Data Processing Agreement
This page is a draft template, not reviewed by a solicitor. It sets out reasonable, standard terms for how Zenith Studio processes data on your behalf, but you should have it checked before relying on it for a live dispute or a customer's own compliance audit.
01Who's who
This agreement applies between your agency and Zenith Studio for the WhatsApp AI Agent service. You decide what the agent is allowed to say and what packages, prices and policies it answers from; we process the resulting messages on your behalf, strictly to operate the service.
"You". You decide what the agent says and answers from.
"We". We process messages on your behalf to run the service.
The people who message your agency on WhatsApp.
02What we process
Inbound and outbound message content, phone numbers, and timestamps, processed to answer enquiries, capture leads, and hand off to your team.
Packages, prices, dates, policies and ATOL details you provide, used only to ground the agent's answers to your own customers.
The agent is instructed to never ask for these, and if a customer sends them anyway, the content is never stored in the searchable knowledge base or logs beyond the single raw message record. The conversation hands off to your team immediately instead.
03Sub-processors
04Retention and deletion
Customer data is kept for the period you set in your dashboard (Settings, “Delete customer data after”), then permanently deleted automatically.
Export or permanently delete any one customer's data at any time from the Inbox, to fulfil a data subject access or erasure request from your own customer.
05Security
Your WhatsApp access token is encrypted at rest.
Every query touching your agency's data is scoped to your agency alone. Other agencies on the platform cannot read your data, and we test this directly.
06Opt-in wording
Where you invite customers to message you on WhatsApp, use wording like this so their consent to an automated reply is clear upfront.
“Message us on WhatsApp and we'll reply using our virtual assistant, which answers from our own packages and policies. A member of our team can take over at any time. Your message and reply history is kept for up to your retention period to help us serve you, and you can ask us to delete it at any time.”
The agent itself never claims to be human if asked directly, and always states it is your virtual assistant. This wording just makes that clear before the first message, as PECR and UK GDPR expect for an automated channel.