Data Processing Agreement
Last updated: 8 November 2026
1. Scope
This DPA is between Western Star Group LLC ("Company", Data Processor), 302 Washington St., Ste. #150-9852, San Diego, CA 92103, and the business customer. It is incorporated into the Terms of Service for business customers whose use of WebSignals involves personal data subject to the GDPR or UK GDPR (for example employee names, locations and messages entered by your team).
2. Roles and instructions
The Customer is the Data Controller and the Company is the Data Processor of Customer content. the Company processes it only on the Customer's documented instructions (the Terms, this DPA and the Customer's use of the Service) and tells the Customer if an instruction appears to violate law. The subject matter is operating the team status and messaging service; the duration is the subscription term plus the deletion period below; the data is the categories listed in the Privacy Policy.
3. Sub-processors
The Customer gives general authorization for the Company to engage third-party sub-processors. the Company will notify the Customer of any intended changes so the Customer can object on reasonable data protection grounds. Current sub-processors:
| Sub-processor | Purpose | Data |
|---|---|---|
| Stripe | Payments and billing portal | Email, subscription and payment data |
| Twilio | Text alerts (only for users who opted in) | Mobile number, message text |
| Hostinger | Infrastructure hosting | All Service data |
Google ML Kit on-device translation runs on the user's device; Google supplies language packs but does not receive chat text from the Company.
4. Security measures
The Company implements technical and organizational measures (TOMs) ensuring a level of security appropriate to the risk, including encryption in transit, hashed credentials, server-enforced access rules between teams, signed webhooks, audit logging, backups, and confidentiality obligations for personnel with access.
5. Assistance, breaches and deletion
- Data subject requests: the Company will reasonably assist the Customer in responding to requests, and will forward requests it receives directly.
- Personal data breach: the Company will notify the Customer without undue delay, and within 72 hours of becoming aware, with the information it then has.
- Return and deletion: at the end of the Service, the Company will delete or return Customer content within 30 days on request, unless law requires retention.
6. International transfers
Where Customer personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties rely on the Standard Contractual Clauses approved by the European Commission (and the UK Addendum), which are incorporated by reference.
7. Audit rights
The Customer may audit the Company's compliance with this DPA up to once per year, at the Customer's expense, on reasonable notice and subject to strict confidentiality. the Company may satisfy this by providing relevant documentation or reports.
8. Contact
Data protection questions and sub-processor objections: support@westernstargroup.com.