Privacy Policy
KONILABS MARKETING - FZCO · Last updated: September 28, 2026
1. Who we are
KONILABS MARKETING - FZCO, a free zone company registered under IFZA licence no. 88154, IFZA Business Park, DDP, Dubai Silicon Oasis, P.O. Box 342001, Dubai, United Arab Emirates. Contact: contact@konilabs.com.
KONILABS builds software for businesses, including a direct-sales solution for growers and their professional buyers, and lets its customers use WhatsApp Business from its software.
Representative in the European Union (Article 27 GDPR): Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria — contact portal (reference ID-11494703482).
2. Roles
- For our customers’ accounts (businesses, growers) and the operation of our services, KONILABS is the controller.
- For data our customers manage in our services (their buyers, their WhatsApp conversations, their orders), the customer is the controller and KONILABS acts as a processor on their instructions (Article 28 GDPR). If you are a buyer of one of our customers, you may contact them or us; we will forward your request.
3. Data we process
- Our customers’ users: name, email address, mobile phone (alerts), company information (legal name, address, registration numbers), settings.
- Our customers’ business buyers: company and contact name, phone, delivery address, buyer type, orders, consent to receive WhatsApp messages (date and source) and its withdrawal.
- WhatsApp messages exchanged through our services: text, photos, voice messages and their transcription, delivery status (sent, delivered, read).
- WhatsApp Business connection: WhatsApp Business Account ID and phone number ID provided by Meta, ID of the Twilio account created for the customer. Access tokens are encrypted. When connecting with Facebook, we only receive these identifiers: we have no access to your Facebook profile, contacts or posts.
- Orders, deliveries and claims: quantities, prices, dates, proof of delivery (name of the person receiving), photos attached to a claim, carriers’ contact details.
- Payments: processed by Stripe. We never receive or store card numbers.
- Technical data: login cookies, security logs.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service: orders, messaging, deliveries, payments, invoicing | Performance of the contract |
| Sending business-initiated WhatsApp messages from a customer to its buyers (e.g. the daily offer) | Buyer’s consent, which can be withdrawn at any time by replying “STOP” |
| Automatically reading an incoming order (text, photo or voice) to prepare a proposal that the customer reviews and approves | Performance of the contract; no decision is made without human approval |
| Re-billing WhatsApp usage to our customers | Performance of the contract |
| Security, abuse prevention, logging | Legitimate interest |
| Keeping accounting records | Legal obligation |
5. WhatsApp
- Business-initiated messages are only sent using Meta-approved templates, and only to people who agreed to receive WhatsApp messages from that business.
- Replying “STOP” withdraws consent immediately: the business no longer contacts you on its own initiative. You can still write to it.
- WhatsApp is a Meta service. Messages pass through Meta and our provider Twilio. See also the WhatsApp Business Policy: https://www.whatsapp.com/legal/business-policy/
- We do not use conversations for advertising and do not sell them.
6. Service providers
- Twilio Inc. (United States): WhatsApp message delivery.
- Meta Platforms (WhatsApp): WhatsApp Business platform.
- Anthropic (United States): automatic order reading. Under its commercial terms, data sent through its API is not used to train its models.
- AllMySMS and Brevo (France): service SMS and emails.
- Stripe: payments.
- Hosting: HOSTINGER operations, UAB (Lithuania), servers located in Düsseldorf (Germany).
We never sell your data.
7. Transfers outside the European Union
KONILABS is established in the United Arab Emirates and some providers are located in the United States. These transfers rely on the European Commission’s standard contractual clauses or, for certified providers, the EU–US Data Privacy Framework.
8. Retention
- WhatsApp message content: automatically erased 12 months after sending or receipt. Message dates and statuses remain attached to the order history.
- SMS login codes: valid for 10 minutes; only a hash of the code is stored, never the code itself.
- Orders and invoices: 10 years (accounting obligations).
- Customer accounts: for the duration of the contract, then deleted or anonymised within 3 years, unless required by law.
- Security logs: 12 months.
9. Security
Encrypted connections (HTTPS), access tokens encrypted at rest (AES-256), strict separation of each customer’s data, signature verification of every notification received from WhatsApp, access limited to those who need it.
10. Cookies
We only use cookies required for logging in (session). No advertising or analytics cookies.
11. Your rights
You may request access to your data, its rectification or erasure, restriction of processing, data portability, object to processing and withdraw your consent at any time. Write to contact@konilabs.com: we reply within one month. You may also lodge a complaint with your data protection authority (in France: the CNIL, https://www.cnil.fr/).
12. Deleting your data
- Stop receiving WhatsApp messages from a business: reply “STOP”.
- Have your data deleted: email contact@konilabs.com with the subject “Data deletion request”, stating your name and the phone number or email address concerned. We delete your data within 30 days, except data we are legally required to keep (invoices), and confirm it to you.
- Customers: you can disconnect WhatsApp and request closure of your account the same way. The identifiers received from Meta and Twilio are then deleted.
13. Minors
Our services are for businesses only and are not intended for minors.
14. Changes
We may update this policy. The date of the last update appears at the top of the page; customers are notified of significant changes.