Data processing agreement

Last updated: 15 November 2026 · Runstate Ltd, Mauritius

In short

This data processing agreement (“DPA”) is the written contract between Runstate Ltd and each business that uses MauText, for the personal data we process for that business. Runstate Ltd is registered with the Data Protection Office of Mauritius. It follows the Mauritius Data Protection Act 2017 (“the Act”) and forms part of our terms of service. MauText is in development and not yet offered to customers; this DPA applies to anyone who uses it, including testers.

1. Definitions

“Controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meanings in the Act. “Customer” is the business that uses MauText. “Customer data” is the personal data we process for the customer through MauText. “Sub-processor” is a provider we use to process customer data.

2. Scope and roles

The customer is the controller of customer data. RUNSTATE LTD (BRN C26230427, VAT 28491021), Forest Side, Mauritius (“Runstate”) is the processor. Schedule 1 describes the processing. For our own account, billing and security records we are a controller, as our privacy policy explains.

3. Instructions

We process customer data only on the customer’s documented instructions: the terms, this DPA, the customer’s settings and its use of the app and API. We tell the customer if we think an instruction breaks the Act. We don’t use customer data for our own purposes, advertising or AI training, and we don’t sell it.

4. Confidentiality

Only staff who need it to run, support or secure MauText can open customer data. They are bound to keep it confidential, and every staff action is logged.

5. Security

We keep the technical and organisational measures in Schedule 2, as section 31 of the Act requires, and review them as MauText changes.

6. Personal data breaches

If we become aware of a personal data breach affecting customer data, we tell the customer without undue delay and in any case within 24 hours, with the facts we have and what we are doing about it. This lets the customer notify the Data Protection Commissioner within 72 hours (section 25 of the Act) and tell the people affected where required (section 26). We keep helping as we learn more.

7. Help with requests and assessments

If a data subject asks us about customer data, we pass the request to the customer and help it answer, for example by finding, correcting, exporting or erasing data. The customer can also erase one person itself in the Inbox or with the API. We help the customer with data protection impact assessments (section 34 of the Act) and with consulting the Commissioner, where needed.

8. Sub-processors

The customer gives general authorisation for the sub-processors below. We tell the customer by email at least 15 days before we add or replace one, and the customer may object on reasonable data protection grounds; if we can’t solve the objection, the customer may end the agreement. We put data protection terms in place with each sub-processor and remain responsible for them.

• Contabo GmbH, France (European Union): hosting, the database and our mail server.
• Meta Platforms: delivery of WhatsApp messages for a number the customer connected. Meta also acts under its own terms for some processing, as the privacy policy explains.

9. Transfers outside Mauritius

Customer data is stored in France and may be handled by Meta in other countries. We transfer customer data outside Mauritius only as needed for the service and with appropriate safeguards, as section 36 of the Act requires.

10. Return and deletion

Before closing its account the customer can download its data in Settings › Company, or ask us for an export. We delete customer data 30 days after the account is closed (or within 30 days of the customer’s instruction), except what the law requires us to keep. Backups rotate out within 14 days after that.

11. Audits

Once every 12 months, with 30 days’ written notice, the customer may ask for the information needed to show that we meet this DPA. We answer with documents, such as a description of our measures and answers to a reasonable questionnaire. Any on-site review needs a separate written agreement.

12. Requests from authorities

If an authority asks us for customer data, we check that the request is lawful, share only what the law requires, and tell the customer first unless the law stops us.

13. Liability

Each party’s liability under this DPA follows the limits in the terms of service, so far as the Act allows.

14. Order of precedence

If this DPA and the terms disagree about customer data, this DPA applies.

Schedule 1: Processing details

• Subject matter and purpose: running MauText for the customer: sending and receiving WhatsApp messages from the customer’s own number, invoices and statements, login codes, the shared inbox and the optional Assistant.
• Duration: while the customer’s account is open, and until deletion under section 10.
• Data subjects: the customer’s contacts and customers, and the customer’s staff who use MauText.
• Categories of data: names, phone numbers, email addresses, message content and status, notes, invoice and statement details, and invoice or statement documents in transit (not kept).
• Special categories: none intended. The customer must not send sensitive data through MauText (see section 8 of the terms).

Schedule 2: Security measures

• Message text and access tokens encrypted at rest (AES-256-GCM).
• Passwords, API keys and login codes stored only as hashes.
• Two-factor login for every user, always on for Runstate staff.
• Tenant separation: each customer sees only its own data, and roles limit what each person can do.
• Access control: staff open a customer’s account only for support; support sessions last one hour.
• Audit logs of every staff action.
• HTTPS for every connection; signature checks on Meta’s webhooks; rate limits on sign-in and codes.
• Nightly backups, kept for 14 days.