Legal
WhatsApp Business API Privacy Policy
This policy explains how Yasuke Consulting (Pty) Ltd (“Yasuke”, “we”, “our”) collects, uses, stores and protects personal information processed through the WhatsApp Business API solutions we build, host and operate on behalf of our clients.
It applies specifically to messaging workflows delivered over the WhatsApp Business Platform. For general information about our website and other services, see our main site at yasuke.co.za.
1. Our role
When you message a business on WhatsApp that we have integrated, that business is the responsible party (data controller) for your personal information. Yasuke acts as an operator (data processor) under the South African Protection of Personal Information Act, 2013 (POPIA) and, where applicable, as a processor under the EU General Data Protection Regulation (GDPR). We process personal information only on the documented instructions of our client.
WhatsApp itself is operated by Meta Platforms, Inc. and is governed by the WhatsApp Privacy Policy.
2. Information we process
Through the WhatsApp Business API solutions we operate, we may process:
- Phone numbers of end users who message a Yasuke-integrated business account.
- Message content ‐ the text of messages exchanged between the end user and the business.
- Media shared in conversations, such as images, documents, audio and video files.
- Opt-in records ‐ evidence that a user consented to receive messages, including the source, timestamp and channel of the opt-in.
- Email addresses where a user provides one during a conversation (for example, to receive a quote, invoice or booking confirmation).
- Technical metadata generated by the WhatsApp platform, such as message IDs, delivery and read receipts, and timestamps.
3. How we use this information
We process personal information solely to deliver the messaging service the client has commissioned, which typically includes:
- Sending and receiving WhatsApp messages between the client’s business account and its end users.
- Routing conversations to the correct workflow, chatbot flow or human agent.
- Delivering campaign messages to users who have opted in.
- Maintaining opt-in and opt-out records so users can be excluded from further messaging on request.
- Troubleshooting, monitoring service quality and preventing abuse of the platform.
- Meeting our legal, regulatory and Meta Platform Policy obligations.
We do not sell personal information, and we do not use it to build advertising profiles or train third-party AI models.
4. Legal basis for processing
We rely on the following legal bases:
- Consent ‐ users opt in to receive WhatsApp messages from the business before campaign or notification messages are sent.
- Performance of a contract or service ‐ for transactional replies (e.g. bookings, receipts, support responses) requested by the user.
- Legitimate interests ‐ for platform security, fraud prevention and operational logging, balanced against user rights.
- Legal obligation ‐ where retention or disclosure is required by law.
5. Data retention
Retention windows are set per client campaign, based on the purpose of the workflow. In general:
| Data type | Typical retention |
|---|---|
| Message content and media | 7 to 30 days after the conversation ends |
| Phone numbers and email addresses tied to a conversation | 7 to 30 days, or as long as the user remains opted in |
| Opt-in and opt-out records | For the life of the client relationship, plus the period required to prove consent under POPIA |
| Technical metadata and delivery logs | Up to 30 days for operational troubleshooting |
Once the retention period ends, data is deleted or irreversibly anonymised. Specific retention periods for a given campaign can be confirmed on request.
6. Sub-processors
We use a small number of trusted providers to deliver the service. Each is bound by contractual data protection obligations.
| Sub-processor | Purpose | Location |
|---|---|---|
| Meta Platforms, Inc. (WhatsApp Business Platform) | Delivery of WhatsApp messages between the business and end users | Global |
| Microsoft Azure | Hosting of the application, databases, message queues and logs that power the integration | South Africa & EU regions |
| Our hosting provider for supporting services | Ancillary hosting for supporting websites, files and mail relays where applicable | South Africa |
We do not transfer personal information to any other third party except where required by law or explicitly instructed by the client.
7. Cross-border transfers
Because Meta operates the WhatsApp platform globally, message data will be transmitted outside South Africa. Where we transfer personal information across borders, we rely on the safeguards permitted under section 72 of POPIA and, for EU data subjects, on Standard Contractual Clauses or equivalent mechanisms.
8. Security
WhatsApp messages are transmitted using WhatsApp’s end-to-end encryption between the user and the Business Platform. Within our systems, we protect personal information using measures that include:
- Encryption in transit (TLS) and at rest for stored data.
- Role-based access control, with production access limited to authorised engineers.
- Segregated environments for each client and campaign.
- Audit logging of administrative access.
- Regular patching, vulnerability scanning and secret rotation.
9. Your rights
Depending on the law that applies to you, you have the right to:
- Ask what personal information we hold about you.
- Ask us to correct or update information that is inaccurate.
- Ask us to delete your information, subject to legal retention obligations.
- Withdraw consent and stop receiving WhatsApp messages at any time by replying STOP to any campaign message, or by contacting the business directly.
- Object to processing on grounds relating to your particular situation.
- Lodge a complaint with the South African Information Regulator (inforegulator.org.za) or, if applicable, your local EU data protection authority.
Because we act on behalf of our clients, we will usually forward requests we receive to the relevant client and assist them in responding.
10. Children
Our WhatsApp Business API solutions are not directed at children under the age of 18 and we do not knowingly process children’s personal information without appropriate parental or guardian consent. If you believe we have received a child’s personal information without proper consent, please contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time to reflect changes in the way we operate the service, the sub-processors we use, or applicable law. The “Last updated” date at the top of this page reflects the most recent revision. Material changes will be communicated through the client and, where appropriate, through the WhatsApp channel itself.
12. Contact us
For questions about this policy, to exercise your rights, or to submit a data-subject or deletion request, contact:
Yasuke Consulting (Pty) Ltd
Email: meta@yasuke.co.za
Website: www.yasuke.co.za
Please include the business (WhatsApp sender) you were messaging so we can route your request to the correct client.