Data Processing Agreement

1. Roles and scope

The merchant is the controller of the personal data of its buyers, recipients and the people who message it that it puts into or receives through WhatCart (“buyer data”). Bit Techs, 18 Health Street, Ain Shams, Cairo 11728, Egypt, which operates WhatCart, processes buyer data as the merchant’s processor (service provider), only to provide the service. For merchant account data WhatCart is the controller, as the Privacy Policy https://whatcart.net/privacy explains.

This agreement applies for as long as we process buyer data for the merchant: from the merchant’s sign-up until its buyer data is deleted under section 11.

2. Processing on instructions

We process buyer data only on the merchant’s documented instructions: the Terms of Service, this agreement, and the merchant’s use and settings of the service. We follow other instructions only where the law requires it, and then we tell the merchant first unless the law forbids that. We tell the merchant if we believe an instruction breaks the law. We do not sell buyer data, use it for our own purposes, our marketing or advertising, or combine it with other merchants’ data.

3. Subject matter, data and people concerned

People concerned: the merchant’s buyers and prospective buyers, gift recipients, and people who message the merchant’s WhatsApp number. Categories of data:

• Identity and contact data: name, phone number and WhatsApp profile name.
• Delivery data: addresses and, when the buyer sends one, a location or maps link.
• Order data: products, prices, payments, refunds, returns and shipment status.
• Conversation data: messages and media exchanged on WhatsApp, message status, and marketing consent or opt-out records.

Nature and purpose: storing, organising, displaying, sending and receiving buyer data in order to take and fulfil orders, message buyers on WhatsApp on the merchant’s behalf, record payments, deliveries and returns, and run the other features the merchant turns on. The service is not designed for special categories of personal data (such as health, religion or biometric data), or for data about children, and merchants should not collect them through it.

4. The merchant’s responsibilities

The merchant is responsible for having a legal basis for the buyer data it processes, for giving its buyers a privacy notice, for getting any consent its law requires (including WhatsApp opt-in for marketing, under the WhatsApp Business Messaging Policy, and in Türkiye the rules of Law No. 6563 on commercial electronic messages), and for any registration, licence or notification its own law requires of it as a controller, such as registering with a data protection authority. The merchant’s instructions must comply with the law.

5. Confidentiality

Everyone at WhatCart who can access buyer data is bound by confidentiality and accesses it only as far as needed to run and support the service. Our support staff open a store only for a recorded reason, and each such access is logged.

6. Sub-processors

The merchant gives us general authorisation to use sub-processors. Our current sub-processors for buyer data are:

• Hostinger (Hostinger International Ltd): hosting of our servers and database in Paris, France (European Union).
• Cloudflare, Inc. (R2 object storage): WhatsApp media, product images and attachments; data centre location chosen by Cloudflare.
• Meta Platforms (WhatsApp Business Platform): message and catalog delivery.
• Google (Firebase Cloud Messaging): push notifications to the WhatCart app on team members’ phones, which can include a buyer’s name or phone number.
• Google (Firebase Crashlytics): crash diagnostics from the WhatCart mobile app, without buyer data.

Payment providers (such as Paymob and Stripe) that the merchant connects under its own agreement with them, and the carriers whose accounts the merchant connects to book and track parcels, are the merchant’s own providers and are not our sub-processors. Our email provider (Resend) sends account emails to the merchant’s team only and receives no buyer data, and Gumroad, the merchant of record through which merchants buy order packs, receives no buyer data either.

We bind each sub-processor by written contract to data protection obligations at least as protective as this agreement, and we remain responsible to the merchant for them. We announce a new or replaced sub-processor on this page, and by email for material changes, at least 30 days in advance. The merchant may object on reasonable data protection grounds within that period and, if we cannot resolve the objection, may end the service and have its data deleted.

7. Security

We keep appropriate technical and organisational measures, including:

• Encryption in transit (HTTPS/TLS), and encryption of access tokens and secrets at rest.
• Isolation of each store’s data from other stores.
• Role-based permissions, step-up verification before sensitive actions, and an audit log.
• Retention and deletion schedules, and backups, as set out in the Privacy Policy.

We review these measures as the service and the risks change.

8. Personal data breaches

If we become aware of a personal data breach affecting buyer data, we notify the merchant without undue delay and within 48 hours of becoming aware of it, with what we know about its nature, the data and people concerned, its likely consequences and the measures taken or proposed, and we send further information as we learn it. This lets the merchant meet the deadlines of its own law, several of which are short (for example 72 hours to the regulator in Saudi Arabia, Egypt, Türkiye, Oman and Jordan, and 24 hours to affected people in Jordan). We help the merchant notify authorities and the people affected, and we do not notify them on the merchant’s behalf unless the merchant asks us to or the law requires us to.

9. Help with requests and assessments

Taking into account the nature of the processing, we help the merchant answer buyers’ requests to exercise their rights. The merchant can export or delete a buyer’s personal data itself from the buyer’s customer page, and download its store data at any time. If a buyer sends a request to us, we forward it to the merchant within 7 days and do not answer it ourselves unless the merchant asks us to. We also help with data protection impact assessments and consultations with authorities where needed.

10. International transfers

Buyer data is processed outside the merchant’s country: our servers are in France, and the sub-processors above process data in the United States and other countries. We make these transfers only with a safeguard the applicable law recognises, such as standard contractual clauses in our sub-processor agreements, and with any licence, permit or notification the law requires, as the Privacy Policy describes. Where the merchant’s law requires a transfer contract between the merchant and us, this agreement together with that contract applies; for example, for merchants in Saudi Arabia we sign SDAIA’s standard contractual clauses for transfers from a controller to a processor on request.

Türkiye: for merchants in Türkiye, transfers of buyer data abroad are made under the standard contract for transfers from a controller to a processor published by the Personal Data Protection Authority (KVKK), which we sign with the merchant on request, without changing its text. The standard contract must be notified to the Authority within five business days of signing; unless the parties agree otherwise, the merchant as the data exporter makes that notification, and we give it the documents it needs.

11. Deletion or return at the end

Before its store is deleted, the merchant can download its store data in Settings → Export store data, or ask us for a copy. When the store is deleted, we delete buyer data at once, and within 30 days of a deletion request, as described in the Privacy Policy and the Data Deletion Instructions https://whatcart.net/data-deletion. Remaining copies in logs, event notifications and backups expire within 12 months. We keep buyer data longer only where the law requires it, and then only for that purpose.

12. Information and audits

On request, we give the merchant the information needed to show that we meet this agreement, such as a description of our security measures and sub-processors. Where that is not enough, or a regulator requires it, the merchant (or an independent auditor bound by confidentiality) may audit our compliance on 30 days’ notice, at most once a year unless after a breach, at its own cost, and without access to other merchants’ data.

13. Precedence

If this agreement conflicts with the Terms of Service about buyer data, this agreement prevails. If a standard contract required by law is signed between the merchant and us, that contract prevails over this agreement where they conflict.

14. Contact

Data protection questions: privacy@whatcart.net.

WhatCart is operated by Bit Techs, 18 Health Street, Ain Shams, Cairo 11728, Egypt.