Skip to content
layer

Legal

Data Processing Addendum

For customers who need a processor agreement under GDPR or similar law.

Last updated 19 August 2026

1. How this fits together

This Addendum forms part of the Terms of Service between you and Applyform LLC. Where it conflicts with the Terms on the processing of personal data, this Addendum governs.

It applies automatically where you process personal data subject to GDPR, UK GDPR, or comparable law. A signed copy is available on request.

2. Roles

You are the controller of the personal data you process through the Service. We are your processor, and we process it only on your documented instructions, which include your use of the Service and its settings.

We remain the controller of our own customer and billing data, which is covered by the Privacy Policy rather than this Addendum.

3. Subject matter and scope

  • Subject matter: providing the WALayer messaging platform.
  • Duration: for as long as your account is open, plus the retention windows in the Privacy Policy.
  • Nature and purpose: transmitting, receiving, storing and reporting on WhatsApp messages you send and receive.
  • Types of personal data: phone numbers, WhatsApp identifiers, display names, message metadata, and message content where your settings store it.
  • Categories of data subject: the people your organisation messages, and your own users of the dashboard.

4. Our obligations

  • Process personal data only on your instructions, unless law requires otherwise, in which case we will tell you first unless prohibited.
  • Ensure everyone we authorise to process the data is under an obligation of confidentiality.
  • Apply appropriate technical and organisational measures, including those described in the Privacy Policy.
  • Assist you with data subject requests, and with data protection impact assessments and consultations, taking account of the nature of the processing.
  • Delete or return personal data at the end of the agreement, subject to the export window and to legal retention duties.
  • Make available the information reasonably needed to demonstrate compliance, and allow audits as described below.

5. Subprocessors

You give general authorisation for us to appoint subprocessors, which are the categories listed in the Privacy Policy. Each is bound by data protection obligations no less protective than these.

We will give at least 30 days' notice before adding or replacing a subprocessor. If you reasonably object on data protection grounds you may terminate the affected part of the Service without penalty.

6. International transfers

Where personal data is transferred out of the EEA, the UK or Switzerland to a country without an adequacy decision, the transfer is made under the European Commission's standard contractual clauses, together with the UK Addendum where applicable. Those clauses are incorporated into this Addendum by reference.

7. Personal data breach

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting your data. The notice will describe what happened, the likely consequences, and the steps taken or proposed.

Send security enquiries to [email protected].

8. Audits

We will respond to reasonable written requests for information needed to confirm our compliance. Where that is not sufficient, you may audit us, or appoint an independent auditor who is not our competitor, no more than once a year, on 30 days' notice, during business hours, and without disrupting the Service or the confidentiality of other customers.

9. Liability

Liability under this Addendum is subject to the limitations in the Terms of Service.

WALayer is a product of Applyform LLC, and is not affiliated with, endorsed by, or sponsored by WhatsApp LLC or Meta Platforms, Inc.