1. Who is the controller
JCA WEB DESIGN S.R.L., CUI 46521660, J40/14146/2022, Str. Baba Novac nr. 8A, bl. C, et. 3, ap. 321, București, România, is the controller for MesajHub account, contracting, support, security and website administration data. Privacy contact: contact@mesajhub.ro.
2. GDPR roles in the platform
For contact, customer or end-user data uploaded by a MesajHub client, the client is normally the data controller and JCA WEB DESIGN S.R.L. acts as processor under the client’s instructions and the DPA.
3. Categories of data
- Account data: name, email, organisation, role, preferences and secured authentication information.
- Contract and billing data: plan, subscription, invoices/payments and information required for accounting obligations, when those features are active.
- Technical and security data: IP address, device/browser, access, audit and error logs.
- Meta/WhatsApp data authorised by the client: Business/WABA/phone identifiers, connection status, templates, messages and statuses necessary to provide the service.
- Client-uploaded data: contacts, tags, lists, segments, consent records and communication content.
4. Purposes and legal bases
- Contract performance: account creation, service functionality, support and subscription administration.
- Legal obligations: accounting, taxation and responses to competent authorities.
- Legitimate interests: security, fraud/abuse prevention, logging, legal defence and proportionate service improvement.
- Consent where required by law, for example for certain optional cookies or our own marketing communications.
5. WhatsApp and Platform Data
MesajHub uses data obtained through the Meta integration only to provide functionality requested by the client that connected those assets: WhatsApp Business connection and management, messaging, templates, contacts, conversations and statuses. We do not sell Platform Data or use it for independent advertising profiling or unrelated purposes.
6. Recipients and service providers
We may use infrastructure/hosting, communications, security, payment and support providers only as necessary. For WhatsApp, data may be transmitted to Meta and relevant entities under Meta/WhatsApp terms. The current categories of subprocessors can be requested using the contact email.
7. International transfers
Some third-party services, including global communications services, may involve processing outside the European Economic Area. In such cases we rely on the provider’s applicable lawful transfer mechanisms, such as adequacy decisions or standard contractual clauses, as relevant.
8. Data retention
We retain data for as long as necessary for the active account/service, legal obligations, security and dispute resolution. Data processed on behalf of a client is deleted or returned under contractual instructions, technical limitations and legal obligations. Specific periods may differ depending on data category and integrated providers.
9. Security
We apply proportionate technical and organisational measures including access control, separation of secrets, encryption of sensitive credentials where implemented, audit logging and HTTPS connections. No system can guarantee absolute security.
10. Your data protection rights
Subject to GDPR, you may request access, rectification, erasure, restriction, portability, objection and withdrawal of consent, as applicable. You may also lodge a complaint with the competent supervisory authority. For data processed on behalf of a MesajHub client, the controller-client may need to handle or authorise the request.
Requests: contact@mesajhub.ro.
11. Children’s data
MesajHub is a business service and is not directed at children. Clients must not upload children’s data unless they have an appropriate legal basis and the processing is necessary for their own service.
12. Updates
We may update this policy for legal, technical or product changes. The current version is always published here.