Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is between Campus Market Private Limited ("Processor") and the business or organisation using Conversia ("Controller"). It applies when Processor handles personal data in Customer Data on Controller's behalf through the Conversia service.

Controller remains responsible for deciding the purposes and means of processing and for its instructions, notices, permissions, and legal basis. Processor will process personal data only to provide, secure, support, and maintain the service, as described in this DPA, the Terms of Service, and Controller's documented lawful instructions.

2. Processing details

The processing is for the duration of Controller's use of the service and any permitted retention period after closure. Its nature and purpose are to host, transmit, organise, display, secure, and support business workspace information and WhatsApp communications connected by Controller.

Data subjects may include Controller's staff, workspace users, business contacts, and people who message Controller through WhatsApp. Data may include contact details, message content, account and workspace identifiers, communication metadata, and configuration information. Controller must not submit special-category or similarly sensitive data unless it is necessary, lawful, and the parties have agreed appropriate safeguards.

3. Processor obligations

• Process personal data only on documented instructions, including instructions to transfer data internationally, unless law requires otherwise. If legally permitted, notify Controller before processing required by law.
• Ensure persons authorised to process personal data are subject to confidentiality obligations.
• Maintain appropriate technical and organisational safeguards, including access controls, authentication and security checks where configured, and encryption of stored Meta access tokens and registration PINs.
• Use the subprocessors listed on the Subprocessors page and remain responsible for their performance of applicable data-protection obligations.
• Notify Controller without undue delay after becoming aware of a personal-data breach affecting Controller's data, and provide information reasonably available to help Controller meet its legal obligations.
• Taking into account the nature of the processing, provide reasonable assistance with data-subject requests, security obligations, impact assessments, and regulator consultations.
• Make available information reasonably necessary to demonstrate compliance with this DPA and allow reasonable audits on notice, subject to confidentiality, security, and protection of other customers' information.

4. Controller obligations

Controller will ensure it has the authority and lawful basis to provide personal data to Conversia, give required privacy notices, honour data-subject rights, configure the service lawfully, and provide complete and lawful processing instructions. Controller is responsible for its own users' access, use of WhatsApp, and compliance with Meta policies.

5. Subprocessors and transfers

Controller authorises the subprocessors identified on the Subprocessors page to process personal data as necessary to provide the service. We will update that page when subprocessors change. Where practicable, we will provide notice of a material new subprocessor so Controller can raise a reasonable, data-protection-based objection. If the parties cannot resolve the objection, Controller may stop using the affected service.

Subprocessors and infrastructure may process data outside Zimbabwe. Processor will use transfer safeguards where required by applicable data-protection law.

6. Return and deletion

When the service ends, Controller may request export of available Customer Data before closure where the service supports it. Processor will delete or de-identify personal data processed on Controller's behalf when no longer needed, subject to legal retention duties and ordinary backup or security-system cycles. Data in backups may remain until those systems overwrite or expire it.

7. Liability and precedence

The liability limits in the Terms of Service apply to this DPA to the extent permitted by law. If this DPA conflicts with the Terms of Service on processing of personal data, this DPA controls for that subject. Nothing in this DPA removes a right or obligation that applicable law makes mandatory.