Controller and Processor Roles

1. Overview

Under the General Data Protection Regulation (GDPR) and other modern data privacy frameworks, defining the legal roles of parties handling personal information is crucial. This document clarifies the distinct responsibilities of our customers and Opimatic when interacting with the platform's omnichannel automation and communication tools.

2. Customer as Data Controller

When you use Opimatic to manage customer relationships, conversational inboxes, and automated social posting, you act as the Data Controller for your end-users, subscribers, and leads.

• Purposes & Means: You determine the purpose for which personal data is collected and processed through our software.
• Lawful Basis: You are responsible for establishing a lawful basis (such as consent or legitimate interest) for collecting and messaging your audience via WhatsApp, Facebook, Instagram, and other connected channels.
• Data Subject Requests: You remain the primary point of contact for your end-users regarding privacy rights, data corrections, and deletion requests.

3. Opimatic as Data Processor

Opimatic acts as a Data Processor (or Service Provider under CCPA) with respect to the customer data and end-user contact lists uploaded, synchronized, or processed through our platform.

• Processing on Instructions: We process personal data strictly according to your documented instructions, configuration settings, and our Terms of Service / Data Processing Agreement (DPA).
• No Independent Use: Opimatic does not monetize, sell, or independently utilize your customer lists or conversation logs for advertising or unauthorized profiling.

4. Shared Compliance Responsibilities

While controller and processor roles are distinct, both parties share a commitment to data protection integrity:

• Security Measures: Opimatic provides robust technical safeguards (encryption, access controls), while the Customer maintains responsible account security (strong passwords, multi-factor authentication).
• Transparency: Both parties agree to maintain clear privacy disclosures to inform data subjects about how automated tools interact with their information.

5. Processing Instructions

The agreement between the Customer and Opimatic serves as the complete and binding instruction for data processing. Opimatic will inform the Customer immediately if, in our opinion, an instruction infringes upon GDPR or other data protection regulations.

6. Sub-processing Dynamics

In our role as a processor, Opimatic utilizes trusted infrastructure sub-processors (such as cloud hosting providers and API gateways) to deliver continuous uptime and automated synchronization. All sub-processors are vetted and bound by strict data protection covenants.

7. Compliance & Documentation

Opimatic makes available all information necessary to demonstrate compliance with our processor obligations and allows for and contributes to audits and inspections conducted by the Customer or an auditor mandated by the Customer, subject to standard confidentiality and security guidelines.

8. Legal & Compliance Contact

If you require clarification on data stewardship roles, need to execute a DPA, or have specific compliance inquiries, our legal team is ready to assist: