This Privacy Policy describes how SHPS SHUGARINGI TKBILI EPILATSIA ("we," "us," or "our") collects, uses, stores, and shares personal data in connection with our WhatsApp Business Platform service (the "Platform") — a messaging automation and shared-inbox service that we provide to other businesses ("Client Businesses") through the WhatsApp Business Platform (Cloud API) operated by Meta.
This policy is provided in English. Translations into other languages may be provided for convenience; in case of any discrepancy, the English version prevails.
Client Businesses use the Platform to communicate with their own customers over WhatsApp. On their instruction, the Platform:
Where a Client Business continues to use the WhatsApp Business app on the same phone number, the Platform also receives copies of messages that the Client Business's own employees send from that app, so that the automated assistant stops replying once a human has taken over.
For all personal data of a Client Business's customers, the Client Business is the data controller and we are a data processor acting solely on its documented instructions. We do not decide why or how that data is used; we do not use it for our own purposes.
If you are a customer who messaged a Client Business, your rights — access, correction, deletion, objection — are exercised against that Client Business. You may also write to us at the address in section 1 and we will forward your request to the relevant Client Business without undue delay, and assist them in answering it.
We are the controller for the limited data we need in order to run the Platform as a business: the name, business email, phone number and role of the Client Business's administrators and employees who hold accounts in the Platform, their authentication data, and technical logs of their use of the Platform.
| Category | Examples |
|---|---|
| Identifiers | WhatsApp phone number and/or Business-Scoped User ID (BSUID) assigned by Meta |
| Profile data | WhatsApp profile name, language of the conversation |
| Message content | Text, images, documents, audio and other media sent to or by the Client Business |
| Message metadata | Message identifiers, timestamps, delivery and read status, which employee replied |
| Enquiry data | What the customer asked about — for example a product, size or branch — and any details the customer volunteers in the conversation |
We do not ask customers for payment card data, government identifiers or health data, and the Platform is not intended to process special categories of personal data. Customers should not send such data in a WhatsApp message.
Personal data described in section 4.1 reaches us from Meta Platforms Ireland Limited / Meta Platforms, Inc. through the WhatsApp Business Platform (Cloud API), as a result of a customer messaging the Client Business, or of the Client Business messaging its customer. We do not purchase contact data and we do not collect it from any other source.
| Purpose | Legal basis |
|---|---|
| Delivering the messaging service the Client Business has contracted for | Performance of our contract with the Client Business; for the customer, the controller is the Client Business and relies on its own basis |
| Generating automated replies and product answers | Same as above |
| Routing conversations to the right employee or branch | Same as above |
| Sending notifications the Client Business has chosen to send | The Client Business's own legal basis, normally consent for marketing notifications |
| Security, abuse prevention, audit logging | Our legitimate interest in operating a secure service, and our legal obligations |
| Managing Platform accounts of employees | Performance of our contract with the Client Business |
Replies are generated with the help of a large language model provided by a third-party artificial-intelligence provider under a written contract. To produce a reply, the content of the current conversation and relevant business data of the Client Business — such as product availability — are transmitted to that provider.
We share personal data only with:
Each sub-processor is bound by a written contract with confidentiality and data-protection obligations. We do not sell personal data, we do not share it for advertising purposes, and we do not disclose it to any other third party except where required by law.
Data of each Client Business is stored separately and is accessible only to that Client Business and to authorised personnel of ours acting on its instructions. One Client Business can never see the conversations, customers or business data of another.
We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, access control by role with least-privilege defaults, separate credentials per Client Business, hashed passwords, revocable sessions, audit logging of significant actions, and restriction of access to personal data to personnel who need it to operate the service.
We are established in Georgia. Personal data may be processed by the sub-processors listed in section 8 on servers located outside Georgia, including in the European Economic Area and the United States. Where required, such transfers are made under the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.
Depending on the law applicable to you, you may have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. You may also lodge a complaint with your competent supervisory authority.
If you are a customer of a Client Business, please address your request to that business; see section 3.1. If you are a Platform account holder, address it to us using the contact details in section 1. We respond within 30 days.
Instructions for requesting deletion of your data are published at Data Deletion Instructions. A request concerning a conversation with a Client Business is forwarded to that business, which decides on it as the controller; we then carry out the deletion on its instruction.
Our use of data obtained from the WhatsApp Business Platform is governed by the Meta Platform Terms, the WhatsApp Business Solution Terms and the Terms for Service Providers. We use Platform data only to provide the service described in this policy to the Client Business from whose WhatsApp Business Account it originates, and for no other purpose.
We may update this policy. The date at the top of the page shows when it was last changed. Material changes affecting Client Businesses are communicated to them in advance.
Questions about this policy, or about how the Platform handles personal data, may be sent to tkbiliepilacia@gmail.com, or by post to the registered address in section 1.