PRETIOSUS

Privacy Policy

Applies to the PRETIOSUS website at www.pretiosus.cc and the PRETIOSUS inbound customer-messaging platform.

PRETIOSUS provides a platform that lets service businesses manage the WhatsApp conversations their customers start with them. This policy explains what personal data we handle, why we handle it, how long we keep it, who it is shared with, and the rights available to you. It is written for the framework of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act").

1. Who we are and our role

PRETIOSUS is registered in India at 3rd Floor, JC Chambers, V970 (Bldg No. 60/44), Panampilly Nagar Avenue, Panampilly Nagar (Opp. Kairali Apartments), Kochi, Ernakulam, Kerala 682036, India. GSTIN 32BPCPV0220D1ZL.

Our role differs depending on whose data is involved:

  • For our own business contacts — people who enquire through this website, and the staff of businesses that use our platform — PRETIOSUS determines the purpose and means of processing and acts as the Data Fiduciary.
  • For the end customers of a business using our platform — the people who message that business on WhatsApp — the business is the Data Fiduciary. PRETIOSUS processes that data on the business's instructions as a Data Processor. If you are such a customer, please direct requests to the business you were messaging; we will support them in responding.

2. Personal data we collect

2.1 Data you give us directly

  • Name, email address, phone number and business name submitted through our contact or data request forms.
  • The content of enquiries and correspondence you send to us.
  • Account details for staff of customer businesses, such as name, work email address and role or permission level.

2.2 Data processed on behalf of customer businesses

  • Inbound WhatsApp messages sent by end customers to a business using the platform, including message content and any attachments they choose to send.
  • The end customer's WhatsApp phone number and profile name as supplied by the WhatsApp Business Platform.
  • Message metadata such as timestamps and delivery or read status.
  • Replies sent by the business's staff, and internal records such as which staff member a conversation is assigned to.

Message content may contain sensitive information, including health-related information where the business is a clinic or healthcare provider. We do not seek such information and it is supplied at the sender's own initiative.

2.3 Technical data

  • Server logs including IP address, browser type, pages requested and timestamps, generated when you use the website or the platform.
  • Security and audit records, such as sign-in events and administrative actions within a business's account.

2.4 What we do not collect

  • We do not purchase, rent or otherwise acquire contact lists or customer databases from third parties.
  • We do not use the website to build advertising profiles or track you across other websites.

3. Purposes and lawful basis

Under the DPDP Act we process personal data on the basis of consent, or for certain legitimate uses permitted by the Act. In each case processing is limited to the purpose stated.

  • Providing the platform — receiving, storing, organising and displaying inbound conversations so a business can reply. Basis: performance of our agreement with the customer business, acting on its instructions, and the consent obtained by that business from its own customers.
  • Responding to your enquiry — using the details you submit through our forms to reply to you. Basis: your consent, given by voluntarily submitting the enquiry.
  • Account administration and support — creating accounts, managing access, and diagnosing problems reported to us. Basis: performance of our agreement with the customer business.
  • Security and abuse prevention — detecting unauthorised access, investigating misuse, and maintaining audit records. Basis: legitimate use in connection with the security of our services.
  • Legal and regulatory compliance — meeting obligations under Indian tax, accounting and other applicable law. Basis: compliance with law.

We do not use personal data for cold outreach or unsolicited bulk messaging, and our terms of service prohibit customer businesses from using the platform for those purposes.

4. How data is processed and protected

  • Access to personal data is limited to personnel who need it for the purposes described above.
  • Data in transit is protected using encryption in transit (HTTPS/TLS).
  • Administrative actions on accounts are logged so that access can be reviewed.
  • Personnel with access are bound by confidentiality obligations.

No system can be guaranteed completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals as required under the DPDP Act.

5. Retention

  • Conversation data is retained for as long as the customer business maintains its account and requires it for the purpose of operating its inbox, or until that business instructs us to delete it.
  • Enquiry correspondence is retained for as long as needed to deal with the enquiry and any follow-up relationship.
  • Account and billing records are retained for the period required by applicable Indian tax and accounting law.
  • Security logs are retained for a limited period appropriate to investigating security incidents.

When personal data is no longer needed for the purpose it was collected for, and no legal obligation requires us to keep it, it is deleted.

6. Sharing and disclosure

We do not sell personal data. We share it only in these circumstances:

  • With the customer business whose inbox a conversation belongs to, and with the staff that business has authorised.
  • With the WhatsApp Business Platform, which is necessary to receive and send messages on the business's WhatsApp Business Account. Messages routed through that platform are subject to its operator's own terms and privacy practices. PRETIOSUS is an independent product and is not affiliated with, endorsed by, or sponsored by Meta or WhatsApp.
  • With service providers such as hosting and infrastructure providers who process data on our instructions under contractual confidentiality and security obligations.
  • Where required by law, including in response to a valid order from a court or authority with jurisdiction.
  • In connection with a business transfer, if PRETIOSUS is involved in a merger, acquisition or transfer of assets, subject to this policy continuing to apply.

7. Cross-border processing

Personal data may be processed on infrastructure located outside India, including by the WhatsApp Business Platform and our hosting providers. Where that occurs, we do so in accordance with the DPDP Act and any restrictions notified by the Central Government, and require contractual protections from our providers.

8. Your rights

Subject to the DPDP Act and to verification of your identity, you have the right to:

  • Access — obtain a summary of the personal data we hold about you and how it is processed.
  • Correction — have inaccurate or incomplete personal data corrected or completed.
  • Erasure — have your personal data deleted where it is no longer needed for the purpose it was collected for and no legal obligation requires its retention.
  • Withdraw consent — withdraw consent you have given, with effect for the future, as easily as it was given.
  • Grievance redressal — raise a complaint with us about how your data has been handled.
  • Nominate — nominate another individual to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these rights, use the data request page, which sends your request to office@pretiosus.cc. If your request concerns messages you sent to a business using our platform, that business is the Data Fiduciary and we will pass your request to them and assist in responding.

9. Children

The platform is provided to businesses for their own use and is not directed at children. We do not knowingly process the personal data of a child except where a parent or lawful guardian has communicated with a business through its inbox. Where the DPDP Act's provisions on children's data apply, we will act on the instructions of the relevant Data Fiduciary to comply with them.

10. Grievance and contact channel

Questions, requests and complaints about privacy should be sent to office@pretiosus.cc, or by post to the registered address below. We will acknowledge your grievance and respond within the timeframe required by the DPDP Act. If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India.

PRETIOSUS
3rd Floor, JC Chambers, V970 (Bldg No. 60/44),
Panampilly Nagar Avenue, Panampilly Nagar (Opp. Kairali Apartments),
Kochi, Ernakulam, Kerala 682036, India
office@pretiosus.cc · +91 79077 25350

11. Changes to this policy

If we change this policy we will update this page and, where the change materially affects how personal data is handled, notify affected customer businesses through the contact details held on their account.