Data Processing Addendum
Last updated October 26, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Monarkz ("Processor") and the Customer ("Controller") and applies where Monarkz processes personal data on the Customer's behalf.
1. Scope and roles
The Customer is the controller of personal data contained in Customer Data (for example contacts' names, phone numbers and message content). Monarkz processes that data as a processor solely to provide the Service.
2. Processing details
| Item | Description |
|---|---|
| Subject matter | Provision of the WhatsApp marketing, inbox, chatbot and CRM Service. |
| Duration | The subscription term plus any export or deletion period. |
| Nature and purpose | Storing, organising, transmitting and analysing messages and contact data on the Customer's instructions. |
| Data subjects | The Customer's contacts, customers, leads and authorised users. |
| Data categories | Names, phone numbers, WhatsApp profile data, message content and media, tags, custom fields, and usage metadata. |
3. Processor obligations
- Process personal data only on the Customer's documented instructions, including those given through the Service.
- Ensure personnel are bound by confidentiality.
- Implement appropriate technical and organisational security measures, including encryption in transit, access controls, logging and backups.
- Assist the Customer with data-subject requests, security, breach notification and impact assessments, taking into account the nature of processing.
- Notify the Customer without undue delay after becoming aware of a personal data breach.
- Delete or return personal data at the end of the Service, unless the law requires storage.
- Make available information reasonably needed to demonstrate compliance.
4. Sub-processors
The Customer authorises Monarkz to use sub-processors, including Meta Platforms, Inc. (WhatsApp Business Platform), cloud hosting providers and payment processors. Monarkz remains responsible for its sub-processors and will give notice of new sub-processors, allowing the Customer to object on reasonable grounds.
5. International transfers
Where personal data from the EEA, UK or Switzerland is transferred to countries without an adequacy decision, the parties rely on the applicable Standard Contractual Clauses or another lawful transfer mechanism.
6. Customer obligations
The Customer is responsible for having a lawful basis and valid opt-in consent for processing and messaging, and for the accuracy of Customer Data.
7. Contact
To request a signed copy of this DPA, contact us.
Monarkz
770 Market St, Farmington, MO 63640, USA
Phone: +1-562-352-5539
Online: Contact form