Data Processing Agreement

Last updated: 6 August 2026 · Effective: 6 August 2026 · Art. 28 GDPR / UK GDPR processor terms

1. When this applies, and how it's agreed

This Data Processing Agreement ("DPA") is part of the Terms of Service between you ("Customer", the controller) and the operator of Wanova ("Wanova", "we", the processor), contactable at privacy@wanova.io. It applies whenever you use Wanova in the course of a business or organisation and, in doing so, have us process personal data on your behalf.

It takes effect when you start using Wanova; no signature is needed for it to bind us. If your procurement process needs a countersigned copy, email privacy@wanova.io and we'll sign this text as-is. Where this DPA and the Terms disagree about personal data, this DPA wins.

2. What we process on your behalf — and what we don't

3. Our obligations as processor

1. Only on your instructions (Art. 28(3)(a)). We process the personal data you submit only to deliver the feature you invoked, plus what EU or Member-State law requires of us — in which case we tell you first, unless that law forbids it. Your instructions are: this DPA, the Terms, and the actions you take in the product. If we think an instruction breaks data protection law, we'll say so.
2. Confidentiality (Art. 28(3)(b)). Everyone with access is bound by confidentiality obligations that survive their engagement.
3. Security (Art. 28(3)(c) and Art. 32). The measures in Annex II, kept under review.
4. Sub-processors (Art. 28(2) and (4)) — §5 below.
5. Helping you answer data subjects (Art. 28(3)(e)) — §6.
6. Helping you with Art. 32–36 (Art. 28(3)(f)) — §7.
7. Deletion at the end (Art. 28(3)(g)) — §8.
8. Proving it (Art. 28(3)(h)) — §9.

4. Your obligations as controller

• You need a lawful basis for messaging the people you message, and for putting their messages through an AI service. Consent obtained for one thing isn't consent for everything.
• You must give those people the information they're owed (Art. 13/14) — including that an AI provider may process what they write to you — and honour their rights and opt-outs.
• Don't submit special-category data (Art. 9) or criminal-offence data (Art. 10) to managed AI. The service isn't designed for it and we don't take on that risk. If your conversations involve it, leave AI off — the local features work without it.
• You're responsible for the accuracy and lawfulness of what you send us, and for complying with marketing and anti-spam rules where you and your recipients are.

5. Sub-processors

You give us general authorisation to engage sub-processors. The current list — who they are, what they get, where they are — is published at wanova.io/subprocessors/ and forms Annex III.

• We impose the same data-protection obligations on each sub-processor by contract, and we remain fully liable to you for their performance.
• We give at least 30 days' notice before adding or replacing one, on that page and in the product. To get the notice by email, ask at privacy@wanova.io.
• You may object on reasonable data-protection grounds within those 30 days. We'll try to find a workaround; if we can't, you may terminate the affected part of the service and we'll refund the unused portion of what you've paid.

6. Data subject requests

If one of your contacts contacts us directly, we won't act on it ourselves — we'll tell them to talk to you, and pass the request to you without undue delay.

We'll help you answer requests, taking into account the nature of the processing (Art. 28(3)(e)). In practice the honest answer is short: we retain no content, so there is nothing to search, correct, export or erase on our side. Where help is possible — confirming what a request would have reached, or what a sub-processor holds — we respond within 5 business days.

7. Incidents and impact assessments

• Personal data breach: we notify you without undue delay and in any case within 48 hours of becoming aware of a breach affecting data we process for you, with what we know: what happened, which data and roughly how many people, likely consequences, and what we're doing about it. Updates follow as we learn more. Your Art. 33 clock runs from our notice.
• DPIAs and prior consultation (Art. 35–36): we give you the information about our processing you need, on request. This page and the Privacy Policy are written to be quotable straight into an assessment.

8. Deletion and return

Content sent to managed AI is not stored, so at the end of the service there is nothing to return or delete: the deletion happened at the moment of processing. Your account data is deleted when you delete your account (Privacy §11), which you can do yourself. Sub-processors' own retention is in their terms; the sub-processors page says which of them retain anything.

9. Audits and information

On request, and no more than once every 12 months (or after a breach affecting your data), we'll provide the information needed to demonstrate compliance with Art. 28 — our security measures, sub-processor terms and transfer safeguards. If a documentary review genuinely isn't enough, you or an independent auditor bound by confidentiality may audit, at your cost, with 30 days' notice, at a time that doesn't disrupt the service, and subject to not exposing other customers' data.

10. International transfers

The servers that process your data are inside the EEA (Privacy §9 gives the full picture, provider by provider). Where a transfer to a third country does occur — because of where we ourselves are established, or because a sub-processor's parent company can reach the service from outside the EEA — this is what governs it:

• Where the personal data of EEA data subjects is transferred, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA by reference and take effect on the same date. Annex I, II and III below populate the SCC annexes with the same names.
• For the SCCs: the optional docking clause (Clause 7) applies; under Clause 9(a) Option 2 (general written authorisation) applies with the 30-day notice in §5; under Clause 11 the optional independent-dispute-resolution body does not apply; the governing law under Clause 17, and the forum under Clause 18, are those of the EU Member State in which you are established — we do not pick one for you.
• For UK transfers the ICO's International Data Transfer Addendum (version B1.0) applies to those SCCs. For Swiss transfers the SCCs apply with the FDPIC as supervisory authority and references read as the Swiss FADP.
• Where a sub-processor is covered by an adequacy decision or an approved certification, we rely on that instead; the sub-processors page names the mechanism per provider.

11. Liability, term and changes

This DPA runs for as long as we process personal data on your behalf. Liability under it is subject to the limits in the Terms, except where the GDPR does not allow that. We may update this DPA to keep it accurate or lawful; a change that materially reduces your protection will be announced before it takes effect, and the SCCs themselves are never amended by us.

Annex I — description of the processing

A. Parties

Data exporter / controller: the Customer — the account holder identified in our billing records, acting as controller for the contacts they message. Data importer / processor: the operator of Wanova, contact privacy@wanova.io. Activity: providing the Wanova extension and its managed AI relay.

B. Description

C. Competent supervisory authority

The authority of the Member State in which the Customer's EU representative — or, where the Customer is established in the EEA, the Customer itself — is located.

Annex II — technical and organisational measures

• Encryption in transit: TLS on every connection between the browser, our API and the AI provider. No plaintext endpoint exists in production.
• Minimisation by design: the relay is stateless for content — it forwards and returns, and there is no table, file or log line that content could be written to. The per-request cap (40 messages / 24,000 characters) is enforced client-side before anything is sent.
• Authentication: per-account session tokens (30-day expiry); passwords stored as bcrypt hashes; entitlements carried in Ed25519-signed tokens whose private key stays on the server.
• Access control: production data is reachable only by the people who operate the service; the admin console is role-gated and every mutating action is written to an audit trail (actor, action, time, IP, result).
• Segregation: each account's data is scoped by account id at the query layer; the data-rights endpoints act only on the requesting session's own account.
• Resilience and recovery: managed database with automated backups at the hosting provider; the extension keeps working offline for up to 14 days on its signed licence, so an outage does not stop the Customer's work.
• Deletion: account erasure runs in a single database transaction across every table that references the account; feedback is anonymised rather than orphaned.
• Vendor management: sub-processors are contractually bound to equivalent obligations and listed publicly, with 30 days' notice before any change.
• Breach response: notification to affected controllers within 48 hours of becoming aware; to the supervisory authority within 72 hours where we are controller.

Annex III — sub-processors

The authoritative, dated list lives at wanova.io/subprocessors/ and is incorporated here by reference.

Questions, or a countersigned copy: privacy@wanova.io.