Platform Privacy Policy

1. Who we are and what this policy covers

This policy explains how Mediaposte Martech SRL processes personal data through its sales communication platform (the "Platform"). The Platform connects a business customer's WhatsApp Business numbers and email mailboxes, uses AI to turn conversations into tasks, order cards and summaries, and gives the customer's team an assistant they can message on WhatsApp.

Mediaposte Martech SRL is part of Groupe La Poste. VAT ID RO40242453, Trade Registry ID J40/17243/2018. Address: Siriului Street No. 42-46, 3rd floor, 014354 Bucharest, Sector 1, Romania.

This policy covers the Platform only. Our website Privacy Policy covers visits to our public website.

We have two roles under the GDPR:

For conversation data (WhatsApp messages, emails, contacts and everything the Platform derives from them), we are a processor. The business customer that connects its accounts is the controller, and we process that data only on its documented instructions, under a Data Processing Agreement (DPA) that meets Article 28 GDPR.
For data about the people who hold Platform accounts (customer administrators, managers and sales agents), for billing, and for security and abuse prevention, we are the controller.
is used only to provide the Platform to the business that connected it;
is never sold, licensed or shared with data brokers or advertisers;
is never used to build or augment user profiles, or for any purpose the Meta Platform Terms or WhatsApp Business policies prohibit;
is kept separate for each customer and is never visible to other customers.

If you exchanged messages with a business that uses the Platform, that business decides how your data is used, so contact it first. We can also forward your request to it (see section 7).

2. Data we process

Category	What it includes	Source	Our role
Account data	Name, work email, phone number, role, company, login and access logs	The customer's administrator or the user	Controller
WhatsApp data	Business phone number and WABA identifiers, contact names and phone numbers, message content (text, media, documents, voice notes), timestamps, delivery status, and chat history shared at onboarding	WhatsApp Business Platform (Cloud API), including messages sent from the WhatsApp Business app on numbers connected in coexistence mode	Processor
Email data	Sender, recipients, subject, body, attachments and metadata of messages in connected mailboxes	Google Workspace (Gmail API) or Microsoft 365 (Microsoft Graph), as authorized by the customer's administrator	Processor
Derived data	Tasks, order cards, conversation summaries, classifications and search indexes the Platform creates from WhatsApp and email data	Generated by the Platform	Processor
Assistant data	Questions users send to the Platform's WhatsApp assistant and its answers	Platform users	Processor (content), Controller (usage logs)
Billing data	Company details, billing contact, invoices	The customer	Controller
Technical data	IP address, device and browser data, error and security logs	Automatically collected	Controller

We do not ask for special categories of data (Article 9 GDPR), and business customers must not use the Platform to process them. Such data may still appear in message content, so we treat all message content as confidential.

WhatsApp does not share group chats or calls with the Platform, so we do not process them.

3. How we use data and on what legal basis

Purpose	Data	Legal basis
Provide the Platform to the business customer: ingest messages and emails, show conversation timelines, create tasks and order cards, send notifications, answer assistant questions	WhatsApp, email, derived and assistant data	Customer's instructions under the DPA; the customer determines its own legal basis as controller
Create and manage user accounts, authenticate users, apply role-based access	Account data	Performance of a contract (Art. 6(1)(b))
Onboard WhatsApp numbers and mailboxes on the customer's behalf	Account, WhatsApp and email identifiers	Performance of a contract (Art. 6(1)(b))
Billing and accounting	Billing data	Contract and legal obligation (Art. 6(1)(b), (c))
Security, fraud and abuse prevention, troubleshooting	Technical data, access logs	Legitimate interest (Art. 6(1)(f))
Service communications (incidents, changes, policy updates)	Account data	Contract and legitimate interest

AI processing

The Platform sends conversation content to large language model (LLM) providers to extract tasks and orders, summarize conversations and answer assistant questions. These providers are our sub-processors, and their data processing terms forbid them to use customer data to train their models. We do not use customer conversation data to train our own models or anyone else's.

AI output can be wrong, so the Platform creates order cards and tasks as drafts that a person confirms. The Platform makes no decisions with legal or similarly significant effects on individuals (Article 22 GDPR).

We do not sell personal data. We use conversation data only to provide the Platform to the customer that connected it, and never for advertising or marketing profiles.

4. Data from Meta, Google and Microsoft

WhatsApp Business Platform (Meta)

We access a customer's WhatsApp Business Account only after the customer's administrator completes Meta's Embedded Signup and grants our app access. We use the whatsapp_business_management and whatsapp_business_messaging permissions only to onboard and manage the customer's phone numbers and message templates, to send and receive messages on the customer's behalf, and to show those messages in the customer's own workspace.

Data we receive from Meta:

A customer can disconnect a number at any time from the WhatsApp Business app or WhatsApp Manager, and our access ends when it does.

Google Workspace

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide user-facing Platform features to the customer that authorized it. We do not use it for advertising, and no person reads it except with the customer's consent, for security investigations, or where the law requires it.

Microsoft 365

The customer's administrator grants access to mailboxes through admin consent and can revoke it at any time in Microsoft Entra ID. The limits that apply to Google data apply here too.

5. Sharing, sub-processors and international transfers

We share personal data only with the sub-processors below, under written data processing terms, and with authorities where the law requires it.

Sub-processor	Purpose	Location
Meta Platforms Ireland Ltd.	WhatsApp Business Platform (Cloud API) messaging	EU / global
[Hosting provider, to confirm]	Application hosting, database and backups	EU
[LLM provider, to confirm]	AI extraction, summaries and assistant answers	[to confirm]
Google LLC / Microsoft Ireland Operations Ltd.	Email access, only for customers who connect these mailboxes	EU / global
[Email notification provider, to confirm]	Transactional emails to users	[to confirm]

You can also request the current list from dpo@mediaposte-martech.com. As the DPA sets out, we inform business customers before we add or replace a sub-processor.

We store Platform data in the European Union. When a sub-processor transfers data outside the EEA, we rely on an adequacy decision (including the EU-US Data Privacy Framework if the recipient is certified) or on the European Commission's Standard Contractual Clauses, with supplementary measures where needed.

6. Retention, deletion and security

Data	Kept for
WhatsApp, email, derived and assistant data	The retention period the customer sets in the Platform; by default while the subscription is active
All customer data after the contract ends	Deleted within 30 days, and from backups within a further 30 days
Account data	While the account is active, then deleted within 30 days
Billing data	As long as Romanian accounting and tax law requires (currently up to 10 years)
Security and access logs	Up to 12 months

Our Data Deletion Instructions page explains how to have data deleted, including what happens when you disconnect WhatsApp, Google or Microsoft access.

Security

We encrypt data in transit (TLS) and at rest. Each customer's data is logically isolated, and access inside a workspace follows user roles: agents see their own conversations and managers see their team's. Only named staff can access production data, they must use multi-factor authentication, and we log that access. If a personal data breach occurs, we notify affected customers without undue delay so they can meet their own obligations.

7. Your rights and how to contact us

Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on it.

If you use the Platform, write to our DPO. We answer within one month, and may extend that by two months for complex requests.

If you messaged or emailed a business that uses the Platform, that business is the controller, so contact it first. If you write to us instead, we forward your request to the business within 5 working days and help it respond.

Our Data Protection Officer is Catalin Raescu, dpo@mediaposte-martech.com, Mediaposte Martech SRL, Siriului Street No. 42-46, 3rd floor, 014354 Bucharest, Sector 1, Romania.

You can complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at www.dataprotection.ro, or to the supervisory authority in the EU country where you live or work.

We post updates to this policy on this page with a new date, and notify business customers of material changes by email at least 30 days before they apply.