Data Processing Agreement
Version 2.0 | Publish date: 01.09.2026
In the course of providing PROVIDER Services as defined in the Agreement, it is necessary for PROVIDER, hereinafter referred to as “Infobip” or “PROVIDER”, to process certain personal data on behalf of the CLIENT, who may act as a controller or as a processor of personal data as defined under the Applicable Data Protection Law.
If and to the extent the Parties’ relationship relates to the transmission of communications, routing, and connectivity services, and where each Party independently determines the purposes and means of processing, the Parties shall be treated as independent controllers with respect to that processing, and this DPA shall not apply to, or govern, that relationship.
The Parties have entered into this Data Processing Agreement (hereinafter: “DPA”), which supplements the Agreement the Parties have entered into for the provision of the Services by PROVIDER, and agree as follows:
- a) “Agreement” shall mean any contract, agreement, terms and conditions, or other legally binding agreement entered into between PROVIDER and CLIENT, pursuant to which PROVIDER provides PROVIDER Services.
- b) “Applicable Data Protection Law” shall mean all laws and regulations applicable to the processing of personal data under this DPA, including, where applicable, the GDPR (General Data Protection Regulation (EU) 2016/679), the UK GDPR, the UK Data Protection Act 2018, and any laws and regulations implementing the foregoing, as amended or superseded from time to time.
- c) “US Privacy Law” shall mean all laws and regulations of the United States applicable to the processing of personal data, including, where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act (“CPA”); the Utah Consumer Privacy Act (“UCPA”); the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (“CTDPA”); the Telephone Consumer Protection Act (“TCPA”); the Controlling the Assault of Non-Solicited Pornography And Marketing Act (“CAN-SPAM”); the Electronic Communications Privacy Act; Massachusetts Gen. Law Ch. 93H, and any laws and regulations implementing the foregoing, as amended or superseded from time to time.
- d) “Personal Data” shall mean any information relating to an identified or identifiable natural person (hereinafter: “Data Subject”) and other personal information as defined by Applicable Data Protection Law..
- e) “PROVIDER Services” shall have the meaning ascribed to it in the Agreement, to the extent where the provision of PROVIDER Services implies the processing of Personal Data on behalf of the CLIENT as described in Annex 1.
- f) The terms used in this DPA, such as (but not limited to) “processing”, “controller”, “processor”, “third party”, “personal data breach” and “technical and organizational measures”, shall have the meaning ascribed to them in the Applicable Data Protection Law.
Any capitalized term not defined in this DPA shall have the meaning ascribed to it in the Agreement concluded between the Parties.
- 2.1 If and to the extent that PROVIDER will be processing Personal Data on behalf of the CLIENT in the course of the performance of PROVIDER Services, an overview of the nature, purposes, and duration of the processing, types of Personal Data, categories of Data Subjects, and other details regarding the processing are provided in Annex 1, insofar as they are not already described in the Agreement.
- 3.1 The CLIENT confirms and ensures its compliance with Applicable Data Protection Law in its use of PROVIDER Services and confirms that its processing of Personal Data as specified under the Agreement and this DPA is lawful, fair, and transparent in relation to the Data Subjects.
- 3.2 The CLIENT shall be solely responsible for assessing whether Personal Data can be processed lawfully and for safeguarding the rights of the Data Subjects so that PROVIDER can provide the agreed PROVIDER Services in a way that does not violate any legal regulations, including Applicable Data Protection Law.
-
3.3 In particular, the CLIENT is responsible:
- for providing Data Subjects with a transparent privacy notice that meets the requirements of the Applicable Data Protection Law, including adequate notice of engaging PROVIDER as a processor, and
- for ensuring that the processing of Personal Data is based on the appropriate legal basis (for example, by collecting consents).
-
4.1 Permitted purposes
- 4.1.1 PROVIDER shall process Personal Data in the context of the concluded Agreement, only to the extent required, and in the appropriate way necessary to provide PROVIDER Services to the CLIENT under the Agreement (including this DPA), or as necessary to comply with applicable law, or as otherwise upon agreed in writing. The CLIENT acknowledges that, in accordance with applicable law, the PROVIDER may act as a controller for certain limited purposes (including, for example, in relation to product development and improvement, data analytics and fraud prevention and security). The Agreement, including this DPA and its annexes, along with the CLIENT’s configuration of or use of any settings, features, or options in the PROVIDER Service (as the CLIENT may be able to modify from time to time) constitute the CLIENT’s complete and final instructions to PROVIDER in relation to the processing of Personal Data (the “Permitted Purposes”).
-
4.2 Instructions
- 4.2.1 PROVIDER shall process Personal Data in accordance with the Agreement, this DPA, and Applicable Data Protection Law and in a manner consistent with the documented instructions of the CLIENT, including (i) to provide the PROVIDER Services, (ii) as permitted under the Agreement, including the Permitted Purposes, (iii) in accordance with applicable law and (iv) other reasonable instructions of the CLIENT. PROVIDER shall not process Personal Data (i) for purposes other than those set forth in the Agreement, (ii) in a manner inconsistent with the terms and conditions set forth in this DPA or any other documented instructions provided by the CLIENT, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so under mandatory law or a data protection authority to which PROVIDER is subject. The CLIENT hereby instructs PROVIDER to process Personal Data in accordance with the foregoing and as part of any processing initiated by the CLIENT in its use of the PROVIDER Services. The CLIENT shall ensure that its instructions are lawful, and that PROVIDER’s processing of Personal Data will not cause PROVIDER to violate any applicable law, regulation, or rule, including the Applicable Data Protection Law.
- 4.2.2 In the event that a mandatory law prevents PROVIDER from complying with such instructions or imposes a legal requirement on PROVIDER to process Personal Data, PROVIDER shall inform the CLIENT in writing of such a legal requirement before carrying out the relevant processing activities, unless PROVIDER is prohibited under that law from informing the CLIENT of such processing.
- 4.2.3 PROVIDER shall immediately inform the CLIENT if, in its opinion, an instruction infringes Applicable Data Protection Law. PROVIDER shall be entitled to suspend performance of such an instruction until it is clarified or changed by the CLIENT.
-
4.3 Confidentiality
- 4.3.1 PROVIDER shall treat all Personal Data as confidential and it shall ensure the reliability of all its employees, agents, and/or approved sub-processors engaged in the processing of Personal Data.
- 4.3.2 PROVIDER shall ensure that access to Personal Data is available only to those PROVIDER’s employees and other persons operating on behalf of PROVIDER who are under confidentiality obligations with respect to Personal Data and who have received appropriate training.
-
4.4 Security of Personal Data
-
4.4.1 PROVIDER warrants that it maintains and shall continue to maintain adequate security measures (technical and organisational) to protect Personal Data against accidental loss, destruction, damage, alteration, unauthorized disclosure of, or access to, and against all other unlawful forms of processing, considering (i) the nature, scope, context, and purposes of the processing, (ii) risks posed to Data Subjects, (iii) the state-of-the-art, and (iv) implementation expenses, including, inter alia, as appropriate:
- the pseudonymisation and/or encryption of Personal Data when possible/appropriate;
- the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
- the ability to restore the availability of and access to Personal Data in a timely manner in the event of a physical or technical incident;
- an established process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures;
- measures to identify vulnerabilities with regards to the processing of Personal Data in systems used to provide PROVIDER Services to the CLIENT;
- other reasonable security measures agreed upon by the Parties.
A specification of technical and organisational measures implemented by PROVIDER is available at https://www.infobip.com/assets/downloads/Technical_and_organisational_measures.pdf, and a list of certifications is available at https://www.infobip.com/certificates.
- 4.4.2 At the request of the CLIENT, PROVIDER shall demonstrate the measures it has taken pursuant to this Article, allowing the CLIENT to audit and test such measures in accordance with Article 4.7. of this DPA.
- 4.4.3 The CLIENT acknowledges that the PROVIDER Services include certain features and functionalities that PROVIDER requires or recommends, as a minimum standard, to the CLIENT to implement and use since those may impact the security of the data processed by the CLIENT’s use of the PROVIDER Services, such as, encryption of communications content, availability of multi-factor authentication on the CLIENT’s account, device fingerprinting IP whitelisting, or usage of TLS encryption and secure file transfer protocol (SFTP). The list of security obligations and minimal recommendations, maintained by PROVIDER in accordance with applicable best practices, is available to the CLIENT at https://www.infobip.com/docs/essentials/security-recommendations. The CLIENT is responsible for properly configuring PROVIDER Services and using the available features and functionalities to maintain the appropriate level of security considering the nature of the data processed by the CLIENT in its use of PROVIDER Services. The CLIENT shall be held solely liable for any security incident or Personal Data Breach occurring as a result of not adhering to PROVIDER’s recommended security measures.
- 4.4.4 The PROVIDER will perform the proper security activities to prevent and identify illicit use of CLINET’s account and PROVIDER’s systems. The PROVIER will notify the CLIENT when it detects a suspicious illicit activity affecting its account.
- 4.4.5 The Parties acknowledge that security requirements are constantly changing, and that effective security requires frequent evaluation of and regular improvements to outdated security measures. When necessary, PROVIDER therefore ensures it will tighten, supplement, and improve these measures in order to maintain compliance with the requirements set out in this DPA. The Parties will negotiate the cost in good faith, if there is any, to implement material changes required by specific updated security requirements set forth in the Applicable Data Protection Law or by the supervisory authorities of the competent jurisdiction.
- 4.4.6 Where an amendment to the Agreement is necessary in order to execute the CLIENT’s instruction to PROVIDER to improve security measures, as may be required by changes in Applicable Data Protection Law from time to time, the Parties shall negotiate an amendment to the Agreement in good faith.
-
4.4.1 PROVIDER warrants that it maintains and shall continue to maintain adequate security measures (technical and organisational) to protect Personal Data against accidental loss, destruction, damage, alteration, unauthorized disclosure of, or access to, and against all other unlawful forms of processing, considering (i) the nature, scope, context, and purposes of the processing, (ii) risks posed to Data Subjects, (iii) the state-of-the-art, and (iv) implementation expenses, including, inter alia, as appropriate:
-
4.5 Responding to Data Subject and third-party requests
- 4.5.1 In the event that PROVIDER receives a request, complaint, enquiry, or communication from a Data Subject, supervisory authority, or third party (hereinafter: “notifications”) which relates to the processing of Personal Data or to the CLIENT’s compliance with the Applicable Data Protection Law or this DPA, PROVIDER will where known by PROVIDER at the time of such notification, no later than within five () working days. Unless obliged to do so by mandatory laws, PROVIDER shall not respond to any such notification without the CLIENT’s prior written consent, except to confirm that such a request relates to the CLIENT. PROVIDER will assist the CLIENT by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the CLIENT’s obligations laid down in the Applicable Data Protection Law to respond to such notifications from Data Subjects.
-
4.6 Assistance with the CLIENT’s compliance
- 4.6.1 Taking into account the nature of processing and the information available to PROVIDER, PROVIDER shall provide the CLIENT, insofar as this is possible and at the CLIENT’s written request, with all information required for the CLIENT to comply with statutory obligations under Applicable Data Protection Law (in particular, the obligations necessary to ensure the CLIENT’s compliance with security of processing, personal data breach notification, data protection impact assessment, and prior consultations with supervisory authorities), and will assist the CLIENT, insofar as reasonable, in meeting these statutory obligations.
-
4.7 Information and audit
- 4.7.1 CLIENT may request information related to PROVIDER’s processing of Personal Data, if necessary to confirm PROVIDER’s compliance with this DPA and Applicable Data Protection Law, in the form of a report or by conducting an audit as stipulated under conditions set out in point 14. (Compliance) of PROVIDER’s Information security terms.
- 4.7.2 Notwithstanding the previous, the Parties agree that the CLIENT may require information on PROVIDER’s compliance with this DPA and Applicable Data Protection Law when the CLIENT is expressly requested or required to provide such information to its supervisory authority, and it may conduct an audit at any time in the event of a confirmed Personal Data Breach.
-
4.8 Personal Data Breach notification
- 4.8.1 In the case of a Personal Data Breach as defined by Applicable Data Protection Law, and to the extent required by such Law, PROVIDER shall, without undue delay after having become aware of it, notify the CLIENT of the Personal Data Breach. PROVIDER shall cooperate with the CLIENT and shall make all reasonable efforts to identify and remediate the cause of such Personal Data Breach.
-
4.8.2 Such notification shall be sent to the CLIENT at the e-mail address, specified in Annex 1, and shall include, at the time of notification or as soon as possible after notification:
- the description of the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects concerned as well as the categories and estimated number of Personal Data records concerned;
- the name and contact details of the data protection officer or other contact point for further relevant inquiries;
- a description of the likely consequences of the Personal Data Breach;
- a description of the measures taken or proposed to be taken to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects;
- any other information if mandatory under Applicable Data Protection Law.
- 4.8.3 The CLIENT, as the controller, is solely responsible and authorised to notify the relevant supervisory authorities, and if applicable, the Data Subjects, of the Personal Data Breach. Therefore, unless required by mandatory law, PROVIDER shall not disclose or publish any statement, communication, notice, press release, or report regarding a Personal Data Breach nor notify Data Subjects or supervisory authorities without the CLIENT’s prior written consent.
-
5.1 The CLIENT agrees that PROVIDER engages processors (sub-processors) already listed at https://www.infobip.com/policies/processors and authorizes PROVIDER to engage further processors (sub-processors) to carry out specific processing activities on behalf of the CLIENT, under the conditions that:
- PROVIDER maintains an up-to-date list of its sub-processors at https://www.infobip.com/policies/processors, and informs the CLIENT of any addition or replacement within the sub-processors list, providing the CLIENT with an opportunity to object to such changes. The Parties agree that the CLIENT will subscribe to notifications of changes within the sub-processors list, and PROVIDER shall notify the CLIENT of any intended changes within the sub-processors list that affect the CLIENT at least 30 (thirty) calendar days before the change;
- The CLIENT has not objected to the change within the sub-processors list within the period of 30 (thirty) calendar days from having received PROVIDER’s written notification, in which case it will be presumed that approval for the change has been obtained;
- PROVIDER has imposed on the sub-processor data protection obligations not less onerous than those contained in this DPA, to the extent applicable to the nature of the services provided by such sub-processor by way of a written contract or other legal act according to the Applicable Data Protection Law.
- 5.2 The CLIENT may object to the use of a new sub-processor where there are reasonable grounds to believe that the new sub-processor will be unable to comply with the Agreement/this DPA. The CLIENT acknowledges that the inability to use a particular new sub-processor may result in a delay in the performing of PROVIDER Services, in an inability to perform PROVIDER Services, or in increased fees. In such a case, the Parties will either execute a written amendment to the Agreement/this DPA or terminate the Agreement/this DPA under the terms of the Agreement, whereby neither Party shall be entitled to reimbursement or compensation from damages arising from, or resulting from, the termination under this Article.
- 5.3 Where the sub-processor engaged by PROVIDER fails to fulfil its data protection obligations, PROVIDER shall remain fully liable to the CLIENT for the performance of the sub-processor’s obligations.
- 5.4 To the extent required by Applicable Data Protection Law, the CLIENT may request that PROVIDER audits the sub-processor or provides confirmation that such an audit has occurred to ensure compliance with its obligations arising from the contractual relationship as far as processing activities carried out on behalf of the CLIENT are concerned.
- 6.1 When processing under this DPA requires the international transfer of Personal Data, PROVIDER will comply with Applicable Data Protection Law, including, where necessary, the implementation of contractual mechanisms such as standard contractual clauses for data transfers.
- 6.2 Unless otherwise agreed with the CLIENT in writing (including e-mail), PROVIDER shall ensure that Personal Data are stored and processed at the processing systems located in its data centres within the European Union (EU) or European Economic Area (EEA), and any transfer of Personal Data to PROVIDER’s data centres located outside the EU or EEA can be made only upon such an instruction by the CLIENT.
- 7.1 This DPA shall become binding from the moment the Agreement between Parties comes into effect and shall be valid for the duration of the actual provision of PROVIDER Services by PROVIDER.
- 7.2 The termination or expiration of this DPA shall not discharge PROVIDER from its confidentiality obligations pursuant to Article 4.3. of this DPA.
- 7.3 Should PROVIDER be in a material breach of any provision of this DPA, the CLIENT has the right to terminate both this DPA as well as the Agreement for cause, in whole or in part, under the conditions defined in the Agreement.
- 7.4 During the term of the Agreement and/or this DPA, PROVIDER shall retain Personal Data following PROVIDER’s data retention policy and schedule applicable to PROVIDER Services, unless otherwise agreed with the CLIENT. Upon termination of the Agreement and/or this DPA for any reason, and at the CLINET’s decision, Personal Data processed on behalf of the Client will be returned or deletion will be initiated within thirty (30) days as of the termination of this Agreement and/or the DPA. PROVIDER shall not retain any copies of Personal Data unless otherwise required or permitted by mandatory law.
- 8.1 This DPA is an integral part of the Agreement. If there is a conflict between this DPA and the Agreement, the provisions of this DPA will prevail. For all questions not regulated under this DPA, the provisions of the Agreement shall prevail.
- 8.2 Where individual provisions of this DPA are invalid or unenforceable, the validity and enforceability of the other provisions of this DPA shall not be affected.
- 9.1 PROVIDER confirms that the CLIENT’s or CLIENT’s Consumers’ Personal Information are processed, retained, used, and disclosed only as is necessary to provide PROVIDER Services in accordance with the Permitted Purposes and to provide the same level of privacy protection as is required by US Privacy Law. PROVIDER further confirms that it will not retain, use or disclose the CLIENT’s or CLIENT’s Consumers’ Personal Information for any purpose other than the Business Purposes specified in the Permitted Purposes and the Agreement, or as otherwise permitted by US Privacy Law.
- 9.2 PROVIDER will not Sell or Share Personal Information, nor use, disclose, or retain Personal Information for: (i) any purposes outside of the Permitted Purposes unless otherwise permitted by US Privacy Law; or (ii) outside of the direct business relationship between PROVIDER and CLIENT. The Client acknowledges and agrees that the exchange of Personal Data between PROVIDER and CLIENT does not constitute a “sale” or “sharing” of Personal Information and does not form part of any monetary or other valuable consideration exchanged between them with respect to the Agreement or this DPA.
- 9.3 Regarding Consumer rights in the sense of US Privacy Law, the provision of Article 4.5. will correspondingly apply.
- 9.4 The sub-processors PROVIDER relies on when providing PROVIDER Services under the Agreement as stipulated in Article 5 of this DPA are Service Providers in the sense of US Privacy Law. With such Service Providers, appropriate data processing agreements are concluded and impose data protection obligations no less onerous than those contained in this DPA, to the extent applicable to the nature of the services they provide. All the obligations of PROVIDER arising from Article 5 of this DPA regarding sub-processors shall apply accordingly.
- 9.5 Capitalized terms used in the Article 4.9. such as (but not limited to) “Sell”, “Sold”, “Share”, “Shared”, “Personal Information”, “Business Purpose”, “Consumers” and “Service Provider” shall have the meaning as set forth in the US Privacy Law.
- 9.6 PROVIDER certifies that it understands the restrictions set forth in this DPA and will comply with them.
-
9.1 The following Annexes are integral parts of this DPA:
- Annex 1: Details about Personal Data processing
- Annex 2: Data Transfer Agreement (EU Standard Contractual Clauses and UK Addendum). When applicable, if and to the extent the Data Transfer Agreement conflicts with any provision of this DPA, the Data Transfer Agreement shall prevail.
- Annex 3: Supplementary relationship modules
Depending on the product/feature used, specific details about personal data processing are listed at https://www.infobip.com/details-about-personal-data-processing.
Contact details for data protection enquiries:
The CLIENT shall provide to PROVIDER the email address and other contact details for data protection enquiries, including Personal Data Breach notifications. If applicable, the CLIENT shall also provide name and contact details of the CLIENT’s EU representative, in accordance with Article 27 of the GDPR.
The PROVIDER shall store the email address and other contact details of the CLIENT in its systems. Regardless of the forgoing, PROVIDER reserves the right to send Personal Data Breach notifications to the authorised user of the CLIENT’s account (e.g., its related business contacts).
Contact details of PROVIDER:
E-mail: [email protected]
E-mail for personal data breach notifications: [email protected]
In light of Parties processing roles as defined in the DPA and the nature of international data transfer occurring during the provision of PROVIDER Services, the Parties agree that one of the following Data Transfer Agreements (hereinafter: “DTA“) may apply:
- DTA between the CLIENT established in the EU (the data exporter) and the PROVIDER established in the third country (the data importer)
- DTA between the CLIENT established in the UK (the data exporter) and the PROVIDER established in the third country (the data importer)
- DTA between the PROVIDER established in the EU (the data exporter) and the CLIENT established in the third country (the data importer)
This Annex applies only to the extent that the Parties enter into the specific contractual relationship described in the module below, as relevant, and only for the duration of such relationship. Where a module applies and there is any conflict with the rest of the DPA, the module prevails to the extent of the conflict.
3.1 Module A – Partnership Sell With & Partnership Sell Through
For the purpose of Partnership relationship, all references to CLIENT in the DPA shall be read as references to PARTNER, as defined in the Agreement, to the extent necessary.
The Parties acknowledge that the Data Processing Agreement will be applicable only in the scope of a Sell Through Partnership Agreement.
In the scope of a Sell With Partnership Agreement, subject to section PARTNER OBLIGATIONS of the Agreement and where necessary, the Partner will take reasonable actions to conclude a data processing agreement with its client(s) (as defined in the Agreement) before the commencement of the service.
3.2 Module B– Terms & Conditions
Where this DPA forms part of the Terms & Conditions, all references to the CLIENT in the DPA shall have the same meaning as You in those Terms & Conditions, to the extent necessary.
3.3 Module C– iGate
For the purpose of iGate, all references to CLIENT in the DPA shall be read as references to COMPANY, as defined in the Agreement, to the extent necessary.