DPA & Subprocessors
Last Updated: September 22, 2026
1. Overview
Ominiflow is built with GDPR in mind — cookie consent on our marketing site, documented privacy practices, and a Data Processing Agreement available for EU customers. When you use Ominiflow’s WhatsApp Business API platform, you typically act as a data controller (or processor for your own customers), and Ominiflow Enterprises acts as a data processor for personal data processed on your behalf through the service.
This page summarizes our processor commitments and lists current subprocessors. For a signed Data Processing Agreement (including Standard Contractual Clauses where needed), email .
2. Roles & scope
- Controller: your business (the Ominiflow customer).
- Processor: Ominiflow Enterprises.
- Services in scope: web dashboard at whatsapp.ominiflow.com, APIs, mobile apps, and related support used to send/receive WhatsApp messages and manage conversations.
- Typical data: end-user phone numbers, message content/metadata, contact/CRM fields you sync, agent account details, and technical logs needed to operate the service.
3. Processor commitments
Subject to a signed DPA and our Terms of Service, Ominiflow will:
- Process personal data only on documented instructions from you (including configuration of the platform).
- Ensure persons authorized to process the data are bound by confidentiality.
- Implement appropriate technical and organizational measures (see our Security Policy; ISO/IEC 27001:2022 certified).
- Engage subprocessors only under written terms that provide equivalent protections, and keep this list reasonably up to date.
- Assist with data subject requests, DPIAs, and breach notifications as required by applicable law and the DPA.
- Delete or return personal data after the end of providing services, subject to legal retention needs.
- Make available information reasonably necessary to demonstrate compliance and allow audits as agreed in the DPA.
4. International transfers
Ominiflow is based in India. Depending on your configuration and the subprocessors below, personal data may be processed in India, the United States, the EEA, or other regions. Where GDPR / UK GDPR requires a transfer mechanism, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) with relevant providers, or other lawful transfer tools.
5. Current subprocessors
These providers may process personal data to deliver the Ominiflow platform. Website analytics/marketing vendors used only on ominiflow.com (and gated by cookie consent) are listed in our Cookie Policy.
| Subprocessor | Purpose | Location / notes |
|---|---|---|
| Meta Platforms, Inc. (WhatsApp Cloud API) | Message delivery, media, template messaging | Global (Meta infrastructure) |
| Cloudways / hosting infrastructure | Application hosting, databases, backups | Configured cloud regions |
| Google Firebase (FCM) | Android push notifications | Google Cloud |
| Apple Push Notification service | iOS push notifications | Apple |
| Transactional email / SMTP provider | Service emails (alerts, receipts, support) | Provider region |
We may update this list when we add or replace providers. Material changes will be reflected on this page. Enterprise customers with a signed DPA may receive notice as agreed in that contract.
6. Your responsibilities
- Capture and document a lawful basis (including WhatsApp opt-in) before messaging end users.
- Configure retention, agent access, and integrations appropriately for your use case.
- Not submit special-category data unless you have a lawful basis and instruct us accordingly.
- Respond to end-user rights requests relating to your messaging; we will assist as processor.
7. Related documents
8. Contact / request a signed DPA
Privacy & legal:
Company: Ominiflow Enterprises, 18 Tarani Colony, Dewas, Madhya Pradesh 455001, India. GSTIN: 23BMKPN8756M1ZA.