The General Data Protection Regulation (GDPR) is the European Union’s data protection law, in force since May 2018. It strengthens and harmonizes data protection rights for people in the EU, consistent with the understanding of privacy as a fundamental human right, and applies to any organization anywhere in the world that processes the personal data of people located in the EU. The United Kingdom applies an equivalent framework (the UK GDPR and the Data Protection Act 2018), and a growing number of US states, beginning with California’s CCPA/CPRA, impose comparable obligations.
Does the GDPR apply to you?
If you have customers, leads, or website visitors located in the EU or UK, the GDPR or UK GDPR almost certainly applies to you, even if your business is based elsewhere. Penalties for non-compliance can reach 20 million euros or 4% of global annual revenue, whichever is higher. You should consult a qualified specialist regarding the full scope of your compliance obligations; nothing on this page is legal advice.
Our roles: controller and processor
When you use WhatConverts, we act as a data processor for the personal data flowing through your account: calls, texts, form submissions, chat transcripts, recordings, and related lead data belonging to your end users. We process that data only on your instructions.
You act as the data controller: you decide what data is collected through the platform and for what purpose. That makes GDPR compliance a partnership. We provide the contractual commitments, security measures, and tooling; you are responsible for the lawful basis, notices, and consents on your side, including any required call recording announcements and website privacy disclosures.
What WhatConverts provides
- A Data Processing Agreement (DPA) meeting the requirements of Article 28 GDPR, available in three regional versions below. The EU version incorporates the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and the UK version adds the UK International Data Transfer Addendum, covering transfers of European data to our US infrastructure. All versions include service-provider terms addressing the CCPA/CPRA and comparable US state privacy laws.
- A published list of authorized subprocessors (Appendix II of the DPA), covering every vendor that processes customer personal data on our behalf, including our hosting, telephony, transcription, AI, and support providers. We provide at least 30 days’ advance notice of any changes.
- An appointed Data Protection Officer, documented breach response procedures, encryption of data at rest and in transit, access controls with logging and monitoring, and procedures for supporting data subject rights requests.
Get our Data Processing Agreement
Choose the version matching your organization’s location, complete the signature block and customer details, and return it to support@whatconverts.com:
The DPA supplements and forms part of our Terms of Use; the two documents operate together as a single contractual framework governing how we process personal data on your behalf, with the DPA prevailing on data protection matters in the event of any conflict. Our Privacy Policy contains further details on how we handle personal data.
Where should you start as a controller?
Assign a data protection lead, or appoint a Data Protection Officer if required. Inventory the personal data you handle and establish a lawful basis for processing it. Review your privacy notices and consent mechanisms, including recording announcements for tracked calls and consent management for website tracking. Put a data processing agreement in place with every processor you use, WhatConverts included, using the documents above. Then monitor regulatory guidance from your national data protection authority or gdpr-info.eu.
This page is provided for general information only and is not legal advice. Consult a qualified professional for advice tailored to your circumstances.
