This page sets out how Clikgen meets its obligations as a data processor under the EU General Data Protection Regulation, the UK GDPR and the Digital Personal Data Protection Act 2023, and forms the Data Processing Agreement ("DPA") between us where you process personal data through the platform. It supplements our Terms and Conditions.
1. Roles of the parties
You are the controller (or, under the DPDP Act, the Data Fiduciary) in respect of personal data you upload or generate in the platform. We are the processor (Data Processor). We process personal data only on your documented instructions, which are given through your configuration and use of the platform, and through any written instruction you send us.
If we believe an instruction infringes applicable data protection law, we will tell you promptly and may suspend performance of that instruction.
2. Subject matter and scope of processing
| Item | Detail |
|---|---|
| Subject matter | Provision of the CRM, messaging, calling, email, AI and analytics services |
| Duration | For the term of the agreement plus the retention periods described in the Terms |
| Nature and purpose | Storage, organisation, retrieval, transmission, analysis and deletion of records to deliver the service |
| Categories of data subject | Your leads, customers, prospects, contacts, staff and workspace users |
| Categories of personal data | Identity and contact details, conversation content, call recordings and transcripts, commercial and transaction data, usage metadata |
| Special categories | Not intended; you must not upload special-category data without an appropriate lawful basis and prior notice to us |
3. Our obligations
- Process personal data only on your documented instructions, including for international transfers.
- Ensure personnel with access are bound by confidentiality and trained appropriately.
- Implement the technical and organisational measures described in section 5.
- Engage sub-processors only under written terms no less protective than this DPA, and give notice of changes so you can object.
- Assist you, taking into account the nature of processing, in responding to data-subject requests.
- Assist you with data protection impact assessments and prior consultations where required.
- Notify you without undue delay, and in any event within 72 hours of becoming aware, of a personal data breach affecting your data.
- Delete or return personal data at the end of the agreement, subject to legal retention obligations.
- Make available the information necessary to demonstrate compliance and allow for audits, subject to reasonable notice and confidentiality.
4. Your obligations
- Establish and document a lawful basis for every category of personal data you process through the platform.
- Provide the privacy information your own data subjects are entitled to receive.
- Obtain and record consent where the channel or jurisdiction requires it, particularly for WhatsApp and email marketing.
- Configure retention periods, role permissions and field-level access appropriately for your organisation.
- Respond to data-subject requests relating to your own records; we will assist but cannot decide them for you.
- Not upload data you are prohibited from processing.
5. Technical and organisational measures
- Encryption of personal data in transit using TLS 1.3 and at rest using AES-256.
- Role-based access control with least-privilege defaults and separate export permissions.
- Multi-factor authentication available on all accounts and enforceable per role.
- Immutable audit logging of record access, changes, exports and permission modifications.
- Network segmentation, managed secrets and restricted production access with logged, time-bound elevation.
- Encrypted, tested backups with a documented restoration procedure.
- Vulnerability management, dependency scanning and periodic penetration testing.
- Documented incident response with defined severity levels and notification paths.
- Data residency selection at workspace creation.
6. Sub-processors
We engage sub-processors to deliver parts of the service. Categories include cloud infrastructure and storage, messaging and telephony providers you connect, email delivery providers you connect, AI providers you enable, error monitoring, product analytics and customer support tooling.
A current list naming each sub-processor, its role and its processing location is available on request by asking us on WhatsApp on +91 96304 70438. We will give at least 30 days' notice before adding a sub-processor that processes your personal data, during which you may object on reasonable data-protection grounds; if we cannot resolve the objection you may terminate the affected service without penalty.
7. International transfers
Where personal data is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Module Two, controller to processor), the UK International Data Transfer Addendum where applicable, and supplementary measures including encryption and access minimisation. Under the DPDP Act, transfers are made only to jurisdictions not restricted by the Central Government.
8. Data-subject rights
The platform provides self-service tooling so you can fulfil requests without contacting us: search across every object, per-contact export, per-contact erasure including conversations and recordings, consent state visible on each record, and audit evidence of the action taken. If a data subject contacts us directly about your records, we will not respond substantively; we will refer them to you and notify you promptly.
9. Breach notification
On becoming aware of a personal data breach affecting your data we will notify you without undue delay and within 72 hours, providing the nature of the breach, categories and approximate numbers affected, likely consequences, measures taken and a contact point. We will provide updates as the investigation progresses and will not make public statements identifying you without prior consultation, except where legally compelled.
10. Contact
Data protection enquiries, DPA counter-signature requests, sub-processor lists and audit requests should be sent to us on WhatsApp on +91 96304 70438 with the subject line "Data protection".