12. WhatsApp Business demo module

This section describes the specific processing carried out by VortekAI’s WhatsApp Business module and, for this demo, takes precedence over the website’s general descriptions. The controller is VORTEK AI, S.L., with the details and contact information given in section 2.

The demo lets you view our WhatsApp test assets, view and create utility templates and send certain approved templates to an authorised test recipient. It does not automatically onboard third-party businesses or receive their conversations or delivery statuses. A future commercial service will have information and terms adapted to how it works.

Data, sources and uses

• Access: email, account identifier and authentication data of authorised users, to identify them and limit their permissions.
• Business assets: WhatsApp account identifiers and name, sender number and template data (name, text, language, category and status), obtained from Meta to display and manage the authorised assets.
• Test sends: the recipient’s phone number, the chosen template, the authorisation for the test and the identifier Meta returns when it accepts the request. Meta’s acceptance does not, on its own, prove delivery or reading.
• Security and review: protected technical credentials, necessary technical logs and evidence of operation to assess the application. A recording may show the test number and data of the authorised participant.

The module displays Meta’s responses during the session and does not keep its own conversation history. Accounts, credentials and evidence are stored separately. Providers may generate their own operational logs. This demo does not send messages to artificial intelligence tools and is not used for advertising or profiling.

Legal basis and voluntary participation

Managing and protecting access is based on our legitimate interest in restricting the module to authorised people and preventing misuse. We apply limited permissions, and you may object on grounds relating to your particular situation.

Voluntary tests will be carried out with specific, informed consent. Where an identifiable recording is needed for Meta’s review, separate authorisation will be requested for that purpose. It does not authorise open publication or advertising use. You can decline to take part or withdraw your consent by writing to contacto@vortekai.es; withdrawal does not affect the lawfulness of earlier processing. Access data is required to enter the demo, and a phone number is required to receive a requested test.

Recipients and providers

• Meta and WhatsApp: manage the assets and transmit the messages. Meta receives the evidence provided to review the application’s permissions. The WhatsApp service for users in the European Economic Area is described in the WhatsApp Ireland Limited policy; business operations are also governed by the WhatsApp Business data processing terms.
• Supabase Pte. Ltd.: authentication, running the application server and protecting its secrets, under its data processing addendum and its list of subprocessors.
• Contabo GmbH: hosting of the server and the administration environment, where code, operational credentials and private evidence are stored. A data processing agreement has been signed with VORTEK AI SL. Its annex identifies Contabo France SAS as the data centre provider in France.
• Cloudflare, Inc.: transmission and protection of traffic to the platform and the administration environment, which may involve processing IP addresses, metadata and content passing through the service. Its processing agreement and its subprocessor information apply.

Location and international transfers

Supabase’s main database is configured in Ireland; function execution has been observed in France. These locations do not, on their own, limit the processing of all services, logs or support access. The providers above operate internationally and may process data, or allow access to it, from outside the European Economic Area.

The linked agreements set out safeguards for transfers, including the European Commission’s standard contractual clauses and, where applicable to the entity and the processing, adequacy decisions. We do not claim that all processing takes place exclusively in the European Union. You can check the safeguards at the links above or ask contacto@vortekai.es for information about transfers and a copy of the applicable safeguards. We are asking the providers for details of all access countries and the retention periods of their logs, and we will update this notice when we receive relevant information.

Retention and deletion

We keep technical accounts and identifiable evidence for as long as they are needed for the review or an appeal. When the process is closed or abandoned, we will manually review whether they need to be kept, remove exclusive access and credentials that are no longer needed and delete identifiable evidence that should not be kept. Any exceptional retention must be based on a specific reason, such as a legal obligation or the defence of a claim, and will be reviewed once that reason no longer applies.

Providers’ logs and backups follow their own contractual and technical criteria. Access to Supabase Pro daily backups for seven days does not mean that all logs or backups are universally deleted on the seventh day. There is no single deletion period that applies to all providers. We will request the appropriate erasure and inform you of any limitations or legal retention affecting your request.

Rights and withdrawal of permissions

Where applicable, you may exercise the rights of access, rectification, erasure, restriction, objection and portability, withdraw your consent and lodge a complaint with the Spanish Data Protection Agency. Write to contacto@vortekai.es and, if you are requesting deletion, follow the Meta data deletion instructions (in Spanish). We will verify your entitlement in a proportionate way. Withdrawing a permission in Meta may prevent new operations, but it does not automatically delete copies kept by VortekAI or its providers.

See also the demo terms (in Spanish).