, in the Terms of Service and in the service configuration carried out by the Controller.
The Processor does not in any way determine the purposes of the processing and does not use the Controller's data for its own purposes.
4. Subject matter, duration, nature and purpose of the processing¶
Subject matter. Automated management of communications with the Controller's clients through WhatsApp Business and management of the related appointments.
Duration. For the entire duration of the contractual relationship, in addition to the retention periods set out in section 11.
Nature. Collection, recording, organisation, storage, consultation, use, disclosure by transmission, erasure.
Purposes.
- Receiving and automatically replying to messages from the Controller's clients
- Checking availability and creating, modifying or cancelling appointments
- Sending reminders, summaries and review requests according to the configuration chosen by the Controller
- Recognising contacts and managing the Controller's address book
5. Categories of data subjects and of data¶
Categories of data subjects: clients or patients of the Controller; staff of the Controller authorised to use the service.
Categories of personal data processed:
| Category | Detail |
|---|---|
| Identification data | first name, last name, business name |
| Contact data | telephone number in international format, email address |
| Appointment data | date, time, duration, service requested, booking status |
| Content of communications | text of the messages exchanged between the data subject and the assistant, retained for the technical duration of the conversational session |
| Preferences | language, time zone, consents given per channel |
5.1 Special categories of data (Article 9 GDPR)¶
The service is not designed or intended for the processing of special categories of personal data. The Processor does not request, does not structure and does not retain health data in its own archives.
The Controller acknowledges and undertakes as follows:
a) not to enter special categories of personal data in the free-text fields of the service, including the business description, the list of services, the frequently asked questions, the general information and the contact notes;
b) that those fields are intended exclusively for information relating to the organisation of the business, such as the names of the services offered, prices, durations, opening hours and access arrangements;
c) that, should a data subject spontaneously state the reason for the booking, that information is transmitted by the Processor exclusively to the Controller's electronic calendar, under the Controller's direct control, and is not retained in the Processor's archives;
d) that, in such an event, the legal basis under Article 9 GDPR lies with the Controller by reason of its own professional activity.
6. Controller's instructions¶
The Processor processes personal data solely on the basis of the Controller's documented instructions, consisting of this Agreement, the Terms of Service and the configuration choices made by the Controller in the management panel.
The Processor immediately informs the Controller if it considers that an instruction infringes the GDPR or other applicable data protection provisions.
The Processor does not transfer, sell or make available to third parties the Controller's data for marketing, profiling or artificial intelligence model training purposes.
7. Confidentiality¶
The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
Access to the Controller's data by the Processor's staff is limited to what is strictly necessary for the provision of the service, for technical maintenance and for the support requested by the Controller.
8. Security measures (Article 32)¶
The Processor implements appropriate technical and organisational measures, including:
- Encryption in transit of all communications through TLS protocols
- Encryption of the credentials used to access connected services with the AES-256 algorithm, stored in encrypted form and never in clear text
- Logical isolation of each Controller's data, with application-level separation preventing cross-access
- Authentication of users through a dedicated identity management system compliant with the OpenID Connect standard
- Infrastructure hosted with an enterprise-grade cloud provider whose data centres are located in the European Union
- Limited retention of conversational content, restricted to the technical duration of the session
- Backups of the database performed automatically, together with infrastructure-level copies, kept in protected form
9. Sub-processors¶
The Controller authorises the Processor to engage the sub-processors listed below, each for the function indicated.
| Sub-processor | Function | Location of processing |
|---|---|---|
| Oracle Corporation (Oracle Cloud Infrastructure) | hosting infrastructure and language model inference | European Union |
| Meta Platforms Ireland Ltd. | WhatsApp Business messaging channel | European Union and outside the EU |
| Google Ireland Ltd. | calendar and address book, subject to the Controller's direct authorisation | European Union and outside the EU |
| Stripe Payments Europe Ltd. | management of subscription payments | European Union and outside the EU |
| Sendinblue SAS (Brevo) | sending of service email communications | European Union |
The Processor informs the Controller of any changes concerning the addition or replacement of sub-processors with thirty days' notice, within which the Controller may object on reasonable grounds and, failing agreement, terminate the contract without penalty.
The Processor imposes on each sub-processor data protection obligations equivalent to those set out in this Agreement and remains liable for their performance.
Processing through a language model. The content of the messages is transmitted to the artificial intelligence service of the infrastructure provider for the sole purpose of generating the reply. The data is not used to train models and is not retained by the provider beyond the time necessary for the processing.
10. Transfers outside the EU¶
Where a sub-processor carries out processing outside the European Economic Area, the transfer takes place on the basis of one of the mechanisms provided for in Chapter V of the GDPR, such as an adequacy decision of the European Commission or standard contractual clauses, together with any supplementary measures that may be necessary.
11. Retention and erasure¶
Data is retained for the duration of the contractual relationship.
The content of the conversations is retained only for the technical duration of the session and is automatically deleted at the end of it.
Upon termination of the relationship, the Processor shall, at the Controller's choice, return the data in a structured format or erase it, within thirty days of the request, save for retention obligations laid down by law. Deleting the account entails disconnecting the integrations and revoking the authorisations granted to the connected services.
Appointments recorded in the Controller's calendar and contacts held in its address book remain under the Controller's exclusive control and are not affected by the erasure.
12. Assistance to the Controller¶
The Processor assists the Controller, taking into account the nature of the processing and by appropriate technical and organisational measures, in:
a) responding to requests from data subjects concerning the exercise of the rights provided for in Articles 15 to 22 GDPR;
b) ensuring compliance with the obligations regarding security, notification of breaches and impact assessment set out in Articles 32 to 36 GDPR.
Requests should be addressed to [email protected] and are handled within thirty days.
Should the Processor receive a request directly from a data subject, it shall inform the Controller without undue delay and shall not act on it independently, unless otherwise instructed.
13. Personal data breaches¶
The Processor notifies the Controller of any personal data breach of which it becomes aware without undue delay and in any event within forty-eight hours, providing the information necessary for the Controller to comply with its own notification obligations under Articles 33 and 34 GDPR.
The notification includes, as far as available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed.
14. Audit¶
The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations set out in this Agreement.
The Controller may request an audit, with thirty days' notice, no more than once a year except in the case of an established breach. The audit is conducted in a manner that does not prejudice the continuity of the service and that respects the confidentiality of the Processor's other clients.
15. Liability and applicable law¶
Each party is liable for the damage resulting from the breach of the obligations that the GDPR directly assigns to it.
This Agreement is governed by Spanish law. Any dispute shall be subject to the exclusive jurisdiction of the Courts of Barcelona, Spain, consistently with the Terms of Service.
16. Amendments¶
The Processor may update this Agreement to reflect regulatory changes or the evolution of the service, notifying the Controller with thirty days' notice.
Each version is identified by a number and an effective date. A Controller who does not accept the new version may terminate the contract without penalty within the notice period.
Wably — Personal data processing agreement — Version 1.0
Contact: [email protected] · [email protected]