GDPR Article 28 — Controller ↔ Processor

---

1. Parties

This Data Processing Agreement ("DPA") is entered into by and between:

• Customer — the entity that has agreed to the Blueticks Terms of Service and, in respect of the Personal Data processed under this DPA, acts as the data controller ("Controller"); and
• Blueticks — Serenix LTD, a company incorporated in Cyprus on 2 May 2023, registered address 68 Spyrou Kyprianou, 4042 Germasogeia, Limassol, Cyprus, company registration number HE 446587 (VAT / TIN 60003974B), which provides the Blueticks WhatsApp business-automation platform and, in respect of that Personal Data, acts as the data processor ("Processor", "Serenix", or "Blueticks").

each a "Party" and together the "Parties". This DPA forms part of, and is subject to, the agreement between the Parties for Blueticks' services (the "Principal Agreement"). Where this DPA conflicts with the Principal Agreement on the subject of data protection, this DPA prevails.

For execution, the Controller is: ____________________________, registered address ____________________________ (see the Signatures block and SCC Annex I).

2. Definitions

Terms not defined here have the meaning given in the General Data Protection Regulation (EU) 2016/679 ("GDPR"). "Personal Data", "Processing", "Data Subject", "Controller", "Processor", "Sub-processor", "Supervisory Authority", and "Personal Data Breach" bear their GDPR meanings. "Applicable Data Protection Law" means the GDPR and any national data protection laws applicable to the Processing under this DPA, and, where relevant, the UK GDPR.

3. Subject matter, duration, nature and purpose of Processing

• Subject matter & duration: Blueticks Processes Personal Data on the Controller's behalf for the duration of the Principal Agreement and until deletion or return of the Personal Data in accordance with Section 11.
• Nature and purpose: to provide the Blueticks platform — scheduling and sending of messages across the Controller's WhatsApp, Facebook, and Instagram channels (one-time, recurring, campaigns, drip sequences), gateway connectivity, audience/contact management, task/board management, analytics, AI-assisted workflow features, and customer support.
• Types of Personal Data and categories of Data Subjects: set out in Annex I.

The Parties acknowledge that Blueticks operates as a Processor with respect to Controller Personal Data. Where Blueticks Processes data as an independent Controller (e.g. its own account, billing, and service-operations records — including the account/billing data it processes through its payment providers), that Processing is governed by the Blueticks privacy policy, not this DPA (see Annex I and the Annex II payment-processor note).

4. Roles and instructions

4.1 Documented instructions. Blueticks Processes Personal Data only on the documented instructions of the Controller, including with regard to transfers to a third country or international organisation, unless required to Process by Union or Member State law to which Blueticks is subject; in such a case Blueticks informs the Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest. The Principal Agreement, this DPA, and the Controller's configured use of the platform (the messages, audiences, and settings it submits) constitute the Controller's documented instructions.

4.2 Lawfulness. The Controller is responsible for the lawfulness of the Personal Data it submits and of the instructions it gives, including having a lawful basis and any required consents for messaging its Data Subjects via WhatsApp, and for complying with WhatsApp/Meta's own terms and anti-spam policies.

4.3 Notice of unlawful instruction. Blueticks informs the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law (without obligation to give legal advice).

5. Confidentiality

Blueticks ensures that persons authorised to Process the Personal Data are bound by an appropriate obligation of confidentiality (contractual or statutory) and that access is limited to personnel who need it to provide the services.

6. Security of Processing (Art. 32)

Blueticks implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. A description of those measures is set out in Annex III. Blueticks may update its security measures over time provided the level of protection is not materially reduced.

7. Sub-processors (Art. 28.2, 28.4)

7.1 General authorisation. The Controller grants Blueticks general authorisation to engage Sub-processors to Process Personal Data, subject to this Section. The current Sub-processors are listed in Annex II.

7.2 Flow-down. Blueticks imposes on each Sub-processor, by written contract, data-protection obligations no less protective than those in this DPA (in particular the Article 32 security obligations), and remains fully liable to the Controller for the performance of each Sub-processor's obligations. Where a Sub-processor is located outside the EEA, Blueticks additionally maintains an appropriate Chapter V transfer safeguard with that Sub-processor as described in Section 13.

7.3 Change notification & objection. Blueticks gives the Controller prior notice of the addition or replacement of a Sub-processor at least 30 days in advance, by email to the account owner and/or via a published sub-processor page, giving the Controller the opportunity to object on reasonable data-protection grounds. If the Parties cannot resolve a reasonable objection, the Controller may terminate the affected service.

8. Assistance with Data-Subject Rights (Art. 28.3(e))

Taking into account the nature of the Processing, Blueticks assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests to exercise Data-Subject rights under Chapter III of the GDPR (access, rectification, erasure, restriction, portability, objection). Where a Data Subject contacts Blueticks directly, Blueticks refers them to the Controller and does not respond substantively except on the Controller's instruction.

9. Assistance with Controller obligations (Art. 32–36)

Blueticks assists the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (security, breach notification, data-protection impact assessments, and prior consultation), taking into account the nature of Processing and the information available to Blueticks.

10. Personal Data Breach notification (Art. 33)

Blueticks notifies the Controller without undue delay, and in any event within 72 hours of becoming aware of a Personal Data Breach affecting the Controller's Personal Data. The notification will, to the extent known, describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Blueticks provides reasonable cooperation and information to enable the Controller to meet its own notification obligations to Supervisory Authorities and Data Subjects.

11. Deletion or return (Art. 28.3(g))

At the choice of the Controller — exercised via the Service or by emailing the choice to privacy@blueticks.co — Blueticks deletes or returns all Personal Data to the Controller after the end of the provision of services relating to Processing, and deletes existing copies, unless Union or Member State law requires storage. Return is provided as a structured export via the Service; residual copies in backups are deleted within 90 days on their normal rotation.

12. Audit and information (Art. 28.3(h))

Blueticks makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28.3 of the GDPR, and allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. Such audits take place at reasonable notice, no more than once per 12 months (absent a breach or regulator requirement), during business hours, under confidentiality, and at the requesting Party's cost; Blueticks may provide third-party certifications/reports in lieu of on-site inspection where these reasonably address the request.

13. International transfers

13.1 Instrument and layer. Blueticks (Serenix) does not transfer Controller Personal Data to a country outside the EEA except under a transfer mechanism valid under Chapter V of the GDPR. The Parties acknowledge that (i) Serenix is established in the EEA (Cyprus), so no restricted transfer arises on the Controller-to-Serenix leg (that leg is intra-EEA where the Controller is in the EEA, or an inbound-to-EEA flow where the Controller is in a third country — neither is a Chapter V restricted transfer, and the Article 28 clauses of this DPA govern that leg in full); and (ii) the relevant third-country transfers occur where Serenix, as data exporter, onward-transfers Controller Personal Data to Sub-processors located outside the EEA (listed in Annex II). For each such onward transfer to a Sub-processor not covered by an adequacy decision, Serenix has entered into, or will enter into before any such transfer, the Standard Contractual Clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (OJ L 199, 7.6.2021, p. 31), Module Three (processor-to-processor), with Serenix as data exporter and the Sub-processor as data importer, together with a transfer impact assessment and any supplementary measures required. The Standard Contractual Clauses are incorporated by reference to the authoritative text published in the Official Journal of the European Union at http://data.europa.eu/eli/dec_impl/2021/914/oj (CELEX 32021D0914); that official published text governs and is neither reproduced nor amended in this DPA. The Module, operative option selections and completed Annexes for those transfers are as stated in Annex IV. Where a Sub-processor is certified under the EU–US Data Privacy Framework, Serenix may additionally rely on that certification for transfers to it; the SCC basis stands independently of any such certification.

13.2 No SCCs between the Parties. Because there is no restricted transfer on the Controller-to-Serenix leg, no Standard Contractual Clauses are executed between the Controller and Serenix. The Controller is not a party to the onward Module 3 SCCs; Serenix's obligation under this DPA is to warrant that it maintains those Module 3 SCCs (or an equivalent Chapter V safeguard) with each non-EEA Sub-processor, and to make evidence of that available on request under Section 12.

13.3 UK-GDPR conditional trigger (onward layer). Where and to the extent the Controller's Processing of Personal Data under this DPA is subject to the UK GDPR (because the Controller is established in the United Kingdom, or offers goods or services to, or monitors the behaviour of, data subjects in the United Kingdom within the meaning of Article 3 UK GDPR), Serenix warrants that, for the onward transfer of such Personal Data to a Sub-processor in a country outside the UK that does not benefit from UK adequacy, it maintains a UK-valid transfer safeguard — the UK International Data Transfer Addendum to the EU SCCs (ICO Addendum, template version B1.0, in force 21 March 2022) layered onto the Module 3 SCCs referenced in Section 13.1, an International Data Transfer Agreement (IDTA), or, where the Sub-processor is certified under the UK Extension to the EU–US Data Privacy Framework, that certification. Consistent with Section 13.2, this UK safeguard sits at the Serenix→Sub-processor onward layer and is warranted, not signed as an annex to this DPA between the Controller and Serenix. (The Controller→Serenix leg, being a UK→EEA transfer where UK GDPR applies, relies on the UK's adequacy decision for the EEA and needs no additional safeguard.)

14. Liability, term, and governing law

14.1 Term. This DPA takes effect on signature and continues for the duration of the Principal Agreement and any subsequent Processing until deletion/return under Section 11.

14.2 Liability. Each Party's liability under this DPA is subject to the limitations and exclusions of liability in the Principal Agreement, to the extent permitted by Applicable Data Protection Law.

14.3 Governing law and forum. This DPA is governed by the laws of the Republic of Cyprus, consistent with the governing-law clause of the Principal Agreement, without prejudice to the Data Subjects' rights and any mandatory provisions of Applicable Data Protection Law. Disputes arising out of or in connection with this DPA are subject to the dispute-resolution provisions of the Principal Agreement. For the avoidance of doubt, this DPA does not assert exclusive jurisdiction of the Cyprus courts over the DPA generally; the courts of Cyprus are reserved only as the chosen forum for SCC Clause 18 purposes in the onward Module 3 Standard Contractual Clauses (a selection in the Serenix ↔ Sub-processor SCC set to which the Controller is not a party — see Annex IV), and that reservation is without prejudice to a Data Subject's right under SCC Clause 18 to bring proceedings in their own Member State.

---

Signatures

---

Annex I — Details of Processing

• Categories of Data Subjects: the Controller's own contacts and message recipients (WhatsApp, Facebook, and Instagram users); the Controller's personnel/agents who use the platform; leads/customers imported into audiences and boards.
• Categories of Personal Data:
  • Contact identifiers — WhatsApp/phone numbers, names, and any custom contact fields the Controller imports.
  • Message content — the body of scheduled/sent messages, campaign templates, poll questions, and media the Controller submits, plus delivery/ack metadata.
  • Audience/board/task data configured by the Controller.
  • Support-conversation content where the Controller contacts support.
• Special-category data (Art. 9): special-category data may be present in the free-text message content, campaign templates, poll questions, and imported fields that the Controller submits. The Controller is responsible for establishing a lawful basis for any such data (including any Article 9 condition) and for not instructing Blueticks to Process special-category data other than as an incidental part of the content it chooses to submit; Blueticks does not intentionally solicit or Process special-category data.
• Frequency & duration: continuous, for the term of the Principal Agreement.
• Purpose: as set out in Section 3.

Account and billing data processed through Blueticks' payment providers is processed by Blueticks as its own controller data (subscription billing / payment processing for the Blueticks service) and is governed by the Blueticks privacy policy, not this DPA (see the Annex II payment-processor note); it is therefore not listed as an in-scope category of Controller Personal Data above.

Annex II — Sub-processors

AI features are served by Google (Gemini, through Vertex AI) for the Blueticks chatbot and knowledge-base search, and by Anthropic (Claude) for Blueticks AI Agents, served through Google Cloud Vertex AI or, for some features, called directly by Blueticks. Redis (cache/locks) and EMQX/MQTT (engine transport) are self-hosted inside the GKE cluster (not third-party sub-processors) and are folded into the Google Cloud Platform entry.

The SCC module is fixed by the relationship — Serenix is a Processor, so every vendor that Processes the Controller's data on Serenix's behalf is a Sub-processor under Module 3 (processor-to-processor), Serenix as exporter. Region determines whether an SCC is needed at all: an EEA region is not a restricted transfer and requires no SCC. Per-vendor mapping is tabulated in Annex IV.

Payment processors — out of DPA scope (Blueticks' own controller data). Chargebee (Chargebee Inc.), Stripe, PayPal, and BlueSnap process account & billing data as Blueticks' own controller data (subscription billing / payment processing for the Blueticks service), governed by the Blueticks privacy policy, not this DPA. They are therefore not listed as Module 3 sub-processors of the Controller's personal data. Their hosting regions are provided on request; all four sit outside this DPA's scope.

Other own-controller services — out of DPA scope. Netlify, Inc. (hosting and delivery of the Blueticks website and web app), Google Analytics / Google Tag Manager and Meta Pixel (website and web-app analytics and advertising measurement), FirstPromoter (affiliate referral attribution and commission administration), and Zeabur (hosting of our Listmonk product and marketing e-mail list) process Blueticks' own website, marketing and affiliate data, governed by the Blueticks privacy policy, not this DPA. They are not listed as sub-processors of the Controller's personal data.

Meta Platforms (WhatsApp / Facebook / Instagram) — independent controller, not a sub-processor. Meta Platforms is the messaging platform the Controller chooses to operate across its WhatsApp, Facebook, and Instagram channels — the destinations to which the Controller directs its messages. Meta's processing of those messages is governed by Meta's own terms and privacy policy, Meta acting as an independent controller of the delivery channels, not a Blueticks sub-processor. No SCC under this DPA covers the Controller↔Meta relationship (it is the Controller's own relationship with Meta).

Annex III — Technical and Organisational Security Measures (Art. 32)

• Encryption in transit — TLS/HTTPS for connections between clients, backend, engines, and sub-processors.
• Encryption at rest — database and object-storage encryption at rest (MongoDB Atlas and Google Cloud provider-managed encryption).
• Access control — role-based access to production systems; least-privilege; authenticated admin access; per-account data isolation (owner-scoped queries throughout the application).
• Network & infrastructure — Kubernetes (GKE, us-central1) with namespace isolation and ingress controls. Secrets management: access-controlled Kubernetes Secrets with least-privilege access.
• Resilience & availability — managed MongoDB Atlas backups (Gateway session backups are stored in Microsoft Azure Blob Storage — see Annex II); gateway lifecycle hardening (graceful shutdown / WhatsApp flush on node reclaim); monitoring and logging.
• Session data handling — per-session isolated storage (one ReadWriteOnce volume per session); crash-dump storage restricted to operational storage buckets.
• Confidentiality — personnel bound by confidentiality obligations.
• Incident response — breach detection, escalation, and notification process per Section 10.

Annex IV — International Transfer Mechanism

The Parties incorporate the EU Standard Contractual Clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (OJ L 199, 7.6.2021, p. 31; CELEX 32021D0914; ELI http://data.europa.eu/eli/dec_impl/2021/914/oj), Module Three (processor-to-processor), with Serenix as data exporter and each non-EEA Sub-processor as data importer, at the Serenix→Sub-processor onward-transfer layer. There are no SCCs on the Controller↔Serenix leg (Serenix is EEA-established, so that leg is not a Chapter V restricted transfer — see §13.1–13.2). The clause body is incorporated by reference and is not reproduced or paraphrased here — the official published text governs. The completed SCC Annexes (Annex I — parties, description of transfer + competent supervisory authority; Annex II — technical & organisational measures; Annex III — list of sub-processors) are set out in the Standard Contractual Clauses — Completed Annexes section below, drawn from Sections 1–3 and Annexes I–III of this DPA and held per Sub-processor.

Per-sub-processor module map (onward layer). The module is fixed by the relationship (all Module 3); region determines whether an SCC is required at all (an EEA region is not a restricted transfer and requires no SCC):

Operative option selections for the onward Module 3 SCCs (mirrored, where relevant, by the Art 28 clauses of this DPA body):

• Clause 7 (docking clause) — included.
• Clause 9 (sub-processors) — Option 2 (general authorisation), with at-least-30-day notice per §7.3 (in a Module 3 SCC this governs the Sub-processor's own onward sub-processors).
• Clause 11 (independent dispute resolution) — the optional independent-dispute-resolution-body language is omitted (the mandatory redress limb — data-subject complaint to a supervisory authority and judicial remedy — still applies).
• Clause 17 (governing law) — Option 1 = law of the Republic of Cyprus (an EU Member State whose law permits third-party-beneficiary rights).
• Clause 18(b) (forum) — courts of Cyprus (in the Serenix↔Sub-processor SCC set only; the Controller is not a party — see §14.3), without prejudice to a Data Subject's Clause 18 right to sue in their own Member State.

UK transfers (conditional — see §13.3). Where the Controller's Processing is subject to UK GDPR (Art. 3), Serenix maintains, at the onward layer, a UK-valid safeguard — the UK International Data Transfer Addendum to the EU SCCs (ICO Addendum, template version B1.0, in force 21 March 2022) layered onto the Module 3 SCCs above, an IDTA, or the DPF UK Extension where the Sub-processor is certified. This UK safeguard is warranted by Serenix at the Serenix→Sub-processor layer and is not signed as an annex between the Controller and Serenix.

---

Standard Contractual Clauses — Completed Annexes (onward Module 3 layer)

The Parties adopt the EU Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (OJ L 199, 7.6.2021, p. 31; CELEX 32021D0914; ELI http://data.europa.eu/eli/dec_impl/2021/914/oj), Module Three (processor-to-processor), with Serenix as data exporter and each non-EEA Sub-processor as data importer. The clause body is the official published EU text, incorporated by reference and not retyped or paraphrased here — the official instrument governs and is attached at execution. Each such Module 3 SCC set is executed between Serenix and the individual Sub-processor (typically via that vendor's own 2021/914-based DPA); this section completes only the Annexes the Clauses require the parties to fill, together with the option selections stated in Annex IV.

SCC Annex I

A. List of Parties

Data exporter (all onward Module 3 transfers): Serenix LTD — 68 Spyrou Kyprianou, 4042 Germasogeia, Limassol, Cyprus; company no. HE 446587; VAT/TIN 60003974B; incorporated 2 May 2023. Contact: privacy@blueticks.co. Role in the Module 3 transfer: processor acting as data exporter (Serenix processes the Controller's Personal Data as a processor and onward-transfers it to its Sub-processors). Activities relevant to the data transferred: provision of the Blueticks WhatsApp business-automation platform (§3).

Data importer(s) (per onward Module 3 transfer): each non-EEA Sub-processor listed in SCC Annex III below, acting as processor (sub-processor) / data importer for the purpose stated against it. The completed Module 3 Annex I.A party block for each importer is the one in that Sub-processor's own executed 2021/914 DPA held by Serenix.

Controller (originating controller — party details). The Controller is the originating controller of the Personal Data. The Controller↔Serenix relationship is governed by the Article 28 DPA above (no SCCs — Serenix is EEA-established); the Controller is not a party to the onward Module 3 SCCs. The Controller's party details are:

B. Description of Transfer

• Categories of data subjects: the Controller's contacts and message recipients (WhatsApp, Facebook, and Instagram users); the Controller's personnel/agents who use the platform; leads/customers imported into audiences and boards. (See Annex I.)
• Categories of personal data: contact identifiers (WhatsApp/phone numbers, names, custom contact fields); message content (bodies, templates, poll questions, media) plus delivery/ack metadata; audience/board/task data; support-conversation content. (See Annex I.)
• Sensitive data: special-category data may be present in the free-text message content the Controller submits; the Controller is responsible for a lawful basis (including any Article 9 condition) and for not instructing special-category Processing; Serenix does not intentionally solicit or Process it. (See Annex I.)
• Frequency of transfer: continuous, for the term of the Principal Agreement.
• Nature & purpose of processing: as §3 (scheduling/sending messages, gateway connectivity, audience/contact management, boards/tasks, analytics, AI-assisted features, support), to the extent the specific Sub-processor performs it.
• Retention: for the term, then deletion/return per §11 (structured export; backup residuals deleted within 90 days).
• Transfers to (onward) sub-processors: subject-matter, nature and duration as set out in SCC Annex III below (Clause 9 Option 2, general authorisation, at-least-30-day notice).

C. Competent Supervisory Authority

For each onward Module 3 transfer, the competent supervisory authority is determined per SCC Clause 13 and Annex I.C and tracks the Controller's establishment (the Controller, not Serenix, being the originating controller):

Competent supervisory authority: ____________________________

SCC Annex II — Technical and Organisational Measures

As set out in Annex III above (encryption in transit and at rest; role-based access control with least-privilege and per-account owner-scoped isolation; GKE us-central1 namespace isolation; access-controlled Kubernetes Secrets; managed MongoDB Atlas backups (Gateway session backups in Microsoft Azure Blob Storage); gateway graceful-shutdown/flush; per-session ReadWriteOnce volumes; monitoring and logging; incident response per §10). For each onward Module 3 transfer, the importer's own technical and organisational measures are those in its executed 2021/914 Annex II.

SCC Annex III — List of Sub-processors (onward importers)

Per Annex II above (general authorisation, Clause 9 Option 2). Each entry below is an onward Module 3 importer where its region is non-EEA; an EEA region is not a restricted transfer and requires no SCC:

• Google Cloud Platform / GKE (Google LLC) — us-central1 (incl. self-hosted Redis + EMQX): Module 3 (US).
• Google Cloud Storage (Google LLC) — location provided on request; uploaded message media and attachments, gateway session data, gateway crash dumps: Module 3 (US).
• Google Vertex AI (Google LLC) — us-east5 / us-central1 / global; AI serving (Gemini for the chatbot and knowledge-base search; Anthropic Claude models served through Vertex AI; data recipient is Google): Module 3 (US).
• Anthropic (Anthropic, PBC) — United States; AI agent model calls made directly (for some features) and AI tools used by Blueticks staff for support and diagnosis: Module 3 (US).
• Google Firebase Cloud Messaging (Google LLC) — location provided on request; push messaging that transmits device push tokens and message content for wake/delivery (payload minimization in progress): Module 3 (US).
• MongoDB Atlas (MongoDB, Inc.) — location provided on request: Module 3 (US).
• AWS SES (Amazon Web Services, Inc.) — us-east-1 (US): Module 3 (US).
• Microsoft Azure — Blob Storage (Microsoft Corporation) — United States; Gateway session backups: Module 3 (US).
• TypeSafe (Jev) — location and transfer instrument provided on request; lead scoring, engaged only when AI Agent lead tracking is enabled.
• Crisp (Crisp IM SAS) — location and transfer instrument provided on request.

Out of scope (not onward importers of Controller data):

• Chargebee / Stripe / PayPal / BlueSnap — process Blueticks' own controller (billing) data, governed by the Blueticks privacy policy, not this DPA; not listed as Module 3 sub-processors of Controller personal data. Hosting regions provided on request.
• Netlify, Google Analytics / Google Tag Manager, Meta Pixel, FirstPromoter, Zeabur — Blueticks' own website, marketing and affiliate data; not sub-processors of Controller personal data.
• Meta Platforms (WhatsApp / Facebook / Instagram) — independent controller of the delivery channel the Controller operates; not a Blueticks sub-processor; no SCC under this DPA.

UK Addendum (conditional — onward layer only)

Where the Controller's Processing is subject to UK GDPR (Art. 3 — see §13.3), Serenix maintains at the onward layer the UK International Data Transfer Addendum to the EU SCCs (ICO Addendum, template version B1.0, in force 21 March 2022) layered onto the Module 3 SCCs above, an IDTA, or the DPF UK Extension where the Sub-processor is certified. Consistent with this DPA, this is warranted by Serenix at the Serenix→Sub-processor layer and is not executed as an annex between the Controller and Serenix.