Version 1.0 · in force from 1 August 2026. Required by Article 28 GDPR whenever we handle your customers' data for you.
The full agreement below is the one that counts legally. It is written in English, which is the binding language.
You (the Customer) are the controller of the personal data of your own customers: their messages, names, phone numbers, bookings and orders. You decide why and how that data is used.
AWMZA — HUSSAIN MUHAMMAD MAJID, VAT IT14191810960, Via Abate Pelizzoni 5, 20033 Solaro (MI), Italy — is the processor. We handle that data only to provide the services you bought.
This agreement is part of the AWMZA Terms of Service. Where the two disagree on data protection, this agreement wins.
We process personal data only on your documented instructions. Buying and using the service is itself an instruction to run the features you switched on. If a law forces us to process data in another way, we tell you first, unless that law forbids us to.
We do not sell personal data, we do not share it with advertisers, and we do not use your data or your customers' data to train any AI model.
Everyone at AWMZA who can reach your data is bound by a written confidentiality obligation that continues after they stop working with us. Access is limited to the people who need it to do their job.
The measures we keep in place are listed in Annex 2. We may change them, but never in a way that lowers the level of protection.
You give us general authorisation to use the sub-processors listed at awmza.com/subprocessors. Before we add or replace one, we email the address on your account at least 30 days in advance. If you object on reasonable data-protection grounds, you may end the affected service before the change takes effect and we refund the unused part of what you paid.
Every sub-processor is bound by data protection duties at least as strict as these.
If one of your customers asks to see, correct, move or delete their data, we help you answer within the legal deadline. Self-service export and erasure tools are included, at no extra charge. If a request comes to us directly, we forward it to you and do not answer it ourselves.
If personal data is ever exposed, lost or accessed without permission, we tell you within 24 hours of becoming aware, with what we know so far, what we are doing about it, and who to contact. We keep helping until it is closed. This lets you meet your own 72-hour duty to the supervisory authority.
If you need to carry out a data protection impact assessment or consult your supervisory authority, we give you the information about our systems that you reasonably need.
You can export everything about your account at any time. When your contract ends we delete your personal data within 30 days, and any backup copies within 90 days, unless EU or member state law makes us keep it. Invoicing records are kept for the period tax law requires.
While your account is live, conversation logs, contact messages and similar records are deleted automatically after 90 days, and bookings after 365 days, unless you ask us in writing for a different period.
We give you the information you need to show you comply. Once every 12 months, or after a security incident, you may audit us — by questionnaire, or on site with 30 days' notice, during working hours, without disrupting other customers.
Your data is stored in Germany. Some optional features send data to the United States: fast AI answers (Groq), advanced AI (Anthropic) and domain registration (NameSilo). For these we use the EU Standard Contractual Clauses and, where the company is certified, the EU-US Data Privacy Framework.
If you do not want any data leaving the European Union, ask us to switch your account to the EU data only plan. On that plan every AI answer is produced by our own model on our German server. There is no extra charge.
This agreement lasts as long as we process personal data for you. Liability follows the AWMZA Terms of Service. Italian law applies and the courts of Milan, Italy have jurisdiction, without affecting any right you have to bring a claim where you live.
| Subject matter | Providing AWMZA automation, WhatsApp and messaging bots, bookings, email and domain services. |
|---|---|
| Duration | For as long as your contract lasts, plus the deletion periods in section 9. |
| Nature and purpose | Receiving, storing, analysing and answering messages; managing bookings, orders and contact requests; sending notifications. |
| Types of personal data | Name, phone number, email address, message content, booking and order details, IP address, language, and anything else your customers choose to write. |
| Categories of data subject | Your customers, your leads, and your own staff who use the service. |
| Special categories | Not requested and not required. Do not configure your bot to collect health, biometric, religious, political or similar data without contacting us first. |
The current list, with what each one does and where it stores data, is published and kept up to date at awmza.com/subprocessors.
Fill this in once. We record the date and time and send a signed copy to your email. You do not need to print or sign anything.