data processing agreement (DPA)

This data processing agreement (hereinafter "DPA") specifies the obligations under Art. 28 GDPR for the processing of personal data that we carry out on behalf of our customers. It supplements the general terms and conditions (hereinafter "main contract") and is to be read together with the privacy policy . In the event of conflicts between the main contract and this DPA, the provisions of this DPA take precedence insofar as the processing of personal data on behalf is concerned.

1. Contracting parties and roles

The processor is HACO d. Gschnitzer Franz Josef KG, Angerweg 43 - Gasteig, 39040 Ratschings (BZ), South Tyrol, Italy (hereinafter "we" or "provider"). Contact: team@smartchat.marketing.

The controller is you, the customer who uses SmartChat to collect and message your own contacts.

The roles are split in two and described in more detail in section 3 of the privacy policy: for the data of your own account (registration, onboarding and business profile, billing, AI chat, connected channels), we ourselves are the controller; this DPA does not apply to that data. For the data of the contacts you collect and message via SmartChat, you are the controller and we process it exclusively on your behalf. This DPA only concerns that data.

2. Subject matter and duration of the processing

The subject matter of the processing is the provision of the SmartChat services described in the main contract, insofar as personal data of your contacts is processed: in particular collecting contacts via landing pages, website widget, manual entry or import, carrying out the double opt-in procedure, sending WhatsApp newsletters and follow-ups, managing incoming messages in the inbox, creating statistics and, if activated by you, automatically replying to incoming messages.

The duration of the processing corresponds to the term of the main contract. The DPA ends when the main contract ends, without the need for separate termination. The obligations regarding deletion and return (section 10) and confidentiality (section 5) continue to apply beyond that.

3. Nature, purpose and scope of the processing

We process the data exclusively for the purpose of providing you with the services agreed in the main contract. No processing takes place for our own purposes, in particular not for creating our own profiles, for our own advertising or for disclosure to third parties.

3.1 Categories of data subjects

The data subjects are the contacts you record and message via SmartChat (hereinafter "end contacts"): for example prospects, subscribers to your newsletter and your customers.

3.2 Types of data processed

• Master data of end contacts: name, email address, phone number, language
• Consent data: consent status, time and channel of consent or confirmation, and technical details such as IP address and browser
• Content data: content of incoming and outgoing messages and conversations
• Sending metadata: delivery and status information and statistics derived from it
• Other fields that you collect yourself in your forms

Special categories of personal data under Art. 9 GDPR are not part of the processing. If you nevertheless collect such data via SmartChat, you do so at your sole responsibility; in this case, you inform us in advance.

4. Right to issue instructions

We process the data exclusively on your documented instructions. Instructions include this DPA, the main contract, and the settings and entries you make yourself in the application (e.g. creating a landing page, triggering a send or activating automatic replies).

You send individual instructions in text form to team@smartchat.marketing. If we believe that an instruction violates applicable data protection law, we will inform you and may suspend its execution until you confirm it.

If we are required by Union or Member State law to carry out further processing, we will inform you before the processing, unless that law prohibits this on important grounds of public interest.

5. Confidentiality

For processing, we only use people who have committed to confidentiality or are subject to an appropriate statutory obligation of secrecy. This obligation continues after their work ends. The group of people with access is limited to what is necessary to provide the services.

6. Technical and organizational measures (Art. 32 GDPR)

We take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk. These include in particular:

• Tenant separation: strict separation of customer environments at database level (Row Level Security); each customer environment is logically separated.
• Encryption in transit: TLS/HTTPS for all data transmission.
• Encryption of sensitive credentials: WhatsApp and integration tokens are stored encrypted (AES-256-GCM) and never passed to the browser frontend.
• Access control: access restricted to what is necessary; write access to the database exclusively on the server side.
• Integrity: signature verification of incoming webhooks.
• Proof of consent: logging of the time and channel of consent in the double opt-in procedure.

We may develop and adjust these measures as long as the agreed level of protection is not reduced. The current status is described in section 6 of the privacy policy.

7. Sub-processors

You grant us general authorization to engage further processors. We select them carefully and contractually bind them to data protection obligations that meet the requirements of Art. 28 GDPR.

We will inform you in advance in text form about the addition of a new sub-processor or the replacement of an existing one. You may object within 14 days for an important reason relating to data protection. If we cannot then provide the service without the sub-processor concerned, both parties are entitled to terminate the main contract with effect from the date the change takes effect.

At the time the contract is concluded, the following sub-processors are used:

Our payment service provider Polar is not a sub-processor within the meaning of this DPA: Polar processes your payment and billing data under its own responsibility, not the data of your end contacts.

8. Transfers to third countries

Some of the sub-processors listed in section 7 process data outside the EU or the EEA, in particular in the USA. Such transfers only take place where appropriate safeguards under Chapter V of the GDPR are in place: on the basis of the EU-U.S. Data Privacy Framework, where the recipient is certified, and/or on the basis of the EU Commission's standard contractual clauses under Art. 46 GDPR.

9. Support for the controller

We support you, as far as we are able, in fulfilling your obligations:

• Rights of data subjects (Art. 12 to 23 GDPR): If an end contact contacts us directly with a request for access, rectification, erasure or objection, we do not answer it ourselves but forward it to you without delay. You can carry out access, rectification, erasure and export of your contacts yourself in the application at any time.
• Security, notification obligations and data protection impact assessment (Art. 32 to 36 GDPR): We provide you with the information you lack to fulfill these obligations.
• Unsubscribes: If an end contact unsubscribes (on WhatsApp e.g. with "STOP", by email via the unsubscribe link), they are automatically blocked from further sending.

10. Notification of personal data breaches

If we become aware of a personal data breach affecting the data we process on your behalf, we will inform you without delay in text form at the email address stored in your account. Where available, the notification contains a description of the nature of the breach, the categories concerned and the approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Notifying the supervisory authority under Art. 33 GDPR and informing the data subjects under Art. 34 GDPR are your responsibility as the controller.

11. Deletion and return after termination

After the main contract ends, you can export the contact data stored in your account yourself within 30 days. After this period, we delete the data processed on your behalf or return it, unless a statutory retention obligation prevents this. If retention obligations exist, we restrict the processing of the data concerned instead.

You can send a deletion request to team@smartchat.marketing at any time; we confirm the deletion within 30 days.

12. Evidence and audits

On request, we will demonstrate compliance with the obligations under this DPA in a suitable manner, usually through meaningful information or existing evidence. You are entitled to satisfy yourself of compliance. On-site audits must be announced in good time, take place during our normal business hours and must not unreasonably disrupt operations. The cost of audits that go beyond providing information may be charged to you, unless there is a specific reason for the audit.

13. Liability

Liability is governed by the provisions of the main contract, unless Art. 82 GDPR mandatorily provides otherwise. Between the parties, you are responsible for the lawfulness of the collection and of the consents of your end contacts; we are responsible for processing in accordance with your instructions and the contract.

14. Applicable law and place of jurisdiction

Italian law applies. The place of jurisdiction for disputes with businesses is, where legally permitted, the provider's registered office in Bolzano (Italy). The mandatory requirements of the GDPR remain unaffected.

15. Final provisions

Changes and additions to this DPA must be made in text form. If any provision is invalid, the validity of the remaining provisions remains unaffected.

Last updated: 17 July 2026