Data Processing Agreement
Last updated: 27 October 2026
This agreement is part of the Terms of Service between you (the "Customer") and Sabyasachi Panigrahi trading as RAPITALK ("RapiTalk"). It applies when RapiTalk processes personal data of the people the Customer talks to through RapiTalk ("Contact Data"). It needs no separate signature. Enterprise customers may ask for a countersigned copy.
1. Roles
For Contact Data the Customer is the Data Fiduciary (controller) and RapiTalk is the Data Processor (processor) under the Digital Personal Data Protection Act 2023 and, where it applies, the EU/UK GDPR. The Customer is responsible for having a lawful basis or consent, giving the notices the law requires, and answering its contacts' requests.
2. What RapiTalk processes
| Subject matter and purpose | Providing RapiTalk: receiving and sending messages, running the Customer's automations, campaigns and AI steps, storing conversations and contact profiles, analytics, support and security |
|---|---|
| People concerned | The Customer's customers, prospects, followers and other people who message the Customer's connected accounts or are imported by the Customer |
| Types of data | Names, usernames, profile pictures, phone numbers, email addresses, messages, comments, files, tags, custom fields, consent status, conversation history and anything else the Customer chooses to store |
| Duration | While the Customer uses RapiTalk, then until erasure as section 8 describes |
The Customer must not upload special categories of data or children's data without a lawful basis and any parental consent the law requires.
3. RapiTalk's commitments
- Process Contact Data only on the Customer's documented instructions: these terms, the Customer's settings and automations, and the Customer's written requests. RapiTalk tells the Customer if an instruction seems to break the law.
- Never sell Contact Data or use it for its own purposes (such as advertising or profiling), except anonymous aggregated statistics that identify no one.
- Make sure everyone with access is bound by confidentiality.
- Keep the security measures in section 5.
- Use sub-processors only as section 6 describes.
- Help the Customer answer its contacts' requests, mostly through the app's own tools (export, correction, deletion, consent status), and pass on requests RapiTalk receives directly.
- Help the Customer with breach notifications, impact assessments and authority inquiries about RapiTalk's processing, as reasonably needed.
- Make available the information needed to show compliance with this agreement, and allow reasonable audits (by questionnaire first; an on-site audit for Enterprise customers by agreement, at the Customer's cost, with 30 days' notice and confidentiality).
4. Personal data breaches
RapiTalk informs the Customer without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting the Customer's Contact Data, with what is known: what happened, the data and people likely affected, likely consequences, and the measures taken. This lets the Customer meet its own duties (DPDP Rules r.7: the Data Protection Board and the affected people; GDPR art. 33/34). RapiTalk keeps a record of every breach.
5. Security measures
- Encryption in transit (TLS) and of secrets at rest (AES-256-GCM); passwords hashed.
- Strict tenant separation: every request is checked against the workspace the user belongs to.
- Role-based access; optional two-step sign-in, single sign-on, IP allow-lists and session limits for customers; multi-factor authentication and logging for RapiTalk staff.
- Access, security and audit logs kept for at least one year; monitoring of errors and abuse.
- Nightly encrypted backups, tested restores, a written incident response plan.
- Protection against server-side request forgery, injection and abuse; automatic pausing of risky campaigns.
6. Sub-processors
The Customer authorises the sub-processors listed on the Sub-processors page. RapiTalk imposes data protection obligations on each one that are no less protective than this agreement and remains responsible for them. RapiTalk gives at least 15 days' notice of a new sub-processor on that page and by email to organization owners who ask for it; the Customer may object on reasonable data protection grounds, and if no solution is found may cancel the affected service with a pro-rata refund. Messaging platforms the Customer connects (Meta, Telegram, email and SMS providers) process data under their own terms as the Customer's choice, not as RapiTalk's sub-processors.
7. Transfers outside India and the EU/UK
RapiTalk and its sub-processors may process Contact Data outside India, never in a country the Government of India restricts under DPDP Act s.16. For Contact Data subject to the EU or UK GDPR, the parties agree to the European Commission's Standard Contractual Clauses (Decision 2021/914: Module 2 where the Customer is a controller, Module 3 where it is a processor), with the UK International Data Transfer Addendum where UK data is concerned. Annex details are those in section 2 and section 5; the supervisory authority is that of the Customer's establishment or representative; the clauses are governed by Irish law (EU) or English law (UK) only for those transfers.
8. Deletion and return
The Customer can export and delete Contact Data at any time in the app. When a workspace, organization or account is deleted, its Contact Data is erased 30 days later (immediately for contacts erased by the Customer), except copies in backups, which expire within 14 days, and data the law requires RapiTalk to keep.
9. Liability and order of precedence
Each side's liability under this agreement is subject to the limits in the Terms of Service, unless the law does not allow it. If this agreement conflicts with the Terms about personal data, this agreement prevails; the Standard Contractual Clauses prevail over both for the transfers they cover.
10. Contact
Data protection contact: Sabyasachi Panigrahi, support@rapitalk.com, 132, Jagat Vihar Colony, Ward No. 27, Mahasamund, Chhattisgarh 493445, India.