Sarwise Data Processing Agreement
This data processing agreement forms part of the agreement (the Terms of Service) between:
- the customer (the business that subscribes to Sarwise), the controller; and
- BOLBUY, trading as Sarwise, registered with the Dutch Chamber of Commerce under number 68734581, Goudplevier 96, 5348 ZG Oss, the Netherlands, the processor.
The customer accepts this agreement when subscribing. Where this agreement and the Terms of Service conflict, this agreement prevails as far as the processing of personal data is concerned.
1. Subject matter and duration
1.1 Sarwise processes personal data only to provide the service: an AI assistant that answers the controller's customers on WhatsApp, manages appointments and reservations, sends reminders and hands conversations over to the controller.
1.2 This agreement applies for as long as Sarwise processes personal data for the controller and ends once all data has been deleted or returned under clause 10.
1.3 The nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
2. Instructions
2.1 Sarwise processes personal data only on the controller's documented instructions. The Terms of Service, this agreement and the settings the controller chooses in the service (such as services, opening hours and languages) are such instructions.
2.2 Sarwise does not use the personal data for its own purposes, for advertising or to train AI models.
2.3 If Sarwise believes an instruction infringes the GDPR or other data protection law, it informs the controller immediately.
2.4 If Sarwise is legally required to disclose data, it informs the controller beforehand unless the law prohibits this.
3. Confidentiality
Everyone with access to the personal data on behalf of Sarwise is bound by confidentiality and has access only as far as needed for the service.
4. Security
4.1 Sarwise takes appropriate technical and organisational measures to protect the personal data, taking into account the state of the art, the costs and the risks for data subjects (art. 32 GDPR).
4.2 The measures are listed in Annex 3. Sarwise may change them as long as the level of security does not decrease.
5. Sub-processors
5.1 The controller gives Sarwise general authorisation to engage the sub-processors listed in Annex 2.
5.2 Sarwise informs the controller by email at least 30 days in advance of a new or replacement sub-processor. The controller may object with reasons within that period. If the parties cannot agree, the controller may end the subscription with effect from the end of the current subscription period.
5.3 Sarwise imposes at least the same obligations on sub-processors as in this agreement and remains responsible towards the controller for their compliance.
6. Transfers outside the EEA
Some sub-processors process data in the United States. Transfers take place only on the basis of the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, as indicated in Annex 2.
7. Data subject rights
7.1 Sarwise assists the controller, as far as reasonably possible, in responding to data subject requests (access, rectification, erasure, restriction, objection, portability).
7.2 If Sarwise receives such a request directly, it forwards it to the controller within 5 business days and does not answer it itself unless the controller asks it to.
7.3 On request, Sarwise deletes a data subject's conversations and data from the service within 10 business days.
8. Personal data breaches
8.1 Sarwise notifies the controller of a personal data breach affecting the controller's data without undue delay after becoming aware of it (Sarwise aims to notify within 48 hours), so that the controller can notify the Dutch Data Protection Authority in time.
8.2 The notification includes, as far as known: the nature of the breach, the data concerned and the (approximate) number of data subjects, the likely consequences, the measures taken or proposed and a contact person. Missing information follows as soon as possible.
8.3 The controller decides whether to notify the authority and data subjects. Sarwise does not notify on the controller's behalf unless asked to.
8.4 Sarwise assists the controller in communicating a breach to data subjects (art. 34 GDPR), including by providing the necessary information and a draft message.
9. Assistance and information
9.1 Sarwise assists the controller, taking into account the nature of the processing and the information available, in complying with articles 32 to 36 GDPR: security, notification and communication of breaches, a data protection impact assessment (DPIA) and prior consultation of the authority.
9.2 Sarwise makes available all information needed to demonstrate compliance with this agreement, primarily by providing written information and documentation. If that information is demonstrably insufficient, the controller may carry out, or have carried out by an auditor bound by confidentiality, an audit at most once a year, with 30 days' notice, at a time that does not disrupt the service and at the controller's cost.
10. End: deletion or return
10.1 At the end of the subscription, the controller chooses whether Sarwise returns the personal data (an export in a common file format) or deletes it. A request for return can be made up to 30 days after the end.
10.2 No later than 30 days after the subscription ends, Sarwise deletes all of the controller's personal data, including existing copies, unless Union or Dutch law requires retention.
10.3 During the subscription, the retention periods in Annex 1 apply; Sarwise deletes data automatically after these periods.
11. Liability
Sarwise's liability is governed by the Terms of Service. This does not affect the parties' liability towards data subjects and supervisory authorities under the GDPR.
12. Final provisions
12.1 This agreement is governed by Dutch law. Disputes are submitted to the competent court in the district of Oost-Brabant, the Netherlands.
12.2 Sarwise may amend this agreement where the law or the service requires. Material changes are announced by email 30 days in advance.
12.3 Contact for privacy questions and data breaches: info@sarwise.com.
Annex 1 — Processing
| Nature and purpose | Answering customer questions on WhatsApp with an AI assistant; booking, changing and cancelling appointments/reservations; sending reminders; handing conversations over to the controller; showing appointments in the overview (panel) and in a calendar link. |
| Data subjects | Customers and prospective customers of the controller who contact it on WhatsApp; the controller's staff (name, schedule). |
| Personal data | Phone number and WhatsApp profile name; message content; name, chosen service, date, time and staff member of an appointment; language preference; technical data (message IDs, timestamps). |
| Special categories | Not requested. The assistant is set up not to ask for health or other special category data. If a data subject shares such data anyway, it is processed only as part of the conversation and deleted with the same retention period. |
| Retention | Conversation history: max. 30 days · conversation state: max. 30 days · message IDs (preventing duplicate processing): 7 days · reminder log: max. 90 days · technical execution logs: max. 30 days · appointments: as long as the controller needs them, no later than 30 days after the subscription ends. |
Annex 2 — Sub-processors
| Sub-processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| WhatsApp Ireland Ltd. (Meta; WhatsApp Business Platform) | Sending and receiving WhatsApp messages | EU (Ireland); transfers to WhatsApp LLC and Meta Platforms Inc. (US) | EU–US Data Privacy Framework; Standard Contractual Clauses as fallback (WhatsApp Business Data Transfer Addendum) |
| Anthropic PBC (Claude API) | Drafting the assistant's replies; data is not used for model training | US | Standard Contractual Clauses (Anthropic Data Processing Addendum, part of the Commercial Terms) |
| netcup GmbH | Hosting the automation server and database (n8n) | Austria (EU; Vienna data centre) | — |
| Hostinger International Ltd. | Storing encrypted nightly back-ups (Hostinger cannot read the content); max. 14 days | Germany (EU; Düsseldorf data centre); Hostinger's own back-ups in France (EU) | — |
| Google Ireland Ltd. (Google Calendar) — only if the controller connects its own calendar | Calendar synchronisation | EU / US | EU–US Data Privacy Framework |
Checked on 22 October 2026.
Annex 3 — Security measures
- All connections encrypted (HTTPS/TLS); WhatsApp messages via the official WhatsApp Business Platform.
- Server and database in the EU (Austria, Vienna data centre); access for Sarwise only; admin accounts (automation server and hosting panels) protected by strong passwords and two-factor authentication; server access only via SSH key, root login disabled.
- API keys and secrets in the automation server's encrypted credential store; never in code or logs.
- The overview (panel) is reachable only through a secret link plus a 6-digit PIN; the PIN is stored only as a hash; 8 failed attempts per hour trigger a lockout.
- No phone numbers in the calendar link.
- Automatic deletion according to the retention periods (daily); a documented procedure for deletion requests.
- Data minimisation: the AI assistant receives only the business data it needs (no keys, PINs or calendar codes).
- The assistant always identifies itself as AI (EU AI Act art. 50) and hands over to a human on request.
- Incoming messages are checked for duplicate processing; errors are reported to Sarwise immediately.
- Documented data breach procedure with notification to the controller without undue delay.
- Back-ups: a server snapshot in the same EU data centre, plus a nightly database back-up that is encrypted on the server (the key stays with Sarwise) and then stored off the server at Hostinger in the EU; back-ups are deleted automatically after 14 days.