Data Processing Agreement

• Processing of end-user phone numbers, OTPs, and verification metadata.
• Cross-border transfer mechanisms where applicable.
• Customer rights: access, rectification, deletion, portability.
• Breach notification timelines and incident-response duties.
• Audit rights and confidentiality obligations.
• Term, termination, and post-termination data-handling commitments.

We engage the following sub-processors to deliver the Service. The full sub-processor list and change-notification process is included in the DPA.

• Meta WhatsApp Cloud API — message delivery, template review.
• AWS (Mumbai) — compute, storage, networking.
• SmartPing — WhatsApp BSP, credit metering.
• Karix — SMS / WhatsApp BSP routing.
• Gupshup — SMS routing (legacy customers).

• DPDP Act 2023 (India) — primary applicable framework for QuickAuth's India-resident processing.
• GDPR — Standard Contractual Clauses (SCCs) available on request for EU customers.
• SOC 2 Type II — our annual audit; see the Security page.

Under the DPA, customers retain the right to:

• Request a copy of personal data being processed on their behalf.
• Instruct deletion or correction within reasonable timelines.
• Audit our processing activities (subject to confidentiality and operational constraints).
• Receive breach notifications within 72 hours of confirmed incident classification.
• Receive a return-or-deletion certification at contract termination.

Email contact@quickauth.in with your company name and the QuickAuth account it should be tied to. We send the signable DPA (PDF + DocuSign) within one business day.

For EU customers requiring SCCs or specific data-transfer mechanisms, please mention this in the request so we can pre-fill the relevant addenda.