Data Processing Agreement

Last updated: 11 July 2026  ·  SmartReply, a product of Made in Graphic Ltd  ·  Company No: 13094248 (England & Wales)

This Data Processing Agreement (“DPA”) forms part of the agreement between Made in Graphic Ltd (“Processor”, “we”) and the customer who uses SmartReply (“Controller”, “you”) and governs the processing of personal data carried out on your behalf. It is designed to satisfy Article 28 of the UK GDPR and the EU GDPR, and applies automatically to every SmartReply account. Capitalised terms not defined here have the meaning given in the GDPR.

1. Roles of the Parties

For personal data contained in the conversations, contacts, and media that your customers send to your connected messaging channels (your WhatsApp Business number and, where enabled, your Facebook Page, Instagram account and website web-chat widget), you are the Controller and we are the Processor acting only on your documented instructions (which include your use of the SmartReply product and its settings). We remain an independent Controller for our own account, billing, support and security data, which is governed by our Privacy Policy.

2. Subject Matter, Duration, Nature and Purpose

• Subject matter: processing of personal data to provide AI-assisted customer support across your connected messaging channels (WhatsApp, Facebook Messenger, Instagram, web chat), message routing, knowledge-base answers, and appointment booking.
• Duration: for the term of your SmartReply account, plus the retention periods set out in section 7.
• Nature and purpose: receiving, storing, displaying, analysing, and responding to inbound messages and media on your behalf, and enabling your operators to reply.

3. Categories of Data Subjects and Personal Data

• Data subjects: your customers and contacts who message your connected channels; your operators and team members.
• Personal data: phone numbers, names, profile information, message content, media files (images, audio, video, voice notes, documents), location messages, and metadata such as timestamps and conversation labels.
• Special categories: we do not require special-category data; if your customers send it within message content, it is processed only as part of the conversation.

4. Processor Obligations (Art. 28(3))

We will:

• process personal data only on your documented instructions, including for international transfers, unless required by law (in which case we will inform you unless legally prohibited);
• ensure that personnel authorised to process the data are bound by confidentiality;
• implement appropriate technical and organisational measures (section 6);
• respect the conditions in sections 5 and 8 for engaging sub-processors;
• assist you, taking into account the nature of processing, in responding to data-subject rights requests;
• assist you in ensuring compliance with security, breach-notification, and impact-assessment obligations (Art. 32–36);
• delete or return the data at the end of the service (section 7); and
• make available the information necessary to demonstrate compliance and allow for audits (section 9).

5. Sub-Processors

You grant general authorisation for us to engage the sub-processors listed below to deliver the service. Each operates under its own data-processing terms and appropriate safeguards. We will inform you of intended changes (additions or replacements) and give you the opportunity to object on reasonable data-protection grounds.

6. Security Measures (Art. 32)

We maintain technical and organisational measures appropriate to the risk, including:

• Encryption: all data in transit over HTTPS; WhatsApp credentials and OAuth tokens encrypted at rest; passwords hashed.
• Tenant isolation: per-account data isolation enforced at the database level (row-level security), so one account cannot access another’s data.
• Access control: role-based operator access; least-privilege database roles; authenticated internal services.
• Media safeguards: inbound media is stored only to display it to your operators; per-file size limits apply (16 MB for images, audio and video; 50 MB for documents), per-account daily volume limits apply, and stored media is permanently deleted 90 days after receipt.
• Resilience: daily backups and monitoring of the production environment.

7. Retention, Return and Deletion

When your account is terminated or you request deletion in the panel, the account enters a 90-day grace window during which the request can be cancelled; at the end of this window personal data is permanently deleted. You may request earlier deletion at any time. Media files are automatically deleted 90 days after receipt. Billing records may be retained for up to 7 years for legal compliance. On request, we will return your data in a structured, commonly used format before deletion. Conversation message content is anonymised after a configurable retention period (24 months by default), permanently removing message text and customer identifiers while retaining only non-identifying analytics. Following deletion or anonymisation, residual copies may persist in our encrypted rolling backups for up to 30 days, after which they are overwritten and put beyond use; backups are not selectively restored to reinstate deleted personal data. These periods are described in more detail in our Privacy Policy.

8. Personal Data Breach

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide the information reasonably available to help you meet your own notification obligations under Articles 33–34.

9. Audit and Compliance

We will make available, on reasonable written request and no more than once per year (or following a breach), the information necessary to demonstrate compliance with this DPA, and will contribute to audits conducted by you or an independent auditor mandated by you, subject to confidentiality and reasonable scheduling.

10. International Transfers

Where personal data is transferred outside the UK or EEA (for example to US-based sub-processors), the transfer is protected by an appropriate safeguard such as the UK International Data Transfer Agreement / Addendum or the EU Standard Contractual Clauses, together with supplementary measures where required.

11. Data Subject Rights

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, and objection).

12. General

This DPA is governed by the laws of England & Wales. In the event of a conflict between this DPA and the Terms of Service or Privacy Policy regarding the processing of personal data, this DPA prevails. If any provision is held invalid, the remainder continues in effect.

13. Contact

Made in Graphic Ltd · Company No: 13094248 · info@madeingraphic.co.uk · Privacy Policy · Terms of Service