Data processing terms

Effective date: 26 October 2026

These Data Processing Terms apply to personal data that OneWa processes on behalf of a customer through that customer’s smart links, websites, widgets and forms (“Visitor Data”). They form part of the Terms and Conditions.

1. Roles

For Visitor Data, the customer decides the purposes and means of processing (as “data fiduciary” or “controller”) and OneWa acts as its processor. For account data and for data we use to secure the Service, prevent abuse and meet legal duties, OneWa decides how it is used, as described in the Privacy Policy.

2. What we process

• Purpose: to provide link tracking, website analytics, the WhatsApp widget and forms to the customer.
• Types of data: IP address, approximate location, device, browser and operating system details, referrer and campaign parameters, pseudonymous visitor and session identifiers, page and engagement events, and whatever visitors enter into OneWa forms.
• People concerned: visitors to the customer’s websites, people who click the customer’s links and people who submit the customer’s forms.
• Duration: for as long as the customer uses the Service, plus the retention periods in our Privacy Policy.

3. Our commitments

• We process Visitor Data only on the customer’s documented instructions (the Terms and the customer’s configuration of the Service), unless the law requires otherwise.
• People who work with this data for us are bound by confidentiality.
• We use appropriate security measures, including encrypted connections, access controls, hashed identifiers and rate-limiting.
• We help the customer respond to requests from the people concerned, where reasonably possible.
• We tell the customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal-data breach affecting its Visitor Data.
• On closure of the account, we delete or return Visitor Data on request, subject to the retention periods in the Privacy Policy and anything the law requires us to keep.

4. The customer’s commitments

• The customer will have a lawful basis for the processing, give visitors the notices the law requires and obtain any needed consent.
• The customer will not use the Service to collect sensitive data (passwords, OTPs, card or UPI details, government ID numbers, health or financial credentials) or data about children without meeting the legal requirements.
• The customer is responsible for the accuracy and lawfulness of its instructions and configuration.

5. Sub-processors and transfers

The customer authorises us to use service providers to process Visitor Data, such as hosting and email providers and IP-geolocation services (currently ip-api.com, if no local GeoIP database is installed). We stay responsible for their handling of the data and will give a current list on request. Data may be processed outside India, subject to applicable law.

6. Audit and information

On reasonable written request, and not more than once a year unless a breach has occurred, we will provide information needed to show compliance with these terms.

7. Legal compliance and abuse prevention

Nothing in these terms stops us from processing, preserving or disclosing data where needed to comply with law or a lawful order, to enforce the Terms and Acceptable Use Policy, or to investigate or report prohibited or unlawful use of the Service, including betting, gambling and online money games.

8. Order of precedence

If these terms conflict with the Terms and Conditions on the processing of Visitor Data, these terms apply to that processing.