Data Processing Agreement (DPA)

This page provides the standard Data Processing Agreement (DPA) for Better Messages under Article 28 of the GDPR. It applies when you use the WebSocket version with the Better Messages cloud relay (cloud.better-messages.com), where Better Messages processes a limited set of personal data on your behalf.

When a DPA applies

A DPA is relevant only for the WebSocket version cloud relay. The free / AJAX version and the self-hosted plan send no data to Better Messages infrastructure — in those modes Better Messages does not process anything on your behalf, so no DPA is required.

This is a template

The text below is a ready-to-use template. To put a DPA in force, request a counter-signed copy. This page is provided for transparency and is not legal advice — review it with your own counsel before relying on it.

Operated from Ukraine — transfers covered by SCCs

Better Messages is run by a solo entrepreneur based in Ukraine (a non-EU country). The relay stores no message content and handles only limited identifiers (such as message and thread IDs) needed to route and sync messages — all processed in the EU (Frankfurt). Any international access is covered by the EU Standard Contractual Clauses included with this DPA (see Annex 4 below).

Parties#

This Data Processing Agreement ("DPA") is entered into between:

Controller: the operator of the website that uses the Better Messages WebSocket version (the customer) — [Controller legal name and address]; and
Processor: Better Messages, operated by [full name], an individual entrepreneur (ФОП) registered in Ukraine, [registered address], [state registration record no. / tax ID] ("Better Messages", "we").

This DPA supplements and forms part of the agreement under which the Controller uses the WebSocket version (the "Principal Agreement").

1. Definitions#

Terms such as "personal data", "processing", "controller", "processor", "sub-processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given to them in the GDPR (Regulation (EU) 2016/679) and any applicable national data protection law (together, "Data Protection Law").

2. Subject matter, nature and purpose#

2.1 Better Messages processes personal data on behalf of, and on the documented instructions of, the Controller solely to provide the WebSocket version: real-time message routing and delivery, offline synchronisation, unread tracking, online presence, push-notification dispatch, and voice/video call signalling.

2.2 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

3. Roles of the parties#

The Controller is the controller of the personal data. Better Messages is the processor and processes personal data only as set out in this DPA and the Principal Agreement, or as otherwise instructed in writing by the Controller, unless required to process by law (in which case Better Messages will inform the Controller, unless legally prohibited).

4. Obligations of Better Messages (Article 28(3))#

Better Messages will:

(a) Documented instructions — process personal data only on the Controller's documented instructions, including with regard to international transfers, unless required by law;
(b) Confidentiality — ensure that persons authorised to process the personal data are bound by confidentiality;
(c) Security — implement the technical and organisational measures set out in Annex 2 (Article 32);
(d) Sub-processors — engage sub-processors only in accordance with Section 6;
(e) Data subject rights — taking into account the nature of the processing, assist the Controller by appropriate measures, insofar as possible, to respond to requests to exercise data subject rights;
(f) Assistance — assist the Controller in ensuring compliance with the obligations in Articles 32 to 36 (security, breach notification, data protection impact assessments, prior consultation), taking into account the nature of processing and the information available;
(g) Deletion or return — at the Controller's choice, delete or return all personal data after the end of the provision of services, and delete existing copies unless storage is required by law (see Section 9);
(h) Audits — make available to the Controller the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits as set out in Section 8.

Better Messages will inform the Controller if, in its opinion, an instruction infringes Data Protection Law.

5. Security of processing#

5.1 Better Messages maintains the technical and organisational measures described in Annex 2, appropriate to the risk.

5.2 By design, message content is never transmitted to or stored on the relay — it remains solely in the Controller's WordPress database. All data transmitted to and from the relay is encrypted in transit. The relay processes only the limited metadata described in Annex 1.

6. Sub-processors#

6.1 The Controller grants Better Messages general written authorisation to engage sub-processors. The current sub-processors are listed in Annex 3.

6.2 Where a sub-processor is engaged, Better Messages imposes data protection obligations equivalent to those in this DPA by contract, and remains fully liable to the Controller for the sub-processor's performance.

6.3 Better Messages will give the Controller at least 30 days' notice of any intended addition or replacement of a sub-processor (by updating Annex 3 and/or by email), giving the Controller the opportunity to object on reasonable data-protection grounds. If the parties cannot resolve a reasonable objection, the Controller may terminate the affected services.

7. International transfers#

7.1 The relay's primary processing and storage takes place in Frankfurt, Germany (EU/EEA) — see Servers location. Personal data is not stored outside the EEA.

7.2 Better Messages is operated by an individual entrepreneur established in Ukraine, a country without an EU adequacy decision. To the extent that providing and supporting the service involves Better Messages accessing personal data from Ukraine, that access is a transfer to a third country under Chapter V of the GDPR. Such transfers are governed by the EU Standard Contractual Clauses incorporated in Annex 4.

7.3 Where the Controller enables push notifications, limited data (device tokens and notification payloads) may additionally be processed by push providers located outside the EEA (see Annex 3), likewise under the EU Standard Contractual Clauses or another valid Chapter V transfer mechanism.

8. Audit#

Better Messages will make available, on reasonable written request and no more than once per year (unless required by a supervisory authority or following a personal data breach), the information reasonably necessary to demonstrate compliance with Article 28, subject to confidentiality and to not compromising the security of other customers.

9. Personal data breach#

Better Messages will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's personal data, and will provide the information reasonably available to assist the Controller in meeting its obligations under Articles 33 and 34.

10. Duration, deletion and return#

10.1 This DPA applies for as long as Better Messages processes personal data on behalf of the Controller under the Principal Agreement.

10.2 On termination, and at the Controller's choice, Better Messages will delete or return the Controller's personal data held on the relay and delete existing copies, unless storage is required by law. Delivery metadata held on the relay is in any case automatically pruned after the retention period stated in Annex 1.

11. Liability and governing law#

11.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Principal Agreement.

11.2 This DPA is governed by the law that governs the Principal Agreement. Where none is specified, it is governed by the law of the country in which the Controller is established, and where the Controller is established within the EEA, by the law of that EEA member state. In all cases the parties comply with the GDPR; nothing in this DPA reduces either party's obligations under Data Protection Law.

11.3 If there is any conflict between this DPA and the Principal Agreement on data protection matters, this DPA prevails.

11.4 The Standard Contractual Clauses incorporated under Annex 4 are governed by the law of an EU member state, as their Clause 17 requires. Where this DPA and those Clauses conflict in respect of a restricted transfer, the Standard Contractual Clauses prevail.

Annex 1 — Details of processing#

Item	Detail
Subject matter	Real-time delivery and synchronisation of messages for the Controller's website
Duration	For the term of the Principal Agreement
Nature & purpose	Routing/delivery of real-time events, offline sync, unread tracking, presence, push dispatch, call signalling
Categories of data subjects	The Controller's registered users and guest/visitor chat participants
Retention on relay	Delivery metadata is retained only as long as necessary to provide the service, then automatically pruned. Current maximum: `[retention period — confirm, e.g. up to 3 years]`. Message content is not stored on the relay.

Categories of personal data (limited to the minimum needed to route and synchronise messages):

Identifiers — numeric user, thread and message IDs of the Controller's users and guests
Delivery state — timestamps, unread counts, delivery and read status
Connection data — each connection's IP address and session identifier (processed transiently to establish and secure the connection) and online/offline status
Device tokens (only if push notifications are enabled) — mobile push tokens / web-push endpoints, used solely to deliver notifications
Encrypted display cache (transient) — a short-lived, encrypted cache of display name and avatar, used only to render sender info in notifications

Never processed or stored by the relay:

Message content and attachments — these stay solely in the Controller's WordPress database and never reach the relay.

Special categories of data (Article 9): The relay is not intended to process special-category data. Because message content never reaches the relay, any special-category data contained in messages remains solely within the Controller's WordPress environment.

Annex 2 — Technical and organisational measures (Article 32)#

Encryption in transit — all connections (browser↔relay and WordPress↔relay) use TLS
Data minimisation by design — message content and attachments are never sent to or stored on the relay; only the metadata in Annex 1 is processed
Encryption at rest of cached display data, with integrity (HMAC) validation
Tenant isolation — each site's metadata is held in a logically separate per-site database
Access control & authentication — per-site secret keys and license validation for all relay API access; administrative access restricted on a need-to-know basis
Network security — firewalling and restricted service ports
Physical & environmental security — EU data centre (Frankfurt, Germany) operated by an ISO/IEC 27001-certified provider
Retention & deletion — automatic pruning of delivery metadata; deletion of a site's data on termination
Backups & resilience — secured backups and monitoring for service continuity

Annex 3 — Sub-processors#

Sub-processor	Purpose	Location	Safeguard
OVHcloud (`[OVH legal entity, e.g. OVH GmbH]`)	Cloud hosting / infrastructure for the relay	Frankfurt, Germany (EU)	Within EEA; ISO/IEC 27001 certified
Apple Inc.	Apple Push Notification service (iOS notifications)	USA	Apple DPA + EU SCCs — only where iOS push is enabled
Google LLC	Firebase Cloud Messaging (Android notifications)	USA	Google DPA + EU SCCs — only where Android push is enabled
OneSignal, Inc.	Push notification dispatch	USA	Only where the Controller enables OneSignal with their own account; subject to OneSignal's DPA

Voice/video calls run on Better Messages' own EU infrastructure and do not involve an external sub-processor.

Annex 4 — EU Standard Contractual Clauses (international transfers)#

Better Messages is operated by an individual entrepreneur established in Ukraine, which is not covered by an EU adequacy decision. Where providing and supporting the service involves access to personal data from Ukraine, the parties incorporate the EU Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 ("SCCs") as follows:

SCC element	Selection
Module	Module Two (Controller → Processor). The Controller is the data exporter; Better Messages is the data importer
Clause 7 (docking clause)	Applies
Clause 9 (sub-processors)	Option 2 — general written authorisation, minimum 30 days' prior notice of changes (consistent with Section 6)
Clause 11 (independent dispute resolution)	Optional wording does not apply
Clause 17 (governing law)	Law of the EU member state in which the Controller (data exporter) is established (the SCCs require an EU member-state law; set on signing)
Clause 18 (forum & jurisdiction)	Courts of that EU member state
Annex I.A (parties)	As stated in Parties above and the signature schedule
Annex I.B (description of transfer)	As set out in Annex 1 of this DPA
Annex I.C (competent supervisory authority)	The supervisory authority of the Controller's EU member state
Annex II (technical & organisational measures)	As set out in Annex 2 of this DPA
Annex III (sub-processors)	As set out in Annex 3 of this DPA

Transfer-impact factors: personal data is stored within the EEA (Frankfurt, Germany); message content is never stored on the relay; all access is authenticated and encrypted in transit; cached display data is encrypted at rest; access from Ukraine is limited to what is necessary to operate and support the service. Better Messages will assist the Controller with any transfer-impact assessment on request.

How to request a counter-signed DPA#

To put this DPA in force, email support@better-messages.com with:

Your legal entity name and address (the Controller)
The name and title of your authorised signatory
Your website domain using the WebSocket version
The EU member state in which you are established (used to complete the Standard Contractual Clauses)

We will return a copy counter-signed by Better Messages (signing as a Ukrainian individual entrepreneur), including the EU Standard Contractual Clauses for the transfer. If your organisation requires its own DPA paper or specific clauses, attach it and we will review.