Welkai Data Processing Agreement
This Data Processing Agreement ("DPA") is part of the Welkai Terms of Service between:
- you, the business using Welkai (the "Customer"), as data controller; and
- VERTEX REALITY DIGITAL SOLUTION (SSM registration no. 202603285026 (003903877-X)), trading as Welkai, as data processor.
It applies automatically when you accept the Terms. It covers the personal data in Your Data that Welkai processes for you ("Customer Personal Data"). Words such as "personal data", "processing", "data controller", "data processor" and "personal data breach" have the meaning given in the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 ("PDPA").
1. Roles
1.1 You decide why and how Customer Personal Data is processed. We process it only on your behalf, to provide the Service.
1.2 You are responsible for having a lawful basis and giving notices to the people whose data you put into Welkai, as the PDPA requires of a data controller, including for any transfer outside Malaysia (see section 7 of this DPA).
2. Your instructions
2.1 We process Customer Personal Data only on your documented instructions. Your instructions are: the Terms, this DPA, and the settings and actions you and your users choose in Welkai (for example connecting a channel, running a flow, turning on AI replies or transcription, or sending a broadcast).
2.2 If we think an instruction breaks the PDPA, we will tell you and may refuse to follow it.
2.3 We may also process Customer Personal Data where the law requires it. We will tell you first, unless the law forbids it.
3. Our people
3.1 Only people who need access to provide or support the Service may access Customer Personal Data, and they are bound to keep it confidential.
3.2 We access your account content only to provide support you ask for, to fix a fault, to protect security, or where the law requires it.
4. Security
4.1 We are directly bound by the Security Principle in section 9 of the PDPA. We take practical technical and organisational steps to protect Customer Personal Data from loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction. Annex 2 lists our current measures. We may change them, but we will not lower the overall level of protection.
5. Personal data breaches
5.1 If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay and in any case within 24 hours after we become aware of it, by email to the account owner and, where possible, by WhatsApp.
5.2 Our notice will say, as far as we know at the time: what happened and when, the types of data and the approximate number of people affected, the likely consequences, what we have done and will do, and a contact person. If we do not know everything yet, we will send the details in stages as we learn them.
5.3 We will help you meet your own duties under section 12B of the PDPA and the Commissioner's Guideline on Data Breach Notification, including notifying the Commissioner within 72 hours and affected people where required. You decide whether and how to notify them. We will not notify the Commissioner or your contacts about your data in your name without your agreement, unless the law requires us to.
5.4 Our notice is not an admission of fault.
6. Subprocessors
6.1 You agree that we use the subprocessors in our Subprocessor List (published at https://welkai.com/subprocessors/). We have written terms with each that protect personal data at least as well as this DPA requires, for the services they provide. We remain responsible to you for their work.
6.2 Changes. We will tell you by email and update the list at least 14 days before a new subprocessor starts processing Customer Personal Data. If we must replace a subprocessor urgently (for example because it failed), we will tell you as soon as we can.
6.3 Objection. You may object on reasonable data protection grounds within that 14-day period by emailing support@welkai.com. We will try to find a solution. If we cannot, you may end the affected service and we will refund the unused part of your prepaid period, counted in whole days.
6.4 Providers you choose yourself are not our subprocessors. This includes Meta (when you connect WhatsApp, Messenger or Instagram), Google (when you connect Google Forms), your own email domain provider, and any AI provider you connect with your own key. Your use of them is under your own agreement with them.
7. Transfers outside Malaysia
7.1 Customer Personal Data is stored on servers in the European Union and is transferred to subprocessors in other countries, including the United States, as listed in the Subprocessor List.
7.2 Under section 129 of the PDPA, you as data controller are responsible for transfers made on your behalf. To support your assessment, we:
- (a) give you the list of countries and subprocessors;
- (b) use only subprocessors bound by written data protection and security terms;
- (c) tell you about changes as set out in section 6; and
- (d) answer reasonable questions you need for a transfer impact assessment under the Commissioner's Cross Border Personal Data Transfer Guideline.
7.3 You confirm that you have given the people concerned the notice the PDPA requires about these transfers, or that another basis in section 129 applies.
8. Helping you with rights requests
8.1 If a person asks us directly to access, correct, delete, stop processing or transfer their data held for you, we will pass the request to you within 5 working days and will not answer it ourselves, unless you ask us to.
8.2 Welkai gives you tools to find, correct, export (contacts as CSV) and delete contacts and chats. Where the tools are not enough, we will help you within a reasonable time, so you can answer within the 21 days the PDPA allows for access requests.
8.3 We will give reasonable help with data protection impact assessments and with questions from the Commissioner about our processing.
9. Ending the service: return and deletion
9.1 While your account is active, you can export your contacts at any time, and download media while it is kept. Before deletion, you can ask us for a copy of your contacts and message history in a machine-readable format (such as CSV or JSON), which we provide within 30 days.
9.2 When your account ends, Customer Personal Data is deleted on day 45 of the timeline in section 8 of the Terms, or within a few days after once we confirm the deletion (or earlier if you ask us in writing to delete it sooner). Copies in encrypted backups expire on their normal schedule, within about 90 days after deletion, and are not used in the meantime except to restore the Service after a failure.
9.3 We may keep data longer only where the law requires it. This DPA continues to protect it.
10. Audits and information
10.1 Once every 12 months, you may ask us in writing to answer a reasonable security and data protection questionnaire. We will answer within 30 days and share available documents (such as this DPA, our Subprocessor List and a description of our security measures).
10.2 An inspection (on site or remote) is allowed only if the Commissioner requires it, or after a personal data breach affecting your data that the questionnaire cannot answer. It must be agreed 30 days ahead, take place in normal working hours, be done by you or an auditor bound by confidentiality, not give access to other customers' data, and be at your cost.
11. Liability and order of documents
11.1 Each party's liability under this DPA is subject to the limits in section 18 of the Terms, to the extent the law allows.
11.2 If this DPA and the Terms differ about Customer Personal Data, this DPA applies.
11.3 This DPA ends when we no longer hold any Customer Personal Data.
Annex 1: Details of the processing
| Item | Details |
|---|---|
| Subject and purpose | Providing the Welkai business messaging service to you: receiving, storing, sending and organising messages and contacts across WhatsApp, Messenger, Instagram and email; running flows, AI features, broadcasts, appointments and Google Forms connections; support, security and backups |
| Duration | For the term of your subscription, then until deletion under section 9 |
| Nature of processing | Collection through connected channels, storage, organisation, retrieval, sending, conversion of media, virus scanning, rendering documents to images for reading, transcription of voice notes, AI text generation, backup and deletion |
| People concerned | Your contacts, customers and leads; people who book appointments or answer your forms; your staff and users; people whose voice is cloned with consent |
| Types of personal data | Names, phone numbers, usernames, profile names and pictures, email addresses, message content, photos, videos, voice notes, documents, call information, appointment details, form answers, tags and custom fields, notes |
| Sensitive data | Not required by the Service, but may appear in content you or your contacts send (for example health information). Voice samples used for cloning may be biometric data. You must have the explicit consent the PDPA requires |
Annex 2: Security measures
- Encrypted connections (HTTPS/TLS) for all web, app and API traffic.
- Web traffic filtered by Cloudflare; servers configured to accept web traffic only from Cloudflare.
- Separation of each business's data; own-server plans run on their own server; containers isolated from each other on the network.
- Passwords stored hashed; keys and secrets stored encrypted; two-factor login available; login attempt limits.
- Backups made nightly, encrypted on the server before upload, with a per-server key and an offline recovery key; weekly encrypted off-site copies with a separate provider.
- Media stored in object storage under a per-business folder, with short-lived access links.
- Files people send are stored as inert files and never run on our servers; files are scanned for viruses and infected files are blocked; risky file types need a second confirmation to download.
- Media conversion, document rendering and text recognition run on a separate workers server, in sandboxes with no network access, time and memory limits, read-only containers and dropped privileges; keys held there have only the limited rights the work needs.
- Card payments handled by our payment gateway; we do not store full card numbers.
- Access by our staff limited to what is needed; changes in our admin console are logged.
- Security updates applied promptly; monitoring and alerts for servers, backups and unusual sending.
Annex 3: Subprocessors
See the Subprocessor List.