Reseller Data Processing Addendum

1. Roles

For the personal data a business keeps in its workspace (its customers' names, phone numbers, conversations, notes and files), the business is the Data Fiduciary (the "controller" under the GDPR). Minivet System LLP is its Data Processor, under the Data Processing Addendum (https://octapages.com/data-processing). The reseller is a processor that acts only on the business's documented instructions, and on behalf of OctaPages's service to that business; it is never an owner of the data.

2. How a reseller reaches the data

• Only as a member of the business's workspace: visible in its Team list with a Reseller badge, with a role the business can see and change, and removable by the business unless the business itself switched on "fully managed".
• Every time a reseller opens the workspace, the visit is written to the workspace's own audit log and to the reseller's access log; the business can ask to be emailed each time.
• A reseller's API key can create and list clients, request workspaces, read the apps it pays for and statements, and apply blueprints. It cannot read a business's customers, messages, contacts or files, and it can never reach another reseller's clients (checked by automated tests on every change).
• Staff permissions of the platform never apply to a workspace host.

3. The reseller's duties

• Process the data only to set up, support and administer the business's workspace, as the business instructs; never for its own purposes, never for advertising, and never to build a list of the business's customers.
• Keep everything confidential and secure: unique sign-ins for each person, two-step verification where the platform offers it, and no sharing of credentials.
• Use no other processor for the business's data without the business's knowledge, and never move workspace data out of the workspace by copy, screenshot or export except as the business asks.
• Help the business answer its customers' requests to access, correct or erase their data (the workspace has tools for each), and pass such a request to the business the same day it receives one.
• Tell the business and us without undue delay, and within 24 hours, of anything that may have exposed the business's data, so the business can meet its own 72-hour duty to the Data Protection Board.
• Follow WhatsApp's Business and Commerce policies and the TRAI rules on commercial communication for any messages it sends for the business.

4. What we do

• Give every business its own database, and check by automated tests that no reseller and no other business can reach it.
• Record reseller access as above, and let the business remove a reseller at any time (unless it chose "fully managed").
• Never let a reseller's payment problem stop a business receiving a customer's message, reading its data or signing in.
• Keep the audit trail of every staff decision that affects a business, and email the business the reason.

5. When the relationship ends

When a business leaves its reseller, or a reseller's account is closed, the reseller's people are removed from the business's workspace and the reseller keeps no access to its data. The business keeps its workspace, its data and its apps; the apps the reseller paid for run to the end of the period it paid for.

If a reseller is suspended for 30 days or closed, each of its businesses has 30 days to continue directly or move to another provider, and nothing of the business is deleted in that time. Nothing is ever archived or deleted without a verified backup.

A reseller must, on request, delete or return any copy of a business's data it holds outside the workspace within 30 days, and confirm it in writing.

6. Sub-processors

The providers OctaPages uses are listed, with what they do and where, at https://octapages.com/sub-processors. A reseller's own tools that touch a business's data are the reseller's responsibility and are disclosed to that business.

7. Checks

OctaPages may check a reseller's compliance with this addendum: through the access and request logs, through the business's complaints, and, where there is reason to suspect a breach, by asking the reseller for information. A reseller that breaches it may be suspended or closed, and its businesses then get the continuity window described above.