Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of, and is subject to, the Terms of Use between Mrge IT Private Limited (operating as "wedd.ai"), a private limited company incorporated under the Companies Act, 2013, having its registered office at 30-15-166/2, 2nd Floor, Hirawat Complex, Dabagardens, Visakhapatnam (Urban), Visakhapatnam-530020, Andhra Pradesh, India (CIN: U63119AP2026PTC126756) ("wedd.ai" / "Processor") and the business customer that uses the Services ("Customer" / "Controller").

This DPA applies only where wedd.ai processes personal data on the Customer's behalf — in particular, where the Customer connects and sends messages from its own WhatsApp Business Account and number through the Platform (see Section 3.4 of our Privacy Policy). Where the Customer instead uses a default WhatsApp business number provided by wedd.ai, wedd.ai acts as a data controller and our Privacy Policy — not this DPA — governs that processing.

1. Roles and Scope

For personal data processed under this DPA, the Customer is the controller (or, where the Customer is itself a processor for a third party, the processor) and wedd.ai is the processor (or sub-processor). wedd.ai will process personal data only on the Customer's documented instructions, including as set out in the Terms of Use, this DPA, and the Customer's configuration and use of the Platform, unless required to do otherwise by applicable law.

2. Subject Matter and Details of Processing

3. Customer Obligations

The Customer represents and warrants that it will:

• Comply with applicable data-protection and messaging laws and with Meta's policies, including the WhatsApp Business Messaging Policy and WhatsApp's Terms of Service;
• Obtain and maintain all necessary consents and opt-ins from recipients before messaging them through the Platform;
• Provide any required privacy notice to its own data subjects; and
• Give wedd.ai only lawful and documented processing instructions through its use of the Platform.

4. Confidentiality

wedd.ai will ensure that personnel authorised to process the personal data are bound by appropriate obligations of confidentiality and access it only on a need-to-know basis.

5. Security Measures

wedd.ai will implement appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, network security, regular audits, and incident-response procedures, consistent with Section 9 of our Privacy Policy.

6. Sub-processors

The Customer authorises wedd.ai to engage the sub-processors listed below to process personal data in connection with the Services. wedd.ai imposes data-protection obligations on each sub-processor that are no less protective than those in this DPA and remains responsible for their performance. wedd.ai will give the Customer prior notice of any intended addition or replacement of a sub-processor, giving the Customer the opportunity to object on reasonable data-protection grounds.

7. Assistance with Data-Subject Requests

Taking into account the nature of the processing, wedd.ai will provide reasonable assistance to the Customer, by appropriate technical and organisational measures, in responding to requests from data subjects to exercise their rights. If wedd.ai receives such a request directly, it will, where lawful, refer the data subject to the Customer.

8. Personal Data Breach Notification

wedd.ai will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting the Customer's data, and will provide the information reasonably necessary for the Customer to meet its own notification obligations.

9. International Transfers

Personal data processed by wedd.ai is primarily hosted in India (AWS Mumbai and Hyderabad regions). Certain sub-processors, including Meta, may process personal data outside India as part of delivering their services. Where personal data is transferred across borders, the parties will put in place any transfer mechanism required by applicable law.

10. Deletion and Return of Data

On termination of the Services, and at the Customer's choice, wedd.ai will delete or return the personal data processed on the Customer's behalf and delete existing copies, unless applicable law requires further storage. Data-deletion requests may also be made using our data deletion request form or as described in our Privacy Policy.

11. Audits

On reasonable written request, and no more than once per year, wedd.ai will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA — for example, a summary of its security measures or responses to a reasonable security questionnaire. Because the Services are provided on a standardised, self-service basis, on-site inspections are not offered; this documentation-based process satisfies the parties' audit obligations under this DPA.

12. General

Except as expressly modified by this DPA, the Terms of Use remain in full force and effect. Each party's liability under this DPA is subject to the limitations set out in the Terms of Use. This DPA is governed by the laws of India, and the courts of Visakhapatnam, Andhra Pradesh have exclusive jurisdiction, consistent with the Terms of Use.

13. Contact

For any questions about this DPA or to make a request under it, contact us at admin@wedd.ai.

Mrge IT Private Limited (operating as wedd.ai)
CIN: U63119AP2026PTC126756
30-15-166/2, 2nd Floor, Hirawat Complex
Dabagardens, Visakhapatnam (Urban), Visakhapatnam-530020
Andhra Pradesh, India
Email: admin@wedd.ai
Website: https://www.wedd.ai