WHATSAPP CONSENT, OPT-IN & MESSAGING POLICY
(Client-facing — binding on every Client)
Document key: WA_CONSENT · Version: 2.0
8.1 The allocation of responsibility, stated plainly
You, the Client, are the Data Fiduciary for every Recipient you message. Wapzio is only the technical pipe. Consent is your obligation, your evidence and your liability. If a Recipient complains, a regulator asks, or a court is approached, you must produce the consent record. Wapzio will produce its logs showing what you sent and when — it cannot produce a consent it never obtained.
8.2 What a valid opt-in must look like
A valid opt-in under section 6 of the DPDP Act must be:
| Requirement | Meaning |
|---|---|
| Free | Not a condition of an unrelated service |
| Specific | Tied to a named purpose and category |
| Informed | Preceded by a s.5 notice identifying you and the purpose |
| Unconditional | Not bundled with other consents |
| Unambiguous, by clear affirmative action | An unticked box the Recipient ticks; a button the Recipient presses; a keyword the Recipient sends. Not a pre-ticked box, silence, inactivity, or continued browsing |
| Withdrawable | With the same ease as it was given |
Recommended opt-in wording (adapt and version it):
"I agree to receive [order updates / appointment reminders / promotional offers] from [Your Business Legal Name] on WhatsApp at the number I have provided. I can stop these at any time by replying STOP. [Link to your privacy notice]."
8.3 Evidence you must retain for every Recipient
For each opt-in, retain and be able to produce within 48 hours:
- Recipient identifier (phone number in E.164)
- Purpose and category of consent
- Exact consent wording and its version
- Source type — web form, in-store QR, WhatsApp keyword, checkout, IVR, physical form
- Source URL, campaign ID or form ID
- Timestamp with timezone
- IP address and user agent, where lawfully collected
- Proof reference — form submission ID, screenshot, scanned form, recording ID
- Withdrawal timestamp and suppression status, if any
Wapzio's Consent Centre provides fields for all of the above. Populating them accurately is your obligation; Wapzio does not verify them.
8.4 Prohibited sources
Purchased, rented, scraped, harvested, appended or exchanged lists. Contacts obtained from a third party without an opt-in specific to you. Numbers derived from public directories, social media scraping, or data brokers. Numbers re-imported after suppression without a fresh, documented opt-in.
8.5 Opt-out
You must: honour STOP, UNSUBSCRIBE, and equivalent keywords in English and the language of the message; process withdrawal within 72 hours; add the Recipient to your suppression list permanently; and never message again absent a fresh opt-in. Wapzio's suppression list is enforced at send time and cannot be overridden by the Client.
8.6 Frequency and quality
Maintain a reasonable frequency consistent with the consented purpose. Monitor your quality rating in the dashboard. A Red rating, a block rate above 2%, or a spike in reports triggers automatic pause under the AUP.
8.7 On complaint — the 48-hour rule
If Wapzio receives a complaint, a Meta notice, or a legal notice relating to your messaging:
- Wapzio raises a case and may immediately pause sending on the affected number or campaign.
- Wapzio requests your consent evidence for the affected Recipients.
- You must produce it within 48 hours.
- If produced and adequate, sending is restored subject to risk assessment.
- If not produced within 48 hours, Wapzio will treat the messaging as having been sent without consent, will maintain the suspension, and will record that finding. That record will form part of Wapzio's evidence in any subsequent proceeding.
8.8 Acknowledgement
Before connecting a WhatsApp number, you must affirmatively acknowledge, and this acknowledgement is logged with your user ID, timestamp and policy version:
☐ I confirm that [Client Legal Name] has obtained and holds valid, specific and documented consent from every Recipient it will message through Wapzio; that no contact was obtained from a purchased or scraped list; that I will produce consent evidence within 48 hours of request; and that [Client Legal Name] accepts full responsibility and will indemnify Anantkamal Software Labs for any claim, complaint, penalty or proceeding arising from messages sent through this account.