Data Processing Addendum.

This Data Processing Addendum (DPA) is between Whisperr, Inc., a Delaware corporation (File No. 10571843) (Whisperr) and the Customer that accepted the Whisperr Customer Terms (together with any Order Form, the Agreement).

This DPA forms part of the Agreement. The Customer accepts it by using the service to process Customer Personal Data. A signed copy is available on request from privacy@whisperr.net.

This DPA applies when Whisperr processes Customer Personal Data on behalf of the Customer. If this DPA and the Agreement conflict about personal data, this DPA controls. If this DPA and the Standard Contractual Clauses conflict, the Standard Contractual Clauses control.

Data Protection Laws means all laws on personal data that apply to the processing under the Agreement, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act.

Customer Personal Data means personal data in Customer Data that Whisperr processes on behalf of the Customer.

Standard Contractual Clauses or SCCs means the clauses in the annex to Commission Implementing Decision (EU) 2021/914.

UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

Sub-processor means a third party that Whisperr engages to process Customer Personal Data.

Terms such as controller, processor, data subject, personal data breach and processing have the meanings in the GDPR. Other capitalised terms have the meaning in the Agreement.

The Customer is the controller of Customer Personal Data, or a processor that acts for its own clients. Whisperr is the Customer’s processor, or its sub-processor. Annex 1 describes the processing.

Whisperr processes Customer Personal Data only on the Customer’s documented instructions. The Agreement, this DPA, and the Customer’s configuration and use of the service are the Customer’s complete instructions. The Customer can give further written instructions that are consistent with the Agreement. If the law requires other processing, Whisperr will tell the Customer first, unless the law prohibits this.

Whisperr will tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Laws.

The Customer will:

• have a lawful basis and give the notices that Data Protection Laws require, including for the SDK on End User devices and for each message channel;
• obtain any consent required (for example under ePrivacy rules for device storage, or for marketing email, SMS and push);
• use internal user IDs, not email addresses or phone numbers, as Whisperr user IDs;
• not send special categories of personal data, government IDs, payment card numbers, passwords or data about children, unless Whisperr agrees in writing;
• keep its own provider accounts and credentials secure.

Whisperr makes sure that every person it authorises to process Customer Personal Data is bound by an obligation of confidentiality.

Whisperr implements and maintains the technical and organisational measures in Annex 2. The measures take into account the state of the art, the cost, and the nature, scope, context and purposes of the processing, and the risks to data subjects. Whisperr can update the measures, but it will not lower the overall level of security.

General authorisation. The Customer gives a general authorisation for Whisperr to engage Sub-processors. The current list is at whisperr.net/subprocessors.

Notice. Whisperr will give at least thirty (30) days’ notice before a new Sub-processor starts to process Customer Personal Data. Whisperr posts the notice on the Sub-processors page and emails the account owner.

Objection. The Customer can object in writing within those 30 days on reasonable data protection grounds. The parties will discuss the objection in good faith. If Whisperr cannot reasonably avoid the new Sub-processor for the Customer, the Customer can terminate the affected part of the service. Whisperr will then refund any prepaid fees for the terminated part for the period after termination.

Flow-down. Whisperr puts a written contract in place with each Sub-processor. The contract gives data protection obligations no less protective than this DPA. Whisperr remains responsible for its Sub-processors.

Customer-connected providers. Providers that the Customer connects with its own account and credentials (for example its email, push or SMS provider, or its data sources) are the Customer’s own processors. They are not Whisperr Sub-processors. Whisperr sends or receives data through them only on the Customer’s instruction.

If Whisperr receives a request from a data subject about Customer Personal Data, Whisperr will forward it to the Customer without undue delay. Whisperr will not answer the request itself, except to confirm that it forwarded the request, unless the Customer authorises it.

Whisperr will help the Customer, by appropriate technical and organisational measures, to answer requests to access, correct, delete, restrict, export or object. When the Customer cannot do this itself in the service, the Customer can send the request to privacy@whisperr.net. Whisperr will complete it without undue delay and within 30 days.

Whisperr will notify the Customer of a personal data breach that affects Customer Personal Data without undue delay, and in any case within 48 hours after Whisperr becomes aware of it.

The notice will include, as far as known at the time:

• the nature of the breach, including the categories and approximate number of data subjects and records;
• a contact person at Whisperr;
• the likely consequences;
• the measures taken or proposed to address the breach and to reduce its effects.

Whisperr will give more information as it becomes available. Whisperr will take reasonable steps to contain and fix the breach. A notice is not an admission of fault.

Whisperr will give the Customer reasonable help with data protection impact assessments and prior consultations with supervisory authorities, where the processing by Whisperr is relevant. Whisperr will give the information that it has.

When the Agreement ends, Customer Personal Data is available for export for thirty (30) days, as in Section 19 of the Customer Terms. Within thirty (30) days after that period, Whisperr will delete or return Customer Personal Data, at the Customer’s choice. Backup copies expire on their 14-day cycle.

Whisperr can keep data that the law requires it to keep. Whisperr will protect that data under this DPA and will process it only for the purpose the law requires.

During the Agreement, the Customer can ask Whisperr to delete specific Customer Personal Data, for example one End User’s data, as in Section 8.

Whisperr will make available the information that is necessary to show compliance with this DPA and Article 28 of the GDPR. This includes answers to reasonable security questionnaires.

If that information is not enough, the Customer (or an independent auditor that the Customer mandates and that is bound by confidentiality) can audit Whisperr once per year, on at least 30 days’ written notice, during business hours. A supervisory authority can audit at any time the law allows. The Customer pays its own costs. The audit must not risk the security or confidentiality of other customers’ data.

Whisperr hosts the service in the EU (Sweden). Whisperr, Inc. is established in the United States. Some Sub-processors and staff are outside the EEA.

EEA. For transfers of Customer Personal Data from the EEA to Whisperr in a country without an adequacy decision, the SCCs apply and form part of this DPA:

• Module 2 (controller to processor) when the Customer is a controller;
• Module 3 (processor to processor) when the Customer is a processor.

For the SCCs:

• Clause 7 (docking clause) applies.
• Clause 9: Option 2 (general written authorisation) applies, with the notice period in Section 7 of this DPA.
• Clause 11: the optional language does not apply.
• Clause 13: the competent supervisory authority is as in Annex 1.
• Clauses 17 and 18: the law and the courts of Ireland.
• Annexes I and II of the SCCs are Annex 1 and Annex 2 of this DPA. Annex III is the Sub-processors page.

United Kingdom. For transfers from the UK, the UK Addendum applies. Its Table 1 to 3 information is in Annex 1 and Annex 2. Either party can end the UK Addendum as in its Section 19.

Switzerland. For transfers from Switzerland, the SCCs apply with these changes: the competent authority is the Swiss Federal Data Protection and Information Commissioner, references to Member State law include Swiss law, and data subjects in Switzerland can bring claims in Switzerland.

Onward transfers. When a Sub-processor receives Customer Personal Data outside the EEA, Whisperr uses the SCCs, the EU-U.S. Data Privacy Framework (where the Sub-processor is certified), or another valid mechanism, with supplementary measures where needed.

For personal information subject to US state privacy laws, Whisperr is a service provider or processor. The terms in Section 12 of the Customer Terms apply. Whisperr will not sell or share that personal information, will not use it outside the direct business relationship with the Customer, and will not combine it with other data except as the law allows. Whisperr will tell the Customer if it can no longer meet these obligations.

Each party’s liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws or the SCCs do not allow a limit.

This DPA applies for as long as Whisperr processes Customer Personal Data. Whisperr can update this DPA to reflect changes in law or in its service. Whisperr will not reduce the Customer’s protection without notice under Section 20 of the Customer Terms.

• Hosting. The API, workers, database and cache run in Microsoft Azure, Sweden Central (EU). The database runs with zone-redundant high availability.
• Encryption. TLS for all data in transit to our public endpoints. Encryption at rest for the database and backups (Azure storage encryption). The credentials that Customers give us for their delivery providers are also encrypted at the application level with a separate key.
• Network. Public traffic to the API and dashboard enters only through Cloudflare. Database connections need credentials and TLS and are limited by firewall rules. We are moving the database to a private network.
• Access control. Each workspace is isolated by organisation and app. Ingestion keys are split into publishable keys (for apps and browsers) and server keys (for backends), with separate rate limits. Only a small number of named staff can access production systems.
• Secrets. Production secrets are kept in Azure Key Vault, not in source code.
• Data minimisation. The API does not store End User IP addresses. The SDKs do not collect advertising IDs or precise location. A filter removes contact data, links and IDs from event values before any AI request. Contact addresses and traits are removed from failed-payload records.
• AI providers. We call AI models through business APIs whose terms do not allow training on our data. We do not send email addresses, phone numbers or push tokens to AI providers.
• Backups and recovery. Automatic database backups with 14-day point-in-time restore, copied to a second Azure region in Sweden.
• Secure development. Code changes go through pull requests. Automated tests run on pull requests.
• Personnel. Staff and contractors are bound by confidentiality obligations.
• Incidents. Security reports go to security@whisperr.net. We investigate, contain and notify as in Section 9.

The list of Sub-processors is at whisperr.net/subprocessors. It was current on October 8, 2026: