Last update: August 2026.
This Data Processing Agreement (“DPA”) applies where Nagence, Inc. (“2Chat”, “we”, “our”, “us”) processes Personal Data on behalf of a customer (“Customer”, “you”) in the course of providing the Service. It forms part of our Terms of Service and is incorporated into them by reference.
Where this DPA conflicts with the Terms of Service in respect of the processing of Personal Data, this DPA prevails.
There are two distinct sets of Personal Data involved in the Service, and our role is different for each.
We are the controller of the Personal Data we process for our own purposes: your account and contact details, your billing records, your support requests, and the data we collect from visitors to our websites. How we handle that data is described in our Privacy Policy.
We are the processor of the Personal Data you put into the Service or generate through it in the course of communicating with your own contacts. That includes the phone numbers and profile details of your contacts, the content of the calls and messages you exchange with them, recordings, voicemail, transcripts and the metadata describing those communications. For that data you are the controller and this DPA governs our processing.
If you are an end user of one of our customers and you want to exercise a data protection right in relation to your data, contact that customer. They decide what data is collected and why. We will refer such requests to them.
“Personal Data”, “controller”, “processor”, “processing”, “data subject” and “supervisory authority” have the meanings given in Regulation (EU) 2016/679 (“GDPR”).
“Customer Personal Data” means Personal Data processed by us on your behalf under this DPA.
“Data Protection Law” means the GDPR, the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other data protection or privacy law applicable to the processing.
“Subprocessor” means any processor engaged by us to process Customer Personal Data.
We will process Customer Personal Data only on your documented instructions, including with regard to transfers, unless required to do otherwise by law to which we are subject. Where we are so required, we will inform you of that legal requirement before processing, unless the law prohibits it.
Your instructions are given by your use of the Service and its configuration options, by the Terms of Service and by this DPA. Any other instruction must be agreed in writing.
We will inform you if, in our opinion, an instruction infringes Data Protection Law.
The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of data subjects are set out in Annex 1.
We will ensure that persons authorized to process Customer Personal Data are bound by an appropriate obligation of confidentiality, and that access is limited to those who need it to provide the Service.
We will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. Those measures are described in Annex 2.
You give us a general authorization within the meaning of Article 28(2) GDPR to engage Subprocessors for the purpose of providing the Service.
Our current Subprocessors are listed at https://2chat.co/legal/subprocessors. You may subscribe on that page to be notified of additions and replacements.
We will give you notice before a new Subprocessor starts processing Customer Personal Data. You may object on reasonable data protection grounds within fifteen (15) days of the notice. If you object and we cannot make the Service available to you without that Subprocessor, you may terminate the affected part of the Service.
We will impose on each Subprocessor data protection obligations no less protective than those in this DPA, and we remain fully liable to you for the performance of each Subprocessor's obligations.
Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as this is possible, in fulfilling your obligation to respond to requests to exercise data subject rights.
Where a data subject contacts us directly about Customer Personal Data, we will refer them to you and will not respond substantively unless you instruct us to.
Taking into account the nature of processing and the information available to us, we will assist you in ensuring compliance with your obligations under Articles 32 to 36 GDPR, including security of processing, personal data breach notification, data protection impact assessment, and prior consultation.
We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably available to us to enable you to meet your own notification obligations.
On termination of the Service, we will delete Customer Personal Data in accordance with the retention periods published in our Privacy Policy, unless a law to which we are subject requires us to retain it. During your subscription you may export your data through the Service and its API.
We will make available to you the information necessary to demonstrate compliance with the obligations in Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.
We may satisfy this obligation by providing our current security documentation and by answering reasonable written questions. Where that is not sufficient, an on-site audit may take place no more than once in any twelve month period, on reasonable prior written notice, during business hours, subject to confidentiality obligations, and at your cost.
The Service may be provided using equipment or facilities located in the European Union, the United Kingdom, the United States and other countries.
Where Customer Personal Data is transferred out of the European Economic Area, the United Kingdom or Switzerland to a country that has not been the subject of an adequacy decision, the transfer is made under one of the following:
the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, or the Swiss-U.S. Data Privacy Framework, where the recipient participates in the relevant framework;
the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, which are incorporated into this DPA by reference and are deemed executed between the parties, with Module Two (controller to processor) applying between you and us and Module Three (processor to processor) applying where you act as a processor for a third party;
the UK International Data Transfer Addendum to the Standard Contractual Clauses, for transfers subject to the UK GDPR; and
such additional measures as are required in the circumstances, taking account of the guidance of the European Data Protection Board.
Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.
This DPA applies automatically and does not need to be signed to take effect. If your procurement process requires a countersigned copy, email support@2chat.co and we will arrange one.
Annex 1: Details of processing
Categories of data subjects
Your personnel who use the Service, including the users you invite to your account.
The contacts you communicate with through the Service, including your customers, prospects, suppliers and any other person whose number you add to the Service or who contacts a number on your account.
Types of Personal Data
Identifiers and contact details: name, phone number, email address, profile photo, and any other field you store against a contact record.
Communications content: the text and media of SMS, MMS, WhatsApp and WhatsApp Business API messages; call audio where recording is enabled; voicemail; transcripts, summaries and other output generated from that content.
Communications metadata: calling and called numbers, direction, date, time, duration, disposition, routing and delivery status of each call and message.
Account and usage data associated with your users, including login records and activity within the Service.
Any other Personal Data you choose to submit to the Service, including through the API, imports and integrations.
Nature and purpose of processing
Provision of the Service: transmitting, receiving, storing, displaying, recording, transcribing, routing and analyzing communications on your instructions; making them available to your users; supporting your account; billing; and securing the Service against fraud and abuse.
Duration
For the duration of your subscription, plus the retention periods published in our Privacy Policy.
Annex 2: Technical and organizational measures
Encryption of data in transit over public networks using current TLS versions, and encryption of data at rest in our production databases, object storage and backups.
Access control on the principle of least privilege, with individual named accounts, multi-factor authentication for administrative access, and revocation on role change or departure.
Segregation of customer data, so that each account's data is accessible only through that account's credentials and API keys.
Network controls at our hosting providers, including private subnets for data stores and restricted administrative access.
Logging and monitoring of access to production systems, and alerting on anomalous activity.
Regular backups, with restoration tested periodically.
Vulnerability management, including dependency scanning and timely application of security updates.
Personnel measures, including confidentiality undertakings and security awareness expectations for staff with access to production systems.
Vendor management, including diligence on Subprocessors and contractual data protection terms with each of them.
An incident response process covering detection, containment, assessment, notification and remediation.