Privacy Policy
Data Privacy Consulting B.V. is committed to protecting your personal data in full compliance with the European General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and global data protection standards.
WhatsApp Business API & Regulatory Compliance Summary
This policy provides full transparency regarding our use of the WhatsApp Business Platform (Cloud API) to engage in high-volume communications, provide automated assistance via our conversational chatbot, and deliver professional consulting services.
STOP in WhatsApp for instant revocation.Table of Contents
Identity & Contact Details of the Data Controller
The entity responsible as Data Controller under Article 4(7) of the General Data Protection Regulation (GDPR) for the processing of your personal data on this website and via our communication channels is:
Company Legal Entity
Data Privacy Consulting B.V.
Registered in the Netherlands
VAT / Tax ID: NL863801249B01
Registered Address
Westplein 12
3016BM Rotterdam
Netherlands
Official Electronic Contact
Privacy & Data Protection: admin@dataprivacy.eu.com
General Inquiries: info@dataprivacy.eu.com
Phone & Official WhatsApp Channel
Telephone: +31 10 890 6650
WhatsApp Business API: +31 10 890 6650
WhatsApp Direct: wa.me/message/SXADX3WNM6FIE1
Overview of Business Operations & Legitimate Scope
Data Privacy Consulting B.V. is a registered Dutch corporate entity specializing in regulatory compliance, technical privacy engineering, and artificial intelligence governance. Our commercial activities include:
GDPR EU Representative
Acting as official legal Article 27 GDPR Representative in the European Union for non-EU enterprises offering goods or services to EU residents or monitoring EU individual behaviour.
AI & Privacy Governance
Delivering AI impact assessments, ethical risk management frameworks, and compliance auditing under the EU AI Act, led by IAPP Certified AI Governance Professionals (AIGP).
Regulatory Consulting
Cross-border compliance advisory across GDPR, Swiss FADP (DSG/LPD), Singapore PDPA, technical architecture reviews, and full-stack privacy-by-design implementations.
WhatsApp Business API & Automated Chatbot Operations
To manage customer communications effectively, handle thousands of inbound service requests, and provide rapid assistance, we utilize the official WhatsApp Business Platform (Cloud API) provided by Meta Platforms Ireland Ltd.
Disclosure of Automated Conversational Agent (Bot)
When you contact our official WhatsApp Business account, you are initially engaged with an automated software assistant (bot). The bot operates to:
- Answer frequently asked questions regarding our GDPR Representative services, fees, and onboarding steps.
- Collect preliminary details (such as your full name, company name, address, and inquiry type) to generate custom service quotes.
- Triage inquiries and route complex regulatory queries to appropriate human specialists.
- Provide immediate status updates, intake confirmation, and booking assistance.
Human Handoff & Escalation Guarantee
The bot does not replace human legal and compliance evaluation. You may request to speak with a human consultant at any point during your conversation by typing keywords such as HUMAN, AGENT, or HELP. Our team will take over the conversation during business hours.
Categories of Personal Data Collected
Depending on how you interact with us (via website forms, email, or our WhatsApp Business API bot), we collect and process the following specific categories of personal data:
1. Phone Number
Your international mobile phone number (MSISDN) provided when initiating contact via WhatsApp or submitted through our contact form. This serves as your messaging endpoint and identifier for all WhatsApp communications.
2. Full Name
Your first and last name, as transmitted in your WhatsApp profile display name or explicitly provided by you during bot intake or form submission. Used to personalize correspondence, verify business identity, and prepare service agreements.
3. Address
Your physical postal address, including street address, city, postal code, and country. Required when onboarding clients for GDPR Article 27 EU Representative appointments, statutory contracts, and compliant fiscal invoicing.
Additional Messaging & Communication Metadata
- Message Content & Attachments: Inquiries, queries, text messages, documents, or screenshots you transmit during chat sessions.
- Opt-In & Consent Records: The exact date, timestamp, method of opt-in, source IP address (for web forms), and consent record verifying your request to communicate.
- Technical Delivery Metadata: Timestamps of message dispatch, delivery receipts, read receipts, and WhatsApp unique message IDs.
- Company & Professional Data: Company name, job title, and company country provided to evaluate representative eligibility.
Purposes of Processing & Legal Bases under GDPR (Article 6)
We process your personal data strictly under lawful bases specified in Article 6(1) of the GDPR. We do not process data for secondary purposes incompatible with the original collection intent.
| Purpose of Processing | Data Processed | GDPR Legal Basis |
|---|---|---|
| Responding to customer inquiries, automated bot assistance, and consulting intake via WhatsApp | Phone number, Full name, Message content, Metadata | Art. 6(1)(b) GDPR Pre-contractual measures & contract performance |
| Formalizing and executing GDPR EU Representative appointments and AI governance contracts | Full name, Address, Phone number, Company details | Art. 6(1)(b) & (c) GDPR Contract execution & legal compliance |
| Sending requested service notifications, account updates, and regulatory alerts via WhatsApp | Phone number, Full name, Opt-in records | Art. 6(1)(a) GDPR Freely given, specific opt-in consent |
| Statutory accounting, fiscal administration, and corporate recordkeeping under Dutch law | Full name, Physical address, Invoices, Contract records | Art. 6(1)(c) GDPR Compliance with legal obligations |
| High-volume message triage, abuse prevention, rate-limiting, and infrastructure security | Phone number, IP / Webhook metadata, Message timestamps | Art. 6(1)(f) GDPR Legitimate interests in IT security |
Third-Party Processors & Infrastructure (Sub-Processors)
To route, process, and secure high-volume communications and cloud operations, we share data with trusted third-party service providers acting strictly as Data Processors under Article 28 of the GDPR:
Meta Platforms Ireland Ltd. / Meta Platforms, Inc.
WhatsApp Business Cloud API Infrastructure
Meta provides the underlying Cloud API infrastructure used to transmit, route, and deliver WhatsApp messages between you and our systems. Data processed includes phone numbers, message payloads, timestamps, and delivery statuses. Meta operates in accordance with the Meta Business Data Processing Terms and European Standard Contractual Clauses (SCCs).
Cloudflare, Inc.
Edge Routing, Webhook Protection & Bot Security
Cloudflare provides web application firewalls, DDoS protection, edge API routing, and the Turnstile bot verification service used on our contact intake forms to prevent abuse without tracking individual users across the web.
EU Cloud Hosting & Webhook Servers
Bot Logic Execution & Database Storage
Our webhook server endpoints and bot logic are hosted within secure, ISO 27001-certified data centers located inside the European Economic Area (EEA), ensuring that stored chat logs and client data benefit from strict European data residency protections.
* We never sell, rent, monetise, or distribute personal data or phone numbers to third-party marketing brokers or advertisers under any circumstances.
International Data Transfers & Safeguards
Where message routing via Meta Platforms involves data transfers outside the European Economic Area (such as to servers in the United States), such transfers are governed by appropriate safeguards in full compliance with Chapter V of the GDPR:
Standard Contractual Clauses (SCCs)
We have incorporated the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with Meta Platforms, Inc. and sub-processors, ensuring equivalent protection for data subjects.
EU-U.S. Data Privacy Framework
Where applicable, transfers rely on the European Commission's Adequacy Decision for the EU-U.S. Data Privacy Framework (DPF), under which our primary US infrastructure providers maintain certified compliance.
Consent, Opt-In & Clear Opt-Out Instructions
In accordance with Meta's WhatsApp Business Messaging Policy and GDPR Article 7, we strictly adhere to permission-based communications.
How Active Opt-In is Established
We do not send unsolicited or promotional WhatsApp messages. You opt in to communicate with us when you take any of the following voluntary actions:
- Sending an inbound message to our official WhatsApp number (
+31 10 890 6650). - Scanning the official WhatsApp QR code published on our website or marketing documentation.
- Clicking our direct WhatsApp link (
wa.me/message/SXADX3WNM6FIE1). - Checking the explicit consent box on our website contact form requesting follow-up via WhatsApp.
How to Opt Out / Stop WhatsApp Messages at Any Time
You have the absolute right to revoke consent and stop receiving messages at any time, immediately and without cost:
Reply with any of these standard keywords directly in your WhatsApp chat thread:
The bot will acknowledge instantly and cease automated messages.
You can block our official number (+31 10 890 6650) directly in the WhatsApp client settings or delete the conversation thread from your device at your discretion.
Send an email with your phone number to:
admin@dataprivacy.eu.comSubject: "WhatsApp Data Deletion Request". Handled within 30 days.
Data Retention & Automated Deletion Schedule
We retain personal data strictly for as long as necessary to fulfill the purposes for which it was gathered, in line with storage limitation principles (GDPR Article 5(1)(e)):
General Inquiries & WhatsApp Bot Chat Sessions
Inquiries, customer support conversations, and transient bot chat transcripts that do not result in a contract or ongoing business relationship are retained for a maximum of 90 days from the date of last activity, after which they are permanently deleted or anonymized.
Contractual, Client & Invoicing Records (Name, Address, Phone)
Where you engage our GDPR EU Representative or consulting services, records containing your full name, business address, phone number, contracts, and invoices are retained for the duration of the engagement plus 7 years following termination, in mandatory compliance with Dutch tax and corporate accounting laws (Article 2:10 Dutch Civil Code and Article 52 Dutch State Taxes Act).
Erasure Requests
Upon receipt of a valid Right to Erasure request under Article 17 GDPR, non-contractual records and WhatsApp chat logs associated with your phone number are expunged within 30 days.
Technical & Organizational Security Measures (GDPR Article 32)
We maintain advanced technical and organizational measures to safeguard your personal information against unauthorized access, loss, alteration, or disclosure:
Encryption in Transit & at Rest
All web communication, webhook transmissions, and API integrations utilize modern TLS 1.3 cryptographic protocols. Databases storing client profiles are encrypted with industry-standard AES-256.
Access Control & Token Isolation
WhatsApp Business API system tokens and secret keys are stored in encrypted vaults with strict role-based access control (RBAC), multi-factor authentication (MFA), and automated credential rotation.
Edge DDoS & Bot Shielding
Cloudflare Web Application Firewall (WAF) inspects incoming traffic to prevent SQL injection, cross-site scripting (XSS), and automated brute-force attacks against webhook endpoints.
Audit Logging & Incident Response
Continuous security monitoring and access logging ensure immediate detection of anomalous activity, backed by formal GDPR Article 33 breach notification protocols.
Your GDPR Data Subject Rights (Articles 15–22)
Under the European General Data Protection Regulation, you possess enforceable legal rights regarding the personal data we hold about you:
Right of Access (Art. 15 GDPR)
You have the right to obtain confirmation as to whether your personal data is being processed, and to receive a copy of your personal data along with full transparency on processing details.
Right to Rectification (Art. 16 GDPR)
You have the right to request prompt correction of inaccurate personal data concerning you, including your name, telephone number, or address.
Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)
You may demand the permanent deletion of your personal data when it is no longer needed, when you withdraw consent, or when data has been processed unlawfully.
Right to Restriction of Processing (Art. 18 GDPR)
You may request that we temporarily suspend active processing of your data while its accuracy or the lawfulness of our processing is being examined.
Right to Data Portability (Art. 20 GDPR)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g. JSON or CSV) and have it transmitted to another controller.
Right to Object (Art. 21 GDPR)
You have the right to object at any time to processing based on legitimate interests (Article 6(1)(f)). We will cease processing unless we demonstrate compelling legitimate grounds.
How to Exercise Your Rights
To exercise any of the rights listed above, simply send a written request to our Data Protection Officer at admin@dataprivacy.eu.com or via registered post to: Data Privacy Consulting B.V., Westplein 12, 3016BM Rotterdam, Netherlands. We will respond without undue delay and at the latest within one calendar month (30 days) free of charge.
Automated Decision-Making & Human Oversight (GDPR Article 22)
We place supreme value on ethical AI and human agency. In full compliance with Article 22 of the GDPR and our corporate AI governance framework:
Our WhatsApp conversational bot operates strictly as an interactive informational and triage assistant. It does not perform automated individual decision-making, legal evaluations, or profiling that produces legal effects or significantly affects you.
- All binding representation mandates and formal consulting contracts are reviewed and approved by human data privacy experts.
- Pricing calculations and eligibility determinations are subject to human verification prior to contractual engagement.
- Users always have the right to request human intervention, express their point of view, and contest decisions.
Amendments to this Policy
We may update this Privacy Policy from time to time to reflect modifications in our business operations, technological updates to the WhatsApp Business API, or evolving legal requirements under European and international privacy regulations. Changes take effect upon posting to this website. We encourage you to review this page periodically.