Privacy policy

This policy describes how personal data is processed on the WhatsApp Business connectivity platform that RELOOP AI LTD ("reloop", "we") operates for the vertical software products it builds. The platform connects business customers' WhatsApp numbers to Meta's WhatsApp Business Platform and routes messages to the right product. How it works is described on the WhatsApp platform page.

It concerns two groups of people: business customers who connect their number to the platform, and end users who exchange WhatsApp messages with those business customers.

Company

RELOOP AI LTD, Private Limited by Shares, registered in England and Wales

Company number

17220313

Registered office

[[INDIRIZZO]]

Telephone

[[TELEFONO]]

Privacy contact

admin@relooptech.ai

[[VERIFICARE: numero di registrazione presso l'Information Commissioner's Office (ICO), se dovuto; eventuale rappresentante nell'Unione europea ai sensi dell'art. 27 GDPR; eventuale responsabile della protezione dei dati (DPO)]]

Business customers: controllers

The companies that connect their WhatsApp number to the platform decide why and how they communicate with their customers. For message data, they are the controllers.

RELOOP AI LTD: processor

We process message data on behalf of business customers, only on their documented instructions and under a data processing agreement (Article 28 GDPR). [[VERIFICARE: accordo sul trattamento in essere con ogni cliente business]]

360dialog: sub-processor

360dialog is the Business Solution Provider (BSP) through which the platform accesses the WhatsApp Business Platform. It processes data as our sub-processor. [[VERIFICARE: ragione sociale e sede di 360dialog, accordo sul trattamento con 360dialog]]

Meta: platform provider

Meta provides the WhatsApp Business Platform through which messages are sent and received, and processes data under its own WhatsApp Business Platform terms. [[VERIFICARE: entità Meta contraente e qualifica di Meta, responsabile o titolare autonomo, per ciascun trattamento]]

For the contact details of business customers' representatives, used to manage the contractual relationship, RELOOP AI LTD acts as controller.

Message content

Text and media (images, audio, video, documents) of the messages exchanged between business customers and end users, including replies to interactive and template messages.

Phone numbers

The WhatsApp number of end users who send or receive messages, and the business number connected to the platform. [[VERIFICARE: trattiamo anche il nome del profilo WhatsApp che la piattaforma trasmette con i messaggi in arrivo]]

WABA and channel identifiers

The identifiers of the WhatsApp Business Account (WABA), the phone number and the business portfolio on Meta, and the internal identifiers that tie each number to the product it is connected to.

Delivery metadata

Message identifier, date and time, direction, delivery status (sent, delivered, read, failed) and any error codes.

Access credentials

The access tokens Meta issues when a business customer completes Embedded Signup, needed to operate on its number. [[VERIFICARE: modalità di conservazione e cifratura dei token]]

Representatives' details

Name, email address and role of the people who manage the account and the contractual relationship on behalf of the business customer.

We do not use this data for advertising or profiling, and we do not sell it. [[VERIFICARE]]

As a processor, we process message data only to provide the service to the business customer:

• connecting its WhatsApp number to the platform through Embedded Signup;
• receiving inbound messages and routing them to the right product;
• sending outbound messages generated by the product;
• recording delivery statuses and keeping the service secure, diagnosable and compliant.

The legal basis for this processing is set by the business customer as controller: typically the performance of a contract with the end user, consent, or legitimate interest. WhatsApp's business messaging rules also require the end user to have agreed to receive messages from the business.

Where we act as controller, for business customers' representatives, the legal bases are the performance of a contract (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c)) and our legitimate interest in keeping the platform secure (Article 6(1)(f)).

The applicable framework is Regulation (EU) 2016/679 (GDPR) and, where applicable, the UK GDPR and the Data Protection Act 2018.

Data is shared only with those needed to provide the service:

• 360dialog, as Business Solution Provider (BSP) and sub-processor;
• Meta, as provider of the WhatsApp Business Platform;
• [[VERIFICARE: fornitore dell'infrastruttura di hosting e database della piattaforma]];
• [[VERIFICARE: eventuali fornitori di modelli di intelligenza artificiale usati dai prodotti per elaborare il contenuto dei messaggi]];
• public authorities, only where required by law.

We inform business customers before engaging a new sub-processor. [[VERIFICARE]]

The platform stores data in: [[TODO: regione di storage da confermare]].

RELOOP AI LTD is established in the United Kingdom. Transfers of data from the European Union to the United Kingdom rely on the European Commission's adequacy decision. [[VERIFICARE]]

Meta and 360dialog may also process data outside the European Economic Area, under their own terms and with the safeguards provided by the GDPR, such as standard contractual clauses or the EU-US Data Privacy Framework. [[VERIFICARE]]

Message content

For the duration of the contract with the business customer, or for the shorter period it specifies. [[VERIFICARE: periodo]]

Delivery metadata and technical logs

[[VERIFICARE: periodo]]

Identifiers and credentials

For as long as the number stays connected to the platform. On disconnection, credentials are revoked and deleted. [[VERIFICARE]]

Representatives' details and contract records

For the duration of the relationship and, afterwards, for the period required by legal, accounting and tax obligations. [[VERIFICARE: periodo]]

When the contract ends, data processed on behalf of the business customer is deleted or returned according to its instructions, subject to retention obligations under the law. [[VERIFICARE: termine]] Meta and 360dialog retain the data they process under their own terms.

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, access limited to the staff who need it, and access logging. [[VERIFICARE]]

Data subjects have the right to access their data, to request its rectification or erasure, to restrict its processing, to object, to receive their data in a portable format and to withdraw consent at any time, without affecting the lawfulness of earlier processing.

For message data, the controller is the business customer: requests should be addressed first to the business you communicated with. If a request reaches us, we forward it without delay to the business customer concerned and help it respond.

Operational instructions for requesting deletion are on the Data deletion page. For any other request: admin@relooptech.ai.

You can always lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali, in the United Kingdom the Information Commissioner's Office (ICO), or the authority of the country where you live or work.

The relooptech.ai website sets no cookies and uses no third-party analytics or tracking tools. The hosting provider may log technical request data, such as IP addresses, for security and operational purposes. [[VERIFICARE: fornitore di hosting e periodo di conservazione dei log]]

Emails we receive are used only to reply.

We may update this policy when the platform or the law changes. The date of the last update is shown at the top of this page; material changes are communicated to business customers. [[VERIFICARE]]