This Data Processing Agreement (“DPA”) forms part of the agreement between Creative Reach Technologies, operating WatsayPay (“Processor,” “we,” “us”), and the business using the Service (“Controller,” “you,” “your”), and applies whenever WatsayPay processes personal data on your behalf as part of providing the Service.

1. Background

When you use WatsayPay to invoice, quote, or manage records for your own customers, you determine the purpose and means of processing that customer data — making you the “Data Controller.” WatsayPay processes that data only on your instructions, making us the “Data Processor,” as defined under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

2. Scope & Nature of Processing

Categories of data processed:
Your customers’ names, contact details (phone number, email, WhatsApp number), invoice and quotation records, payment history, and outstanding balances.

Purpose of processing:
To generate and deliver invoices, quotations, and retention contracts on your behalf; process payments; send automated payment reminders; and maintain your dashboard and records.

Duration:
For as long as your account is active, and thereafter only as required for legal record-keeping (see Section 7).

3. Our Obligations as Processor

We agree to:

• Process personal data only on your documented instructions, as necessary to provide the Service
• Ensure our personnel with access to the data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures to protect the data
• Assist you in responding to data subject requests (such as access or deletion requests from your customers) where reasonably required
• Notify you without undue delay if we become aware of a personal data breach affecting your customers’ data
• Not sell, rent, or use your customers’ data for any purpose beyond providing the Service

4. Subprocessors

We use the following categories of subprocessors to deliver the Service:

• Payment processors (e.g., Stripe) to process payments
• WhatsApp Business API / Meta to deliver messages you send through the platform
• Email service providers to deliver invoices and notifications
• Cloud hosting providers to store and secure platform data

We remain responsible for ensuring our subprocessors meet data protection obligations equivalent to those in this DPA. We will notify you of any material change in subprocessors where required.

5. International Data Transfers

Where personal data is transferred or stored outside the UAE, we take reasonable steps to ensure it remains protected in a manner consistent with the PDPL.

6. Your Obligations as Controller

You are responsible for:

• Having a lawful basis to collect and process your customers’ personal data
• Providing your customers with appropriate notice regarding how their data is used, including through WatsayPay
• Ensuring the accuracy of the data you input into the platform
• Obtaining any consents required from your customers, including for receiving invoices, quotations, or automated reminders via WhatsApp or email

7. Data Retention & Deletion

Upon termination of your account, we will delete or return your customers’ personal data, except where we are required to retain financial records under UAE law (typically a minimum of 5 years).

8. Security Measures

We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, loss, or disclosure, including encryption, access controls, and regular security review of our systems.
9. Liability
Each party’s liability under this DPA is subject to the limitation of liability terms set out in the WatsayPay Terms of Service.

10. Governing Law

This DPA is governed by the laws of the United Arab Emirates, consistent with the governing law provisions in the WatsayPay Terms of Service.

11. Contact

Questions about this DPA can be directed to us via our Contact page.