Privacy Policy

This Privacy Policy explains how ProDokumenty TETIANA DEPUTAT handles personal data: data of visitors to this website, data in email correspondence with us, and data processed in our CRM, which receives WhatsApp messages from the WhatsApp Business Platform on behalf of our business clients. In this policy, "we" and "us" mean ProDokumenty TETIANA DEPUTAT.

1. Who we are

We are the controller of personal data of visitors to this website and of people who write to us by email.

For data that our CRM receives from the WhatsApp Business Platform on behalf of a business client, we are a processor. The controller of that data is the business client whose WhatsApp Business number you exchange messages with (see section 3).

2. Website and email correspondence

Website

This website does not use cookies, analytics, advertising pixels or other tracking, and it does not load content from third parties. The website is hosted by Cloudflare. When you open a page, Cloudflare processes technical data needed to deliver the page and protect the website from abuse, such as your IP address, the address of the requested page, the time of the request and your browser type. We do not use this data to identify visitors.

Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

Email

If you email us, we process your email address, your name if you give it, the content of your message and any other data you include, in order to answer you and handle your matter.

Legal basis: our legitimate interest in answering correspondence and handling matters raised in it (Art. 6(1)(f) GDPR). Providing data is voluntary, but without it we cannot answer you.

3. Data processed in our CRM (WhatsApp Business Platform)

Our business clients connect their WhatsApp Business numbers to our CRM through the WhatsApp Business Platform (WhatsApp Cloud API) provided by Meta. We process this data only on behalf of the business client and on its documented instructions, under a data processing agreement concluded with the business client in accordance with Art. 28 GDPR.

Categories of data

• WhatsApp phone number of the person who exchanges messages with the business;
• WhatsApp profile name;
• content of messages and media files (for example images, documents, voice messages);
• time of messages and their delivery status;
• data of the business client's WhatsApp Business Account: account ID, phone numbers and message templates.

Purposes

• displaying messages in the CRM and sending replies on behalf of the business client;
• technical support for the business client;
• security of the CRM and of the data processed in it.

If you are a customer of one of our business clients

The business you exchange messages with decides how your data is used. Please send requests about your data to that business. You can also write to us at kontakt@tdeputat.xyz: we will pass your request on to the business and help it carry the request out.

4. Recipients and subprocessors

We share personal data only to the extent needed for the purposes above, with:

• Meta Platforms (WhatsApp Business Platform): sending and receiving WhatsApp messages;
• CRM hosting provider: [TODO];
• Cloudflare: hosting of this website;
• our email provider: handling email correspondence.

We may also disclose data to public authorities where the law requires it.

5. Transfers outside the European Economic Area

Meta Platforms and Cloudflare may process data outside the European Economic Area (EEA), including in the United States. Such transfers take place on the basis of the mechanisms provided for in Chapter V GDPR, in particular an adequacy decision of the European Commission (EU–US Data Privacy Framework, for certified companies) or standard contractual clauses approved by the European Commission. [CHECK]

6. How long we keep data

• Email correspondence: as long as needed to handle the matter, and afterwards only as long as needed to establish, exercise or defend legal claims.
• CRM data: for the duration of the agreement with the business client, or shorter if the business client instructs us to delete data. After the business client disconnects the app or the agreement ends, we delete the data within 30 days [CHECK].
• Technical website data processed by Cloudflare: according to Cloudflare's own retention rules.
• Accounting documents: for the periods required by tax and accounting law.

7. Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it;
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• restrict processing;
• data portability;
• object to processing based on our legitimate interest;
• lodge a complaint with the supervisory authority in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).

To use your rights, write to kontakt@tdeputat.xyz. We answer within one month; in cases allowed by the GDPR this period may be extended. For data processed in the CRM, see section 3. How to request deletion is described in the Data Deletion Instructions.

We do not make decisions based solely on automated processing, including profiling.

8. Cookies

This website does not use cookies or similar technologies, and does not use analytics. For this reason it does not show a cookie banner.

9. Changes and contact

We may update this policy. The current version is always on this page, with the date of the last update at the top. Questions about this policy: kontakt@tdeputat.xyz.