Data Processing Addendum

Last updated: 20 October 2026

This addendum sets out how we handle the personal data of your contacts that you manage through IGNIPOST Chat. You decide what happens to that data, and we process it only on your instructions. It covers the terms that article 28 of the GDPR requires, in plain language.

1. Parties and scope

This Data Processing Addendum ("DPA") is between you, the customer who holds an IGNIPOST Chat account ("you"), and Sinergia Ventures LTD, a company registered in England and Wales (company number 12082105), registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("we").

It forms part of our Terms of Service and applies when we process personal data for you that is protected by the UK GDPR, the Data Protection Act 2018, the EU GDPR or Morocco's law 09-08 on the protection of personal data. You accept it when you accept the Terms of Service. If this DPA and the Terms of Service conflict on a data protection point, this DPA wins.

2. Roles

• You are the controller of the personal data of your contacts and of the people who message your connected numbers: phone numbers, names, message content, media and the other data described in section 6 ("Customer Personal Data").
• We are your processor for that data.
• For your own account data, such as your name, email and billing details, we are a separate controller, and our Privacy Policy applies.

3. Subject matter

We process Customer Personal Data to provide IGNIPOST Chat to you: connected numbers and their WhatsApp sessions, Quick Send, bulk campaigns and scheduling, templates, contact groups and imports, opt-out keywords, the keyword chatbot, keyword flows with consent checks, optional AI features (message variants and AI Smart Reply), the live chat inbox, the activity log, the developer API and webhooks, and team workspaces.

4. Duration

We process Customer Personal Data for as long as your account is open, and then until it is deleted as described in section 12.

5. Nature and purpose

We collect, store, organize, display, send, receive and delete Customer Personal Data, only as needed to run the features you turn on. Messages pass through the WhatsApp session of the number you connected. We do not use Customer Personal Data for our own purposes, we do not sell it, we do not use it to build advertising profiles, and we do not message your contacts ourselves.

6. Categories of data subjects and personal data

Data subjects

• people on your contact lists and in your contact groups;
• people who send messages to your connected numbers;
• people who appear in the templates, media and knowledge you upload;
• members of your team workspace.

Personal data

• phone numbers, names and WhatsApp profile names;
• contact fields you add or import;
• the content of messages sent and received, and attached images, documents, videos and other media;
• opt-out and consent records, and the decisions logged by flows;
• delivery and activity records for campaigns and automations.

IGNIPOST Chat is not designed for special categories of personal data, such as health data. Please do not use it for them.

7. Your responsibilities

• You have a legal basis for the Customer Personal Data you process with IGNIPOST Chat, such as consent, and you can show it.
• You tell the people you message who you are and how you use their data.
• You honour opt-outs and other data protection requests at once.
• You follow our Acceptable Use Policy and WhatsApp's own terms.
• You decide whether to turn on AI features, and you are responsible for the knowledge you approve.
• Your instructions to us comply with the law.

8. Our duties as processor

We will:

• process Customer Personal Data only on your documented instructions, which are these terms and the settings you choose in IGNIPOST Chat, unless the law requires otherwise. If the law requires otherwise, we will tell you first unless the law forbids it;
• tell you if we think an instruction breaks data protection law;
• make sure everyone who can access the data, at Sinergia Ventures LTD and at IGNITECH SARL AU, is bound by confidentiality;
• apply appropriate technical and organizational security measures, including encryption in transit and at rest, password hashing and role-based access. See our Security page;
• send Customer Personal Data to an AI provider only when you turn on an AI feature, and then only the relevant message text and the knowledge you approved;
• use sub-processors only as described in section 9.

9. Sub-processors

You authorize us to use these sub-processors:

WhatsApp carries the messages sent and received through the numbers you connect. You choose to use WhatsApp, and it acts under its own terms, not as our sub-processor. A current list of sub-processors is available on request at [email protected]. We give each sub-processor data protection duties that are at least as protective as this DPA, and we remain responsible to you for its work.

Before we add or replace a sub-processor, we will give you notice by email. If you have a reasonable data protection objection, tell us within the notice period. We will try to find a solution, and if we cannot, you may stop using the affected feature or close your account.

10. Assistance

Taking into account the nature of the processing, we will help you:

• answer requests from people who use their data protection rights, such as access or deletion. If a request comes to us directly, we will pass it to you and not answer it ourselves unless you ask us to;
• meet your duties on security, breach notification, data protection impact assessments and prior consultation with authorities, using the information available to us.

11. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay and in any case within 72 hours. Our notice will describe, as far as we know at the time, what happened, the data and people affected, the likely consequences and what we are doing about it. We will send further details as we learn them.

12. Deletion and return

While your account is open, you can export or delete your contacts and groups, delete chats and delete connected devices. When you delete a device, we delete its WhatsApp session data. When you delete your account, we erase Customer Personal Data within 30 days, and backups roll off within 35 days, unless the law requires us to keep it.

13. Audits

We will give you the information you reasonably need to show that we meet this DPA. Audits are carried out by documentation: on request, we will share a description of our security measures, our sub-processor list and written answers to reasonable security questionnaires. If a supervisory authority requires more, we will cooperate with it.

14. International transfers

We host Customer Personal Data on servers in the European Union (Germany), behind Cloudflare. IGNITECH SARL AU, our technology service provider, is based in Casablanca, Morocco, and its support and engineering team may access the data from there to run and support the service. Some sub-processors also operate outside the UK and the EEA.

Where personal data leaves the UK or the EEA for a country without an adequacy decision, such as Morocco, the transfer relies on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, and we put equivalent safeguards in place with each sub-processor that receives the data.

15. Liability and changes

Liability under this DPA follows the limits in our Terms of Service, except where data protection law does not allow it. We may update this DPA to reflect changes in the law or in our service. We will tell you about significant changes before they apply.

16. Contact

For questions about this DPA, or to request the sub-processor list or our security documentation, email [email protected].