Data Processing Agreement

Version 2026-10-27.1 · Updated 27 October 2026

DRAFT — owner and professional legal approval required before commercial reliance. Missing details and unverified safeguards are explicitly identified below.

Draft parties and scope

Customer [LEGAL NAME] is controller/responsible party; [WHALE LEGAL ENTITY] is processor/operator for visitor support content and intelligence. Account and own-purpose security/billing processing are addressed separately. This draft is not executed and does not establish transfer safeguards.

Processing schedule

Duration: subscription plus agreed deletion/return period [APPROVE]. Purposes: host knowledge, embed content, answer questions, store support conversations and generate insights. Subjects: customer personnel and website visitors. Data: messages, identifiers, timestamps, supplied documents, internal notes and evidence excerpts. Sensitive/children’s data are not intended and require separate assessment.

Instructions and confidentiality

Process only documented lawful customer instructions, including authorised transfers. Inform customer if an instruction appears unlawful; notify of legally compelled disclosure unless prohibited. Bind authorised staff to confidentiality, least privilege and security training. Customer remains responsible for lawful basis, notices and content permissions.

Security, assistance and incidents

Schedule A requires tenant isolation, authentication, secure transport, secret management, access review, retention enforcement and tested restoration; deployment evidence is outstanding. Assist proportionately with requests, assessments and regulator enquiries. Notify customer of personal-data breaches without undue delay with available facts, containment and follow-ups. No contractual deadline or certification is invented.

Subprocessors and audit

List Supabase and OpenAI for customer content; hosting/email remain unverified. Paddle and Google may act independently for some processing. [APPROVE: notice period and reasonable objection procedure for changes]. Flow down applicable processor obligations. Provide security evidence and reasonable audits subject to confidentiality, avoiding access to other tenants.

Return, deletion and transfers

On termination, return/export or delete content as instructed subject to lawful exceptions, backups and provider retention. [APPROVE: export window and backup schedule]. Assess POPIA section 72 and GDPR Chapter V/UK transfer rules for every route. EU SCC modules, UK Addendum/IDTA and transfer impact assessments may be needed depending on parties, location and existing arrangements; attach completed instruments only after legal review. No provider agreement is represented as signed.

Approval

Counsel must finalise parties, processing/security schedules, subprocessors, international transfer annexes, liability alignment and execution before relying on this DPA.