KobiChat is a platform for business WhatsApp communication, provided by KobiTech B.V. In this policy we explain which personal data we process, why, and what rights you have. We comply with the General Data Protection Regulation (GDPR).
KobiTech B.V.
Klompenmakerstraat 24, 4871 EM Etten-Leur, the Netherlands
Chamber of Commerce (KvK): 42005593
Email: privacy@kobichat.nl
If you have any questions about this policy or about your data, you are always welcome to email us.
1. Two roles: controller and processor
KobiChat processes data in two roles:
- As controller for the data of our own customers (the businesses that subscribe to KobiChat): account details, billing and usage statistics.
- As processor for the data our customers process through KobiChat - in particular the WhatsApp conversations, contact details and messages of their own customers. That data belongs to the customer; we process it solely on their instructions. The arrangements for this are set out in our data processing agreement (GDPR Art. 28).
2. What data we process
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, email address, company name, encrypted password | Access to and management of your environment |
| Billing data | Subscription, payment status, invoice numbers | Billing and accounting |
| WhatsApp conversations | Messages, phone numbers and contact details of your customers, and any media | Providing the team inbox service (processor role) |
| Usage data | Login times, number of messages, technical logs | Security, troubleshooting and usage metering |
3. WhatsApp Business Platform and Meta
KobiChat uses the official WhatsApp Business Platform (Cloud API) from Meta Platforms Ireland Ltd. Messages sent and received via WhatsApp pass through Meta’s infrastructure. The WhatsApp/Meta privacy policy also applies to that processing. Each customer connects its own WhatsApp Business account; in doing so, we obtain only the access needed to send and receive messages on that customer’s behalf.
4. Recipients and sub-processors
We share data only with parties that are needed to provide the service. Some of these sub-processors are only engaged if the customer uses the relevant feature (e.g. the AI assistant or a calendar integration):
| Sub-processor | Purpose | Location / transfer |
|---|---|---|
| Meta Platforms Ireland Ltd. | Sending/receiving WhatsApp messages (WhatsApp Business Platform) | EU/US (SCC / Data Privacy Framework) |
| Microsoft Azure (West Europe) | Hosting of the platform and the database | EU |
| Mollie B.V. | Processing subscription payments | EU (Netherlands) |
| Apple Inc. (APNs) | Push notifications to the mobile app | US (DPF) |
| Anthropic / OpenAI (only when the AI assistant is used) | Generating AI replies using the customer’s own API key | US (SCC/DPF) |
| Google Ireland Ltd. (only with a calendar integration) | Reading free/busy status and booking appointments in the customer’s own calendar | EU/US (DPF) |
| Teamleader NV (only with a CRM integration) | Lead handover and tasks in the customer’s CRM | EU (Belgium) |
| Email provider (SMTP) | Sending system and reminder emails | EU |
Data processing agreements have been concluded with these parties. We never sell your data and do not use it for advertising. Our own customers enter into a data processing agreement with us for the data they process through KobiChat.
5. Retention period
We keep account data for as long as your environment is active. After termination we delete your data within 90 days, unless we are legally required to retain it for longer (for example, billing data subject to the 7-year statutory tax retention obligation). We delete conversation data that we manage as processor at the customer’s request or on termination of the agreement.
6. Security
We take appropriate technical and organisational measures: encrypted connections (TLS), encrypted storage of passwords, signed webhooks, access separation between customer environments, and daily backups. KobiChat platform administrators have no access to the content of customers’ conversations.
7. Your rights
You have the right of access to, and rectification, erasure, restriction and portability of, your personal data, as well as the right to object. Would you like to exercise these rights or have your data deleted? Email us at privacy@kobichat.nl. We respond within 30 days. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Would you like us to delete your account and the associated data? Send an email from your registered address to privacy@kobichat.nl with the subject “Deletion request”. We will delete your data within 30 days and confirm this by email.
8. Cookies
The KobiChat web app uses a functional session cookie and a few functional local storage items (see the cookie policy) to keep you logged in and remember your preferences. A full overview is available in our cookie policy.
On our website we use Google Analytics to measure visits and improve our marketing. The associated analytics and marketing cookies are only placed after you give your consent via the cookie banner; until then, Google Analytics runs in a consent-free mode (Consent Mode v2) without cookies. If you decline, no tracking or advertising cookies are placed. In this context, data is processed by Google (Google Ireland Ltd., with possible transfer to the US under the EU-US Data Privacy Framework). You can change your choice at any time by clearing your cookies.
9. Changes
We may amend this policy from time to time. The current version is always available on this page, with the date of the last change at the top.