> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unecast.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GDPR Compliance: Using Unecast in the EU Legally

> Learn how Unecast and the WhatsApp Business API keep your customer communication GDPR-compliant.

If your business communicates with customers in the EU, you are legally responsible for how their personal data is handled - including through messaging channels like WhatsApp. Unecast is built from the ground up to meet those obligations, giving you a fully GDPR-compliant communication platform backed by Amazon Web Services (aws-hosted) infrastructure.

## Why GDPR Matters for Business Messaging

Under the General Data Protection Regulation (GDPR), your business acts as the **data controller** for all customer data you collect and process. That responsibility extends to every tool you use for customer communication. If you use a third-party messaging platform, that platform becomes a **data processor** - and you need a valid Data Processing Agreement (DPA) with them to remain compliant under GDPR Article 28.

This means it is not enough to simply communicate with customers over WhatsApp. The platform you use must also handle that data in a privacy-compliant way.

## Why the Standard WhatsApp Business App Is Not GDPR-Compliant

The free WhatsApp Business App is not suitable for commercial customer communication under GDPR. Here is why:

<Warning>
  Using the standard WhatsApp Business App (not the API) for commercial customer communication is legally risky in the EU. Always use the WhatsApp Business API via Unecast for compliant business communication.
</Warning>

* **Accesses the device address book** - WhatsApp reads contact data from the phone it is installed on, creating an uncontrolled transfer of personal data.
* **Collects metadata** - WhatsApp captures metadata about who messaged whom and when, which constitutes personal data under GDPR.
* **Unencrypted automatic backups** - Message backups can be stored without encryption, exposing customer data.
* **Can share data with Meta** - As a Meta product, the WhatsApp Business App can theoretically share data with Meta's broader infrastructure, over which you have no control.

## Why Unecast via the WhatsApp Business API IS GDPR-Compliant

The WhatsApp Business API, accessed through Unecast, separates business communication infrastructure from the consumer app. This architecture, combined with Unecast's own security practices, makes compliant customer communication possible.

<CardGroup cols={2}>
  <Card title="No Device Address Book Access" icon="address-book" href="/features/whatsapp-business">
    The API does not access any device contact list. Customer phone numbers are stored only within your Unecast account, under your control.
  </Card>

  <Card title="Hosted on AWS Infrastructure" icon="server" href="/security/data-privacy">
    All data is stored on secure AWS infrastructure, with data processing agreements in place to meet EU data protection requirements.
  </Card>

  <Card title="Encrypted Messages" icon="lock" href="/features/whatsapp-business">
    WhatsApp messages sent via the API are end-to-end encrypted between you and your customers, the same as the consumer app.
  </Card>

  <Card title="No Training with Client Data" icon="ban" href="/security/data-privacy">
    Unecast never uses your conversation data to train AI models. Your data is yours - period.
  </Card>
</CardGroup>

## Key GDPR Compliance Features

### Data Processing Agreement (DPA)

A DPA is a legally binding contract between you (the data controller) and Unecast (the data processor). It defines what data is processed, for what purpose, and what safeguards are in place. Under GDPR Article 28, you must have a DPA with every processor who handles personal data on your behalf.

### Contact Deletion

If a customer requests erasure of their data (a right under GDPR Article 17), you can delete their contact and all associated data directly from Unecast. Deletion is immediate and permanent.

## Trust & Certifications

Unecast's compliance posture is backed by recognised standards and partnerships:

<CardGroup cols={2}>
  <Card title="Meta Business Partner" icon="certificate" href="/setup/whatsapp-api-setup">
    Unecast is an official Meta Business Partner (Meta Tech Provider), meaning you access the WhatsApp Business API through a verified and trusted provider.
  </Card>

  <Card title="GDPR Compliant" icon="shield" href="/security/data-privacy">
    Unecast platform, processes, and data handling practices are designed and audited for full GDPR compliance.
  </Card>

  <Card title="Proud Sri Lankan company. 7 years in Business." icon="flag" href="/security/data-privacy">
    Unecast is built and operated by BLOOMWIRE (PRIVATE) LTD., headquartered in Colombo, Sri Lanka.
  </Card>

  <Card title="Hosted on AWS infrastructure" icon="database" href="/security/data-privacy">
    All customer data is hosted on aws-infrastructure, ensuring highest security and reliability to our services.
  </Card>
</CardGroup>

***

Have questions about your specific compliance requirements? [Contact the Unecast team](mailto:support@unecast.com) to speak with a compliance specialist.