Data Processing Agreement
Last updated: 2026-09-12
When you use Wakeel, you are the controller of your customers' data and we are the processor — we work on that data on your instructions, not for our own purposes. This document sets out what we may do with it and what we owe you. It applies automatically to every merchant who accepted it at signup, and is read together with the Terms of Service and the Privacy Policy.
The parties and their roles
You (the merchant) are the controller. You decide why your customers' data is collected and how it is used. We (Wakeel) are the processor. We process it on your behalf and on your instructions.
Wakeel is a service provided by an entity registered in the United Arab Emirates.
What we process
Only what the service needs to work, and only for as long as your account is active:
- •Your customers' data: WhatsApp number or channel identifier, name if provided, the text of conversations and voice messages, orders, tickets and bookings, and a summary the agent remembers about each customer.
- •Your store's data: catalogue, policies, agent settings, and your account details.
- •The data subjects are your store's customers and the users you add to your account.
Why we process it — and what we do not do
We process it solely to run the service for you: answering your customers, recording their orders, and showing them to you in your dashboard.
⛔ We do not sell your data or your customers' data, rent it, or share it with advertisers. ⛔ We do not use it to train AI models — neither ours nor our providers'.
We do not process the data for any other purpose unless you instruct us to, or a law applicable to us requires it — and in that case we tell you first, unless the law forbids it.
Security
- •Isolation enforced in the database. Each store sees only its own rows, and the database itself enforces that — not application code.
- •Encryption: in transit (TLS) and for stored secrets (AES-256-GCM).
- •Limited access. Access to the data is restricted to those who need it to run the service.
Sub-processors
We use providers to run the service, each bound by obligations no less protective than those in this document. The full list and their hosting regions are published on the Privacy page, and we update it before adding any new provider.
If you object to a new provider on reasonable data-protection grounds, you may stop the service and take your data, with no charge for the remaining period.
Helping you with your customers' rights
If a customer asks you for a copy of their data or for it to be deleted, we help you act on it. You can delete a conversation or a customer from your dashboard yourself at any time, and where you need our help we respond within one calendar month of your request.
If a request from one of your customers reaches us directly, we do not answer it ourselves — we pass it to you, because you are the controller.
If there is a breach
If we discover a breach affecting personal data that belongs to you, we tell you without undue delay, and within 72 hours of becoming aware of it. We tell you what happened, which data was affected, what we have done — and what we suggest you do.
Deletion and return of data
When you close your account you can export your data. Thirty days after closure we delete it from our live systems, and from backups within their normal cycle. We keep only the financial records that the law requires us to keep.
A lapsed subscription is not a closed account: your data stays intact and the service continues in a reduced form until you renew.
Audit
We make available the information needed to demonstrate that we meet these obligations. For an on-site audit, we agree a reasonable time on prior notice, once a year unless there has been a breach or a regulator asks.
Cross-border transfers
Our providers sit in more than one country, and the regions are listed on the Privacy page. Where data moves to a country outside your own, we rely on the legal mechanisms available for that transfer — and we can sign standard contractual clauses if you need them.
Duration and governing law
This agreement runs for as long as we process data on your behalf, and ends when the data is deleted as set out above.
It is governed by the laws of the United Arab Emirates, whose courts have jurisdiction. This does not remove any mandatory right you have under the law of your own country.
Changes
Every version carries a number (the date above). The version you accepted stays the one that applies to you, and if we make a material change we tell you and ask you to accept the new one.
Contact
For any question about this agreement or about your data: hello@wakeelhq.com