Skip to content
UNFYCHAT

Data Processing Agreement

Version date: 31 October 2026

This Data Processing Agreement ("DPA") forms part of the agreement between VARK TECHNOLOGIES MMC (VÖEN 1310018631, office: Bakı, Ağ Şəhər, Mərkəzi Bulvar 8, the "Processor") and the business customer that uses UNFYCHAT (the "Customer", acting as controller) — the Terms of Service or the B2B SaaS Service Agreement, whichever applies (the "Agreement").

1. Subject and duration

1.1. The Processor processes personal data on behalf of the Customer only to provide UNFYCHAT under the Agreement.

1.2. This DPA applies for as long as the Processor processes personal data on behalf of the Customer.

2. Nature and purpose of processing

Receiving, storing, displaying and sending messages between the Customer and its end customers through connected messaging channels; organising conversations (assignment, notes, tags, statuses); producing analytics on response times and workload; and, if the Customer enables them, AI-assisted drafts, translations and summaries.

3. Categories of data subjects and data

  • Data subjects: the Customer's end customers who write to it through connected channels; the Customer's staff who use the Service.
  • Personal data: names, usernames, platform identifiers, phone numbers (WhatsApp), message contents and attachments, notes and tags, staff names and e-mail addresses, activity and audit records.
  • Special categories: the Service is not designed for special categories of data (such as health data). The Customer decides what its end customers send and remains responsible for it.

4. Processor's obligations

The Processor will:

  1. process personal data only on the Customer's documented instructions, which are given by the Agreement and by the Customer's configuration of the Service, unless the law requires otherwise (in which case it will inform the Customer unless the law prohibits it);
  2. ensure that its personnel with access are bound by confidentiality;
  3. implement the technical and organisational measures described in the Security & Data Protection Policy;
  4. help the Customer, as far as reasonably possible, to answer requests from data subjects and to meet its obligations on security, breach notification and impact assessments;
  5. notify the Customer without undue delay, and in any case within the time limits set by applicable law after becoming aware of a personal data breach affecting the Customer's data;
  6. at the end of the Agreement, delete the Customer's personal data as described in section 7;
  7. make available the information reasonably necessary to demonstrate compliance with this DPA.

5. Sub-processors

5.1. The Customer authorises the Processor to use the following sub-processors:

  • Vercel Inc.: application hosting (Frankfurt, Germany; global CDN for static files).
  • Supabase Inc.: database and real-time messaging (Frankfurt, Germany).
  • Meta Platforms: delivery of messages through the channels the Customer connects.
  • Resend, Inc. (United States): transactional e-mails to staff.
  • AI model provider: none at present, because AI features are not active. Before AI features are enabled, the provider will be added to this list with prior notice under section 5.2.

5.2. The Processor will inform the Customer of any intended addition or replacement of sub-processors at least 14 days in advance, giving the Customer the opportunity to object. The Processor remains responsible for its sub-processors.

6. International transfers

Personal data is stored mainly in the European Union (Germany). Transfers outside Azerbaijan or the EU take place only with the safeguards the relevant sub-processor offers in its data processing terms, such as standard contractual clauses, or on another ground permitted by applicable law.

7. Deletion

7.1. During the subscription, the Customer can disconnect channels, and workspace owners can set an automatic retention period for message texts and attachments.

7.2. After the Agreement ends, the workspace becomes read-only. The Processor keeps the Customer's data only as long as needed for the Customer to reactivate it, and deletes it at the Customer's request (sent to support@unfychat.com) or when it is no longer needed for that purpose, unless the law requires longer storage.

8. Customer's obligations

The Customer is responsible for having a lawful basis to process its end customers' data, for informing them, and for complying with the terms of the messaging platforms it connects.

9. Order of precedence

If this DPA conflicts with the Agreement regarding the processing of personal data, this DPA prevails.