Effective from: 21 October 2026
This policy describes how Quartex Praha, s.r.o. processes personal data in the Quartex WhatsApp Gateway service (Meta app "wapp-gateway"; the "Service"). The Service lets businesses receive the messages their customers send them on WhatsApp, store them, make them available to their internal systems, and reply to them. The Service uses Meta’s official WhatsApp Business Platform (Cloud API).
A WhatsApp number can be connected to the Service in two ways, and both can run at the same time:
- A company (shared) number connected to the Cloud API only. Staff handle its messages through the Service and internal applications, not in the WhatsApp app on a phone. A conversation can be assigned to a specific salesperson, for example by a code the customer sends from that salesperson’s link or QR code.
- A salesperson’s number in coexistence mode. The salesperson keeps using the WhatsApp Business app on their phone and the same number is also connected to the Cloud API. The Service receives customers’ messages and the messages the salesperson writes from the phone.
Our company-wide privacy policy is available at https://quartexpraha.cz/zasady-zpracovani-osobnich-udaju/ (in Czech). This document supplements it for the Service. The Czech version of this policy prevails in case of discrepancy.
1. Who we are
Quartex Praha, s.r.o., company ID 25678230, VAT ID CZ25678230, registered office Nádražní 203/9, 250 64 Měšice, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 60466. Privacy contact: info@quartex.cz, phone +420 602 740 062.
2. Our role
When we use the Service for our own communication with customers (WhatsApp numbers of Quartex Praha and its salespeople), we are the controller of the personal data.
When we operate the Service for another business (a client that connected its WhatsApp Business account to it), that client is the controller of its customers’ data and we act as its processor. We process the data only on the client’s instructions and under a data processing agreement. Please direct requests about such communication to that business; if you contact us, we will forward the request to it.
3. What data we process
About people who write to a connected WhatsApp number (customers):
- the WhatsApp user identifier (business-scoped user ID) and the phone number, where available;
- the WhatsApp profile name;
- message content: text, reactions, location, contacts and attachments (documents, images, voice messages, videos), including the files;
- message metadata: sent and received times, delivery and read status, message and conversation identifiers;
- for a company number, which salesperson the conversation is assigned to and the code from the link or QR code the customer used to write;
- messages the business sent back (replies, templates, reactions) and, for numbers connected in coexistence mode, messages the salesperson wrote from the WhatsApp Business app on their phone.
When a number used in the WhatsApp Business app is connected (coexistence mode): WhatsApp transfers the app’s contacts to the Service (name and phone number of contacts who use WhatsApp) and, if the owner of the number agrees during connection, the chat history of up to the last 6 months. The Service may therefore process data about people who have not yet communicated through the Service but are in the salesperson’s contacts or earlier conversations. We keep this data in sync while the number stays connected.
About salespeople: name and assigned conversations; for numbers in coexistence mode also the phone number, display name and the messages they sent from that number.
About businesses using the Service (clients) and their accounts: business name, WhatsApp Business account and phone number identifiers, display name, message templates, webhook settings and access tokens. We obtain these through Meta’s APIs with the whatsapp_business_management and whatsapp_business_messaging permissions, and only for accounts the client itself connected to us (e.g. through Embedded Signup).
About staff operating the Service (operators): name, e-mail, login credentials (passwords are stored only as a cryptographic hash), and a record of their actions in the Service.
We do not process special categories of personal data unless a customer sends them in a message.
4. Why we process data and on what legal basis
| PURPOSE | LEGAL BASIS |
|---|---|
| Receiving, storing and displaying messages and replying to them | performance of / steps towards a contract with the customer; for clients, performance of the contract with the client |
| Passing the message and attachments to the business’s internal systems (e.g. to handle an inquiry, to extract data from an attached document) | legitimate interest in handling the inquiry the customer sent |
| Assigning a conversation on a company number to the responsible salesperson and notifying them of a new message | legitimate interest in having the inquiry handled by the salesperson the customer meant to write to |
| Importing contacts and chat history from the WhatsApp Business app when a salesperson’s number is connected, and keeping them in sync | legitimate interest in continuing existing communication with customers seamlessly |
| Filtering unsolicited messages (spam) and sorting messages, including automated assessment by a language model | legitimate interest in protection against spam and efficient handling of messages |
| Per-client traffic statistics for billing | performance of the contract with the client; legal obligation (accounting) |
| Security, debugging and monitoring of the Service | legitimate interest |
Automated assessment of a message (e.g. spam / not spam) has no legal effect on the customer; an operator can review any message marked as spam and reverse the decision at any time.
5. Where data is stored
The Service runs on virtual servers we rent from a cloud infrastructure provider, in data centres within the European Union. Quartex Praha, s.r.o. itself manages the Service software, databases, messages and attachments on those servers; we use no other third-party cloud services to store or process messages (such as hosted databases or file storage). The infrastructure provider is our processor, bound by a data processing agreement, and has no access to the data for any purpose other than operating the servers.
6. Who we share data with
We share data only as far as the Service requires:
- the provider of our rented virtual servers in the EU (see section 5) — as a processor operating the infrastructure;
- Meta Platforms Ireland Ltd. (WhatsApp Business Platform) — messages reach us and leave us through the WhatsApp Cloud API. Meta’s processing is governed by WhatsApp’s and Meta’s terms and policies; Meta may process data outside the EU under its own GDPR safeguards.
- OpenRouter, Inc. (USA) — a gateway to language models. We use it only to sort and filter messages and to extract data from attached documents where needed to handle the message. Only the content necessary for the task is sent. OpenRouter is our processor under its data processing agreement; the transfer to the USA is safeguarded by the standard contractual clauses approved by the European Commission (Decision (EU) 2021/914). We route requests only to model providers that do not store the data for their own purposes or use it to train models.
- the controller’s internal systems — for clients, their own applications, to which the Service makes messages available through a secured API; for us, our internal applications (e.g. document processing).
- public authorities where required by law.
We do not sell personal data, do not use it for advertising or marketing profiling, and do not share it with any other third parties.
7. How long we keep data
- Messages and attachments: 24 months from the last communication with the customer; for clients, for the duration of the client contract or a shorter period the client sets; then deleted.
- Usage records and billing statistics (without message content): for the period required by accounting and tax law.
- Technical logs: 30 days.
- Client account data and access tokens: while the account is connected; deleted on disconnection.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. Send requests to info@quartex.cz; we will handle them without undue delay and within one month at the latest. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.gov.cz).
9. How to request deletion of your data
To have the messages and other data we hold about you in the Service deleted:
- e-mail info@quartex.cz with the subject "Data deletion — WhatsApp";
- state the phone number or name you used to write to us on WhatsApp and the business you wrote to;
- to verify your identity, we may ask you to confirm the request from the same WhatsApp number.
We delete the data within 30 days and let you know the result. If you wrote to a business for which we operate the Service as a processor, we handle the request in agreement with that business. Data we are legally required to keep (e.g. accounting records) is deleted when the statutory period ends. Deletion on our side does not affect copies of messages on your phone or at WhatsApp/Meta.
A client that disconnects its WhatsApp Business account from the Service can request deletion of all data related to that account in the same way.
10. Security
Access to the Service is protected by personal operator accounts, encrypted connections (HTTPS) and separation of each client’s data. Access keys for the Meta and OpenRouter APIs are stored separately and never written to logs. Only authorised staff have access to the data.
11. Changes
We may update this policy; the current version is always published on this page with its effective date. We will inform clients of material changes in advance.