Data Processing Agreement

1. Definitions

In this DPA: "Controller" means you, the Homing customer who determines the purposes and means of processing your end-customers' personal data. "Processor" means Bouwens Marketing Services, which processes personal data on the Controller's behalf. "Data Subjects" means the end-customers who message the Controller via WhatsApp. "Personal Data" has the meaning given in Article 4(1) GDPR. All other capitalised terms have the meanings given in the Terms of Service.

2. Subject matter and duration

Bouwens Marketing Services processes personal data on behalf of the Controller for the purpose of operating the WhatsApp AI assistant service described in the Terms of Service. Processing begins when you activate the service and ends when your account is closed or this DPA is otherwise terminated.

3. Nature and purpose of processing

The processing consists of receiving inbound WhatsApp messages from Data Subjects, storing message content and contact identifiers in a database, passing message content to an AI model to generate replies, sending outbound replies on the Controller's behalf, and extracting lead data (name, phone number, intent) where the AI identifies a qualified lead. The sole purpose is to provide the service contracted by the Controller.

4. Categories of personal data and data subjects

The personal data processed under this DPA includes:

• WhatsApp contact identifier (JID / phone number) of each Data Subject.
• Inbound and outbound message text exchanged with each Data Subject.
• Name and phone number where voluntarily provided by the Data Subject during conversation.
• Conversation timestamps and status.

Data Subjects are the end-customers and contacts of the Controller who initiate or receive WhatsApp messages through the Homing assistant.

5. Obligations of the Processor (Bouwens Marketing Services)

Bouwens Marketing Services shall:

• Process personal data only on documented instructions from the Controller (being the Terms of Service and this DPA), unless required to do so by EU or Member State law.
• Ensure that persons authorised to process the personal data are bound by confidentiality obligations.
• Implement appropriate technical and organisational security measures in accordance with Article 32 GDPR (see section 7 below).
• Not engage sub-processors without prior general authorisation from the Controller (see section 6). The Controller's acceptance of this DPA constitutes such general authorisation for the sub-processors listed in section 6.
• Assist the Controller in fulfilling its obligations to respond to Data Subject requests (access, erasure, rectification, portability, objection) within the timescales required by the GDPR.
• Notify the Controller without undue delay — and in any case within 72 hours of becoming aware — of any personal data breach affecting Data Subjects' data.
• Delete all personal data within 30 days of account closure, or return it in machine-readable format if requested before closure.
• Make available all information necessary to demonstrate compliance with this DPA and allow for audits, subject to reasonable advance notice and confidentiality obligations.

6. Sub-processors

The Controller grants general authorisation for Bouwens Marketing Services to engage the following sub-processors. Bouwens Marketing Services will impose data protection obligations on each sub-processor equivalent to those in this DPA and remains liable for their compliance.

We will notify you of any intended addition or replacement of sub-processors with at least 14 days' advance notice, giving you the opportunity to object before the change takes effect.

7. Security measures

Bouwens Marketing Services implements the following technical and organisational measures to protect personal data:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of data at rest on the database server.
• Password hashing using a modern adaptive algorithm (bcrypt).
• Access controls limiting database access to authorised personnel only.
• WhatsApp session credentials stored encrypted and scoped per tenant.
• Automatic deletion of message data after 12 months.

8. International transfers

Bouwens Marketing Services's application hosting (Railway), database (Supabase), and frontend hosting (Vercel) are all located within the EEA. Personal data is transferred outside the EEA only to Anthropic, PBC in the United States, for the purpose of AI model inference. This transfer is made on the basis of Standard Contractual Clauses (SCCs) adopted by the European Commission, or the EU-US Data Privacy Framework where applicable. By accepting this DPA you authorise this transfer subject to the safeguards described.

9. Controller obligations

The Controller represents and warrants that:

• It has a valid lawful basis under Article 6 GDPR for processing Data Subjects' personal data through the Homing service.
• It has provided, or will provide, appropriate transparency to Data Subjects — for example via a privacy notice, auto-reply, or WhatsApp status message — informing them that an AI assistant may respond to their messages and that conversations are stored.
• It will handle Data Subject rights requests (access, erasure, etc.) directed to it by its own customers and will forward to Bouwens Marketing Services any requests that require our action.
• It will not instruct Bouwens Marketing Services to process personal data in a way that violates the GDPR or any other applicable law.

10. Liability

Each party shall be liable for damage caused by processing that infringes the GDPR to the extent it is responsible for that infringement. Bouwens Marketing Services's total liability under this DPA is subject to the limitations set out in the Terms of Service.

11. Governing law

This DPA is governed by the laws of the Netherlands and subject to the exclusive jurisdiction of the courts of Amsterdam.

12. Contact

For questions about this DPA or to make a data subject request, contact us at hello@homing.pro.