Data Processing Agreement

1. Subject Matter & Duration

Musak Leads processes personal data on your behalf for the purpose of providing the CRM and WhatsApp messaging service you've subscribed to — specifically, the personal data of your contacts and leads, including their phone numbers, names, message content, and related metadata (collectively, "Tenant Personal Data"). This DPA applies for as long as Musak Leads processes Tenant Personal Data on your behalf, beginning when you first submit or generate such data in the platform and ending on completion of the deletion obligations in Section 6.

2. Nature, Purpose & Categories of Processing

Nature and purpose. Storage, organization, transmission (including via the WhatsApp Cloud API), and display of Tenant Personal Data to provide lead management, unified inbox, automation, and related CRM functionality.

Categories of data subjects. Your contacts, leads, and end-customers.

Categories of personal data. Names, phone numbers, WhatsApp display names, message content and media, conversation metadata, email addresses, and standard business-relevant fields you choose to store (for example, notes, tags, or deal values).

Restriction on special category data. You must not submit, upload, or otherwise process through the service any special category of personal data — including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, or data concerning a person's sex life or sexual orientation — unless we have agreed to that processing in writing in advance and put appropriate additional safeguards in place. Musak Leads is not configured or contractually positioned to process special category data by default, and any such data submitted without our prior written agreement is submitted at your own risk and in breach of this DPA.

3. Processor Obligations

Musak Leads agrees to:

• Process Tenant Personal Data only on your documented instructions, as expressed through your configuration and use of the platform, unless required to do otherwise by law (in which case we will inform you before processing, unless legally prohibited from doing so);
• Ensure that personnel authorized to process Tenant Personal Data are subject to confidentiality obligations;
• Implement appropriate technical and organizational security measures, including: encryption in transit via HTTPS/TLS for all data in motion; encryption at rest for data stored in our Supabase-managed PostgreSQL database; database-level tenant isolation enforced via Row-Level Security, so one Tenant's data is not accessible in queries scoped to another; role-based access control for our own personnel; and routine security review of the infrastructure handling Tenant Personal Data;
• Assist you, insofar as reasonably possible and taking into account the nature of the processing, in responding to data subject requests (access, correction, deletion, export) concerning Tenant Personal Data, including through in-platform export and deletion tools;
• Assist you, insofar as reasonably possible and taking into account the information available to us, with any Data Protection Impact Assessment (DPIA) you are required to carry out in connection with your use of the service, and with any related prior consultation with a supervisory authority, by providing relevant information about our processing activities on request;
• Not engage a new sub-processor without providing notice as described in Section 4, and remain responsible for any sub-processor's performance of its obligations.

4. Sub-processors & International Transfers

You authorize Musak Leads to engage the following sub-processors to provide the service, each of which processes Tenant Personal Data only to the extent necessary for its role:

Sub-processor flow-down. Musak Leads imposes data protection obligations on each sub-processor, by way of a binding written contract, that are no less protective of Tenant Personal Data than the obligations set out in this DPA. Musak Leads remains fully liable to you for a sub-processor's failure to meet those obligations.

Cross-border transfers. Several sub-processors listed above are located in, or process data in, countries that have not been recognized by the European Commission or the UK Information Commissioner's Office as providing an adequate level of data protection (including the United States). Where Tenant Personal Data originating from the EU/EEA or UK is transferred to such a sub-processor, that transfer is governed by the European Commission's Standard Contractual Clauses (Module Two: Controller to Processor, or Module Three: Processor to Processor, as applicable to the relevant sub-processor relationship), and, for transfers from the UK, the UK International Data Transfer Addendum to those clauses. Those clauses and the addendum are incorporated into this DPA by reference and apply automatically to the extent required by applicable law; a copy is available on request to info@musakleads.com.

We will provide reasonable advance notice before adding or replacing a sub-processor that materially changes how Tenant Personal Data is processed, giving you the opportunity to object on reasonable data-protection grounds.

5. Data Incident Notification

In the event of a confirmed personal data breach affecting Tenant Personal Data, Musak Leads will notify you without undue delay, and in any case within 48–72 hours of becoming aware of the incident. That notification will include, to the extent then known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it.

We will further cooperate with you and provide reasonable assistance and information as our investigation progresses, including such information as you reasonably require to meet your own regulatory breach-notification obligations to a supervisory authority (such as the CNDP or an EU/UK data protection authority) or to affected data subjects, within the timeframes those obligations require.

6. Data Deletion at Contract End

Upon termination or cancellation of your subscription, Musak Leads will permanently delete all Tenant Personal Data from our production Supabase database — including WhatsApp Business Account tokens, contact records, and message logs — within 30 days of the effective termination date, except where retention of specific records is required by applicable law (for example, billing records retained for tax purposes). Backups containing Tenant Personal Data are purged on our standard backup rotation schedule following the same 30-day window. You may request a data export before cancellation takes effect; export tools are available in your account settings.

7. Audit & Cooperation

On reasonable written request, no more than once per 12-month period, we will provide you with the information reasonably necessary to demonstrate compliance with this DPA, such as a summary of our security practices and relevant compliance documentation. On-site or third-party audits are available for Enterprise-tier agreements, subject to a separately agreed scope, notice period, and reasonable cost allocation; contact us at info@musakleads.com to arrange one.

8. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations of liability set out in the Terms of Service between the parties.

9. Moroccan Law 09-08 & CNDP Compliance

Musak Leads processes personal data from Morocco and is subject to Law No. 09-08 on the protection of individuals with regard to the processing of personal data, enforced by the Commission Nationale de contrôle de la protection des Données à caractère Personnel ("CNDP"). Musak Leads has completed its declaration obligations to the CNDP covering the processing activities described in this Agreement and our Privacy Policy, in full compliance with Law 09-08.

10. Precedence & Acceptance

By creating an account and connecting a WhatsApp Business Account through Musak Leads, you accept this DPA as part of your agreement with us, alongside the Terms of Service and Privacy Policy. Enterprise Tenants requiring a separately countersigned copy of this DPA should contact us at info@musakleads.com.