Last Updated: January 30, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Instant Reply ("Processor" or "we") and you ("Controller" or "you") and governs the processing of Personal Data in connection with your use of our Services. This DPA complies with the EU General Data Protection Regulation (GDPR), UK GDPR, UAE Data Protection Law, and other applicable data protection laws.
In this DPA, the following terms have the meanings set out below:
This DPA applies to all Personal Data that the Processor processes on behalf of the Controller through the Services, including End User data (messages, contact information, conversation metadata) collected through our omnichannel inbox platform.
The Controller is responsible for:
The Processor is responsible for:
The Processor shall process Personal Data only on documented instructions from the Controller, unless required to process by applicable law (in which case, the Processor shall inform the Controller of that legal requirement before processing, unless prohibited by law).
The Processor will process Personal Data to:
Processing will occur for the duration of the Services agreement. Upon termination, the Processor will delete or return Personal Data as specified in Section 12.
The Processor may process the following categories of Personal Data:
Data Subjects include End Users (customers, prospects, or other individuals) who interact with the Controller through the platform's messaging channels.
The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
Upon request, the Processor will provide the Controller with reasonable information regarding its security measures, subject to confidentiality obligations.
The Controller authorizes the Processor to engage Sub-processors to process Personal Data. The Processor shall enter into written agreements with Sub-processors imposing data protection obligations substantially similar to those in this DPA.
The Processor currently uses the following Sub-processors:
The Processor will provide the Controller with at least 30 days' prior notice of any new Sub-processor. If the Controller objects to a new Sub-processor on reasonable data protection grounds, the parties will work together in good faith to find a resolution. If no resolution is found, the Controller may terminate the agreement without penalty.
The Processor remains fully liable to the Controller for the performance of Sub-processors' obligations under this DPA.
The Processor shall, to the extent legally permitted, promptly notify the Controller if it receives a request from a Data Subject to exercise their rights under Data Protection Laws (access, rectification, erasure, restriction, portability, objection). The Processor shall not respond to such requests except on the Controller's documented instructions or as required by law.
The Processor shall provide reasonable technical assistance to enable the Controller to respond to Data Subject requests, including by providing tools within the platform for data export, rectification, and deletion. The Processor may charge reasonable fees for assistance beyond what is provided through the standard platform features.
The Processor shall notify the Controller without undue delay after becoming aware of a Security Incident, and in any event within 72 hours of discovery. The notification shall include:
The Processor shall cooperate with the Controller and provide reasonable assistance in investigating and responding to the Security Incident, and shall take reasonable steps to remediate the cause of the Security Incident.
Notification of a Security Incident under this section shall not be construed as an admission of fault or liability by the Processor.
The Processor shall provide reasonable assistance to the Controller with any data protection impact assessments and prior consultations with supervisory authorities that the Controller is required to conduct under Data Protection Laws, to the extent such assistance relates to the processing of Personal Data by the Processor.
The Processor may charge reasonable fees for assistance that requires significant time or resources beyond standard platform operations.
Upon termination of the Services agreement, the Processor shall, at the Controller's choice and within 30 days of termination:
The Processor may retain Personal Data to the extent required by applicable law, provided that the Processor ensures the confidentiality of such Personal Data and only processes it as necessary to comply with legal obligations.
Personal Data may persist in backup systems for up to 90 days after deletion. Backup data is encrypted and accessible only for disaster recovery purposes.
Upon reasonable advance notice (at least 30 days), the Controller may audit the Processor's compliance with this DPA, no more than once per year, unless required by supervisory authority or following a Security Incident. Audits shall be conducted during business hours and shall not unreasonably interfere with the Processor's operations.
The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA, including:
The Controller shall bear all costs associated with audits, including reasonable fees for the Processor's time and resources, except in cases where the audit reveals material non-compliance by the Processor.
Where the Processor transfers Personal Data to countries outside the European Economic Area (EEA), United Kingdom, or other regions with data protection laws, it shall ensure appropriate safeguards are in place, including:
To the extent required by Data Protection Laws, the parties agree to be bound by the European Commission's Standard Contractual Clauses for the transfer of Personal Data to processors established in third countries (Module Two: Controller to Processor), as updated from time to time.
The Processor shall ensure that all personnel authorized to process Personal Data are subject to confidentiality obligations (whether contractual or statutory) and receive appropriate training on data protection.
The Processor shall ensure that access to Personal Data is limited to personnel who require access to perform their duties under the Services agreement.
This DPA shall remain in effect for as long as the Processor processes Personal Data on behalf of the Controller.
Sections relating to deletion of Personal Data, confidentiality, audits, and limitation of liability shall survive termination of this DPA.
Each party's liability arising out of or related to this DPA shall be subject to the limitation of liability provisions in the Terms of Service. Nothing in this DPA shall limit either party's liability for:
This DPA shall be governed by the same governing law provisions as the Terms of Service.
The Processor may amend this DPA to reflect changes in Data Protection Laws or the Processor's data processing practices. Material changes will be communicated to the Controller with at least 30 days' advance notice. Continued use of the Services after such changes constitutes acceptance.
For questions regarding this DPA or data protection matters:
Email: dpo@instantreply.co
Data Protection Officer:
Instant Reply
Attn: Data Protection Officer
Abu Dhabi, United Arab Emirates