Privacy Policy
This policy explains how D2 Digital Labs ("we", "us") collects, uses, shares and protects personal data when you visit our website, use our services, or communicate with a business that uses d2dl-crm, our WhatsApp customer-engagement platform built on the official WhatsApp Business Platform (Cloud API) provided by Meta.
1. Who is responsible
- Our website, sales and support: D2 Digital Labs is the controller of the data we collect about you directly.
- d2dl-crm: each business that uses d2dl-crm (our "Customer") decides why and how its own contacts' data is processed and is the controller of that data. We process it on the Customer's behalf, as a processor, under our agreement with them. If you messaged a business on WhatsApp, contact that business first about your data; we will help them respond.
2. Data we process
| Who | Data |
|---|---|
| People who message a Customer on WhatsApp | WhatsApp phone number and ID, profile name, message content and media you send or receive, message timestamps and delivery/read status, and details you choose to share (for example name, email, booking or enquiry details, uploaded documents). |
| Customer staff (platform users) | Name, username, email, role and permissions, login history, IP address, and an audit log of actions taken in the platform. |
| Customers (businesses) | Business name and contact details, WhatsApp Business Account and phone-number identifiers, and access credentials for the WhatsApp Business Platform (stored encrypted). |
| Website visitors and enquirers | Information you send us (name, email, phone, message) and basic technical logs (IP address, browser, pages requested). |
3. How we use it
- To deliver, receive, store and display WhatsApp conversations for the Customer you are communicating with.
- To provide platform features the Customer turns on: contact and lead management, follow-ups, approved message templates and campaigns, bookings, forms and automated replies.
- To authenticate users, enforce permissions, separate each Customer's data from every other Customer's, and keep audit records.
- To secure, maintain, troubleshoot and improve the service, and to meet legal obligations.
We do not sell personal data, use it for advertising, or use one Customer's data for another Customer.
4. Automated and AI-assisted replies
If a Customer enables AI features, message content may be sent to an AI model provider to draft or send replies, classify enquiries, or summarise conversations on that Customer's behalf. We send only what the feature needs, and Customers can require staff approval before AI-drafted messages are sent. Customers are responsible for telling their contacts when they use automated replies.
5. Who we share data with
- Meta Platforms (WhatsApp Business Platform), which transmits WhatsApp messages. Meta's own terms and privacy policy apply to its processing.
- Hosting: Tencent Cloud (Singapore region), where the platform and its database run.
- AI model providers, only where a Customer enables AI features (see section 4).
- Integrations a Customer connects itself (for example its own ERP, CRM or webhook endpoint).
- Authorities, where the law requires it, or to protect rights, safety and security.
Our service providers may only use the data to provide their services to us.
6. International transfers
Data is stored in Singapore and may be processed by Meta and AI providers in other countries. Where data leaves Sri Lanka or your country, we rely on contractual and technical safeguards consistent with applicable law, including Sri Lanka's Personal Data Protection Act, No. 9 of 2022.
7. How long we keep it
- Conversation and contact data: for as long as the Customer keeps its account, or shorter if the Customer sets a retention period or deletes the data.
- When a Customer leaves, we delete its data within 30 days unless the law requires us to keep it.
- Database backups: kept for up to 14 days, then overwritten.
- Audit and login records: kept for a limited period for security purposes.
8. Security
We use encrypted connections (HTTPS/TLS), encryption of stored access credentials, strict separation between Customers' data, role-based access control, audit logging, access-controlled file storage, firewalled servers, and regular security updates. No system is perfectly secure; we will notify affected Customers and authorities of a personal data breach as the law requires.
9. Your rights
Subject to applicable law, you can ask to access, correct or delete your personal data, object to or restrict processing, withdraw consent, or ask for a copy of your data. To stop receiving WhatsApp messages from a business that uses d2dl-crm, reply STOP in that chat; you will be opted out of further non-essential messages from that business.
10. Data deletion requests
To request deletion of your data:
- If you messaged a business on WhatsApp, ask that business to delete your data; it can delete your contact and conversation in d2dl-crm.
- Or email [email protected] with the phone number you used and the business you contacted. We will verify the request, work with that business, and confirm within 30 days.
11. Children
Our services are for businesses and are not directed at children under 16. We do not knowingly collect children's data; contact us if you think we have.
12. Changes
We will post changes to this page and update the effective date. Material changes will be notified to Customers in advance.
13. Contact
D2 Digital Labs
No: 14/18, 1st lane, Waragoda
Kelaniya, Western 11300
Sri Lanka
Phone: +94 78 270 1629
Email: [email protected]
Website: d2digitallabs.com