Privacy Policy

1. Introduction

Aftal Group FZC (“Aftal Group”, “we”, “us”, “our”) provides a sales workspace to businesses in the United Arab Emirates: a customer relationship management system with a shared inbox. The workspace connects to WhatsApp, Instagram and Messenger through Meta’s official business platforms.

This Privacy Policy explains what personal information we collect, how and why we process it, who we share it with and how to ask us to delete it. It applies to:

• our website at https://aftalgroup.com/;
• the Aftal Group sales workspace and its related systems;
• messages exchanged through the WhatsApp Business Platform, the WhatsApp Business app (including WhatsApp Business app coexistence, where enabled), Instagram and Messenger, when a business client has connected those accounts to the workspace;
• automated and AI-assisted features that draft replies, route conversations and summarise them;
• email, telephone and any other contact with us.

2. Who we are

The organisation responsible for this Privacy Policy is:

3. Our two roles

3.1 Service provider (processor) for our business clients

When a business uses our workspace, that business decides why and how its customers’ information is used. We process that information only on the client’s behalf and on its instructions, to provide the service it asked for. We do not use it for purposes of our own.

If you have chatted with one of our clients, that business is responsible for your information. You can contact the business directly. If you contact us instead, we will pass your request to the business and help it respond.

3.2 Controller for our own activities

We decide how information is used when you visit our website, ask about our services, or act as a contact person for a client or a supplier.

4. Information we process

4.1 Contact and identity information

• Full name.
• Business or employer name, job title or department.
• Email address.
• Telephone and WhatsApp number.
• Business address, country and city.
• Social-media username, profile name and platform identifiers.

4.2 Information from WhatsApp, Instagram and Messenger

When a client connects an account to the workspace and a person messages that client, we may receive on the client’s behalf:

• the person’s WhatsApp telephone number and display name;
• the person’s Instagram username and user identifier;
• Messenger or Facebook user and Page identifiers;
• message content;
• images, audio, documents, videos and other attachments;
• message dates and times;
• delivery, read, reply and conversation status;
• identifiers of the business account, Page, application and telephone number;
• conversation and messaging metadata;
• information needed to route a conversation to a salesperson, an automated workflow or a support agent.

We never receive anyone’s WhatsApp, Instagram, Facebook or Meta account password.

4.3 WhatsApp Business app coexistence

Where a client connects a telephone number that is also used in the WhatsApp Business app, through Meta’s authorised coexistence process, we may process:

• the connected business telephone number;
• WhatsApp Business Account and telephone-number identifiers;
• business profile information;
• connection and authorisation status;
• messages and conversation information made available through the authorised connection;
• eligible conversation history that Meta makes available and that the client chooses to share;
• whether a message was handled in the WhatsApp Business app, through the WhatsApp Business Platform or in the workspace.

Connecting a telephone number does not give Aftal Group ownership of that number or of any Meta business asset. The number and the account remain the client’s.

4.4 Client users

For the employees, salespeople, managers and administrators our clients authorise, we may process:

• name and business contact details;
• a work telephone number, or a number the person has authorised for business use;
• role, permissions and access level;
• workspace username and user identifier;
• the leads and conversations assigned to the person;
• login, audit, security and activity records;
• actions taken in the workspace.

A client must have appropriate authority before it connects a telephone number or an account that belongs to an employee or a representative.

4.5 Lead and sales information

• What a customer asked about, and the answers they gave to qualifying questions.
• The lead’s stage, owner, notes and outcome, as the client records them.
• Quotations, orders and results the client chooses to record.
• Campaign, spend and result information from an advertising account the client connects.

Please do not send sensitive personal information that is not needed, such as health details, identity documents or payment card numbers, through messaging channels.

4.6 Website and technical information

• Internet Protocol address.
• Browser, device and operating-system type.
• Pages requested, and the date and time.
• Security and error logs.

Our website does not use advertising or analytics cookies. Its typefaces are loaded from Google Fonts, which receives your IP address in order to deliver them.

5. How we obtain information

• Directly from you.
• From a business client that has authorised a connection or added records to its workspace.
• Through WhatsApp, Instagram, Messenger and other Meta services the client has connected.
• From an employer or business client that has authorised your access to the workspace.
• Automatically, through server and security logs.

6. How we use information

6.1 For our clients, on their instructions

• Receive, store and display messages in the client’s workspace.
• Route and assign conversations and leads to the client’s authorised staff.
• Draft and send replies, notifications and approved message templates.
• Connect and manage the Meta business assets the client has authorised.
• Operate automated workflows and AI-assisted features.
• Produce dashboards and periodic reviews of conversations for the client.
• Keep conversation history, audit records and security records.
• Provide setup, support and training.

6.2 For our own activities

• Answer enquiries and arrange demonstrations.
• Manage contracts, invoices and payments.
• Protect accounts, systems and data from fraud, abuse and unauthorised access.
• Find and fix technical faults and keep the service reliable.
• Meet contractual, accounting, tax, regulatory and legal obligations.
• Establish, exercise or defend legal claims.

6.3 What we do not do

• We do not sell or rent personal information.
• We do not use information received through WhatsApp, Instagram or Messenger for advertising of our own, or to build profiles for third parties.
• We do not use that information to train or improve general-purpose artificial-intelligence models.
• We do not share one client’s conversation data with another client. Each client’s data is kept separate.

7. Legal grounds for processing

Depending on the circumstances and the applicable law, including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data where it applies, we process personal information on one or more of these grounds:

• your consent or permission;
• the steps needed to enter into a contract, or the performance of a contract;
• the documented instructions of the business client for whom we act;
• compliance with legal or regulatory obligations;
• the protection of legitimate business, security and operational interests, where these do not override your rights;
• establishing, exercising or defending legal claims.

Where processing depends on consent, you may withdraw it at any time. Withdrawal does not make earlier lawful processing invalid.

8. WhatsApp consent and your choices

Our clients are responsible for obtaining the permission they need before they message a person on WhatsApp, and for identifying themselves in their messages. Our Terms of Service require them to do so.

You can ask a business to stop sending you marketing or other non-essential messages at any time by:

• replying STOP or UNSUBSCRIBE to the message;
• asking the representative handling your conversation;
• blocking the business in WhatsApp;
• emailing info@aftalgroup.com, naming the business.

The workspace records opt-out requests so that the business can honour them. Messages that are needed to complete an active order, a security step or a legal obligation may still be sent where the law permits.

9. Automation and artificial intelligence

The workspace uses automated workflows and AI-assisted features to:

• identify the language and the subject of a message;
• draft or send a first reply from information the client has supplied, such as its price list and frequently asked questions;
• ask qualifying questions and record the answers;
• route and assign conversations;
• summarise conversations and prepare periodic reviews for the client.

For these purposes message content and its context may be sent to AI model providers that act as our service providers. They may use it only to produce the result for the client concerned. We do not allow them to use it to train their models.

Automated and AI-generated replies can be incomplete or inaccurate. Important information, such as prices, availability and contractual commitments, should be confirmed with a representative of the business. You may ask for a human representative at any time, and the workspace hands the conversation to the client’s staff.

10. When we share information

We do not sell or rent personal information. We share it only where reasonably necessary, with:

• Meta Platforms, Inc. and its affiliates, including WhatsApp, Instagram and Messenger, to send and receive messages and to manage authorised connections;
• cloud hosting and infrastructure providers;
• AI model providers, as described in section 9;
• workflow-automation, email, monitoring and security providers;
• the business client whose customer or authorised user you are;
• professional advisers, auditors and insurers;
• courts, regulators and government or law-enforcement bodies, where disclosure is legally required.

Our service providers act under written agreements. They may process information only to provide their service to us and must protect it. Clients can ask us for the current list of sub-processors.

11. Storage and international transfers

Client workspace data is stored on cloud infrastructure located in the United Arab Emirates.

Some service providers, including Meta and AI model providers, may process information in other countries, whose privacy laws may differ from those of the United Arab Emirates. Where required, we use contractual, organisational or technical safeguards for these transfers and limit them to what the service needs.

12. Data retention

We keep personal information only for as long as it is needed for the purposes described in this Policy.

• Client workspace data is kept for as long as the client’s agreement with us runs. When the service ends, or when the client asks, we delete it or return it to the client, normally within 30 days, unless the law requires us to keep it.
• Enquiry and contract records are kept while they are needed and for as long as accounting, tax and legal rules require.
• Security and audit logs are kept for as long as they are needed to protect the service and investigate incidents.

When information is no longer required we delete it, anonymise it or securely isolate it. Copies in backups remain until the backup is overwritten or retired under our normal backup schedule.

13. Data security

We use technical and organisational safeguards designed to protect personal information, including:

• role-based access and user permissions;
• authentication and credential-management measures;
• encryption in transit;
• separation of each client’s data from every other client’s;
• system and activity logging, and security monitoring;
• restricted access to administrative systems;
• backup and recovery procedures;
• confidentiality obligations for employees and contractors;
• removal of access that is no longer required.

No internet, messaging or storage system can be guaranteed to be completely secure. Do not send passwords, one-time passwords, complete payment-card numbers or government identity numbers through ordinary messages.

14. Your privacy rights

Subject to the applicable law, you may have the right to:

• ask whether we process your personal information;
• request access to it;
• request correction of inaccurate or incomplete information;
• request deletion of eligible information;
• request restriction of certain processing;
• object to certain processing, including direct marketing;
• withdraw consent, where consent is the basis for processing;
• request transfer of eligible information;
• complain about our processing to us or to the competent authority.

We may need to verify your identity and authority before we respond. Where we act for a business client, we will refer your request to that client and help it respond. Some rights may be limited where information must be kept for legal, contractual, accounting, security or dispute-resolution purposes.

15. User data deletion

To ask for your personal information to be deleted, follow our User Data Deletion Instructions, or email info@aftalgroup.com with the subject “User Data Deletion Request”.

Give your name, the telephone or WhatsApp number concerned with its country code, your email address, the business you were in contact with if you know it, and a short description of the information you want deleted.

We aim to complete eligible, verified requests within 30 calendar days. We may keep limited information where the law, a contract, security or a dispute requires it.

Disconnecting a Meta or WhatsApp business asset stops future access, but does not by itself delete information already stored in the workspace. A deletion request is needed for that.

16. Cookies

Our website does not set advertising or analytics cookies and does not track you across other websites. It may use essential technical storage that the pages need in order to work.

If we add analytics or similar technologies in future, we will update this Policy first and ask for your consent where the law requires it.

17. Third-party platforms and links

Our services connect to third-party platforms, including Meta, WhatsApp, Instagram and Messenger. Those organisations collect and process information under their own terms and privacy policies. Aftal Group is not responsible for the privacy practices of an independent third party.

18. Children

Our services are intended for businesses and for adults acting for them. We do not knowingly collect personal information directly from children. If you believe a child has provided personal information improperly, contact info@aftalgroup.com.

19. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our services, our technology, the law or our business practices. The latest version is always published on this page with its effective date. We will tell active clients about material changes through the workspace or by email.

20. Related documents

• Terms of Service
• User Data Deletion Instructions

21. Contact us

For privacy questions, requests or complaints, contact: