Crossmedia Helpdesk Privacy Policy

1. Introduction

Crossmedia297 (“we”, “us”) operates a customer support service that lets you contact us over WhatsApp. Messages you send are received and handled through the Crossmedia Helpdesk plugin running on our WordPress website. This policy explains what personal data we process through that service, why, who it is shared with, and the rights you have.

For the purposes of data protection law, we are the data controller for the messages and contact details handled through this service. The service relies on third parties (see Section 5) who act as processors or independent controllers for the parts they handle — notably Meta (WhatsApp) and, if the AI assistant is enabled, the AI provider.

2. What personal data we process

When you contact us over WhatsApp, and as you are handled by our support team, the plugin stores and processes:

  • Your WhatsApp identifier — the phone number (WhatsApp ID) associated with your WhatsApp account.
  • Your WhatsApp profile name, as provided by WhatsApp.
  • The content of your messages — text you send and replies we send back.
  • Media and attachments you send — images, audio/voice notes, video, documents and stickers. These are downloaded and stored on our server. Attachments may contain any personal data you choose to send, including sensitive information such as identity documents; please only send what is necessary.
  • Conversation metadata — timestamps, message delivery/read status, conversation status (open/pending/closed), and which support agent a conversation is assigned to.
  • Raw message-delivery payloads received from WhatsApp, retained for diagnostic purposes.

If you interact with our automated assistant (see Section 8), the text of your messages is additionally sent to our AI provider to generate a reply.

We also process personal data of our support staff (name, email address, role, team assignment) to operate agent accounts. That processing is covered by our internal/employee privacy notice.

3. How we collect it

We collect this data directly from you when you message our WhatsApp number, and from WhatsApp/Meta, which transmits your message, identifier and profile name to us. We do not buy or enrich this data from third parties.

4. Why we process it, and our legal basis

Purpose Legal basis (adapt to your jurisdiction)
Receiving, answering and managing your support enquiry Performance of a contract / taking steps at your request, or our legitimate interest in providing support
Storing conversation history so agents have context Legitimate interest in providing a coherent service
Routing and escalating your enquiry to the right person Legitimate interest
Generating an automated first response (if enabled) Legitimate interest / consent, depending on configuration
Notifying our staff of new enquiries Legitimate interest
Security, diagnostics and abuse prevention Legitimate interest / legal obligation

5. Who we share it with (third parties and sub-processors)

  • Meta Platforms, Inc. (WhatsApp Business Platform / Cloud API). All messages are sent and received through Meta’s WhatsApp infrastructure. Meta processes your message content, phone number and profile data under its own terms and privacy policy. This is inherent to using WhatsApp.
  • Google LLC (Gemini / Generative Language API) — only if the AI assistant is enabled. When the assistant generates a reply, the relevant message content and the configured knowledge-base context are sent to Google’s API to produce that reply. If you do not enable the assistant, no data is sent to Google.
  • Our email provider. New-enquiry notifications containing a short message excerpt and the contact’s name are sent to the assigned agent or to managers by email, using our website’s mail system.
  • Our hosting provider. All data is stored on the server that hosts our website.

The plugin itself does not send analytics, telemetry or any of your data back to the plugin’s author (Crossmedia297) or any advertising network.

6. International transfers

Meta and Google are established in the United States and process data on global infrastructure. Where your data is transferred outside your country/region, that transfer relies on the safeguards those providers put in place (such as standard contractual clauses). Review and reference the appropriate mechanism for your jurisdiction here.

7. How long we keep it, and how it is secured

Retention. Conversations, messages, downloaded media and diagnostic payloads are retained until deleted by us. The plugin does not delete this data automatically. We delete conversation data after 1 month of inactivity, though a third party operator may choose to operate by a different retention and delete policy.

Security measures built into the service include:

  • Incoming WhatsApp requests are verified with a cryptographic signature before being accepted.
  • Downloaded media is stored in a protected directory that is not publicly accessible and can only be viewed by authenticated staff who are permitted to see that specific conversation.
  • Access is controlled by role (administrator / manager / agent); agents can only see the conversations assigned to them, and managers only their team’s.
  • Access to the service requires a WordPress account with the appropriate permission.

No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data. (Server-level protections such as HTTPS and, on some servers, additional directory rules must be configured correctly by the operator.)

8. Automated processing and AI assistance

If enabled, an AI assistant may respond to your messages automatically before or instead of a human agent. When it does:

  • Your message content and our support knowledge base are sent to our AI provider (Google) to generate the reply.
  • The assistant only answers from our configured knowledge base and hands your conversation to a human when it cannot answer, when you ask to speak to a person, or on error.
  • You can request a human at any time by asking in the chat.

The automated assistant provides information and routing; it does not make decisions that produce legal or similarly significant effects about you.

9. Children

WhatsApp requires users to meet a minimum age (generally 13 or higher depending on local laws). This service is not directed at children below that age, and we do not knowingly solicit their data.

10. Cookies and local storage

The support inbox is an internal staff tool and does not set advertising or tracking cookies for you as a contact. Staff browsers may be asked to allow desktop notifications for new messages; this is optional and can be declined.

11. Your rights

Subject to applicable law, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, and to data portability. To exercise any of these rights, contact us at info@crossmedia297.com. We will respond within the timeframe required by applicable law.

Because messages are delivered through WhatsApp, requests concerning data held by Meta may need to be directed to Meta as well.

12. Changes to this policy

We may update this policy from time to time. The current version and its effective date will always be available at https://crossmedia297.com/crossmedia-helpdesk-privacy-policy/.

13. Contact