Data Processing Addendum

Last updated: 13 July 2026

This Data Processing Addendum ("DPA") forms part of the agreement between the Customer ("Controller") and MindValley LLC (operating Syncy, the "Processor"), 30 N Gould St Ste R, Sheridan, WY 82801, USA. It governs how Syncy processes personal data on the Customer's behalf and applies where the EU/UK GDPR, Saudi PDPL, or similar laws apply.

1. Roles

For personal data of the Customer's own end customers processed through Syncy (contacts, message content, phone numbers), the Customer is the Controller and Syncy is the Processor. Syncy processes such data only on the Customer's documented instructions, including as configured in the platform.

2. Scope of processing

Subject matter: providing the Syncy inbox, CRM, and messaging service.
Duration: for the term of the agreement plus any legally required retention.
Data subjects: the Customer's end customers and contacts.
Data types: names, phone numbers, message content, and related conversation metadata.

3. Processor obligations

Process personal data only on the Controller's instructions;
Ensure personnel are bound by confidentiality;
Implement appropriate technical and organizational security measures (encryption in transit and at rest, access controls, tenant isolation);
Assist the Controller with data-subject requests and with security, breach-notification, and impact-assessment obligations;
Delete or return personal data at the end of the service, subject to legal retention.

4. Subprocessors

The Controller authorizes Syncy to engage subprocessors to deliver the service, including cloud hosting, the WhatsApp Business Platform (Meta), payment processors, and analytics providers. Syncy remains responsible for its subprocessors and will impose data-protection terms consistent with this DPA. We will provide notice of material changes to subprocessors and a reasonable opportunity to object.

5. International transfers

Where personal data is transferred across borders, the parties will rely on appropriate safeguards (such as Standard Contractual Clauses or equivalent) as required by applicable law.

6. Security & breach notification

Syncy maintains a security program appropriate to the risk and will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data, with the information needed to meet the Controller's obligations.

7. Audits

Syncy will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable request and subject to confidentiality, support audits relevant to the processing.

8. Controller responsibilities

The Controller warrants that it has a lawful basis and valid opt-in/consent to process and message its end customers, and that its instructions comply with applicable law and the WhatsApp/Meta policies.

9. Contact

MindValley LLC · 30 N Gould St Ste R, Sheridan, WY 82801, USA · sales@syncy.tech

This template is a starting point and not legal advice. Have it reviewed by a qualified attorney and, where required, execute a signed DPA with Enterprise customers.