Is WhatsApp in your CRM GDPR-compliant?

It can be. GDPR compliance is not a label on a product: it depends on which WhatsApp route you use, on a data processing agreement with every processor, on where the data is stored and for how long, and on your own lawful basis for writing to people. WASync is operated by an EU company, stores customer data on servers in the EU, deletes message content after 90 days and comes with a DPA under Article 28.

This page explains who is responsible for what when WhatsApp conversations land in Bitrix24 or Pipedrive, and what WASync does on its side. It is not legal advice; your data protection officer decides for your company.

Who is responsible for what

WhatsApp Business API or a QR-linked number: the data protection difference

Both routes put the same conversations in your CRM. They differ in the contract behind them.

• WhatsApp Business API. Your company holds a WhatsApp Business Account at Meta and accepts Meta's business terms, which include data processing terms. Messages are sent through the official platform. Marketing and reminder messages outside the 24-hour window go out as templates Meta has approved, to people who opted in. This is the route data protection officers usually prefer, because every party has a documented role.
• QR-linked number. You link the WhatsApp Business app on your phone to WASync the way you link WhatsApp Web. The session runs on WASync's own servers, and no sub-processor sees message content on that path. The underlying account remains an app account under WhatsApp's own terms, so the assessment of that part is yours to make.

If the choice is open, see the comparison of QR and the Business API.

Where the data is stored and how long it is kept

• Location. Customer data is stored on servers in the European Union, at Hetzner Online GmbH in Germany and Finland. Message media sits in object storage with EU jurisdiction.
• Retention. Message content and media older than 90 days are deleted from WASync's storage on a rolling basis. When you connect a number, only conversations active in the previous 90 days are imported.
• After you leave. After cancellation or uninstallation you can export your conversations or ask for an export. Without a request, customer data is deleted within 90 days, and backup copies are overwritten within the same period.
• Security. TLS 1.2 or higher on every connection, credentials and tokens encrypted at rest with AES-256-GCM, each customer portal logically isolated, role-based access for staff.
• Transfers. Where a sub-processor works outside the EU or EEA, the transfer is covered by an adequacy decision or the EU Standard Contractual Clauses. The full list of sub-processors, with purpose and location, is in the DPA.

AI features and your data

AI features are optional and work with your own API key. When you switch on an AI automation you choose the provider (OpenAI, Anthropic, Google or DeepSeek) and connect your own account, so that provider is your processor under your contract, and WASync sends it only the prompt and the CRM fields you configured. WASync has no AI sub-processor of its own.

What remains on your side

1. A lawful basis for each kind of message. Replies to people who wrote first rest on a different basis than marketing messages, which need opt-in.
2. Opt-out that works. A person who asks you to stop must stop receiving messages. In WASync a customer who replies with a stop request is marked as opted out, and templates to that contact are refused; you can still answer when they write to you.
3. A privacy notice that mentions WhatsApp as a channel and names your processors.
4. An entry in your record of processing for WhatsApp conversations, with the 90-day retention at WASync and your own retention in the CRM.
5. No special-category data over the channel (health, for example) without your own basis and safeguards. The service is not designed for it.

The data processing agreement

The DPA is part of the WASync terms, so it applies from the moment you start using the service; there is nothing to sign separately. It follows Article 28: processing only on documented instructions, confidentiality, security measures, help with data subject requests and breach notification, deletion at the end, and audit rights. Read it at wasync.app/dpa. Questions go to [email protected].

Companies that need the service in one specific region, isolated from other customers, can ask for a dedicated environment.

Frequently asked questions

Is the WhatsApp Business API GDPR-compliant?

The API gives you the contractual pieces: your company has its own WhatsApp Business Account and accepts Meta's business terms with data processing terms. Whether your use is compliant still depends on your lawful basis, your opt-in for marketing messages and your agreements with the tools that connect the API to your CRM.

Where does WASync store WhatsApp messages?

On servers in the European Union, at Hetzner in Germany and Finland. Message media is kept in object storage with EU jurisdiction.

How long does WASync keep messages?

Message content and media are deleted after 90 days on a rolling basis. Your CRM keeps what was written to it, under your own retention rules.

Do I need to sign a DPA with WASync?

No separate signature is needed. The DPA is incorporated into the terms and applies when you use the service. It is published at wasync.app/dpa.

Does WASync send my conversations to an AI provider?

Only if you switch on an AI automation and connect your own API key. Then only the prompt and the CRM fields you chose are sent, to the provider you chose.

Is a QR-linked WhatsApp number allowed under the GDPR?

The GDPR does not name products. On a QR-linked number the account remains a WhatsApp Business app account under WhatsApp's own terms, and WASync processes the conversations as your processor. Whether that fits your company is a decision for your data protection officer; many choose the Business API because the roles are documented.