Privacy Policy

Comercializadora Web SAS (trade name: Cachalotlab), Colombian tax ID (NIT) 901.048.721, located at Carrera 53 # 75-138, piso 2, oficina 17, Barranquilla, Atlántico, Colombia, operates the Domitienda platform (https://www.domitienda.co). Contact for personal data matters: privacidad@domitienda.co.

Domitienda is a product owned by Comercializadora Web SAS and is not a separate legal entity. In this policy, "Domitienda", "we", "us" and "our" refer to Comercializadora Web SAS.

Domitienda is a technology platform that lets businesses ("Clients") connect their phone numbers to the WhatsApp Business Platform and send and receive messages from their own systems through our API.

• As data controller, we process the data of our Clients and their representatives and platform users.
• As data processor, we process the data of people who message our Clients on WhatsApp ("End Users"). We do so on behalf of, and following the instructions of, the Client. The Client is the controller of that data and is responsible for obtaining End Users' consent.

Clients: name, company name, tax ID, job title, email, phone, billing details, credentials and API keys, platform usage logs, Meta asset identifiers (business portfolio, WhatsApp Business Account and phone number IDs) and access tokens issued by Meta.

End Users: phone number and WhatsApp ID, profile name, message content (text, images, audio, video, documents and location), metadata (date, time, delivery and read statuses, message IDs) and the templates used.

We do not request sensitive data. If an End User includes it in a message, it is processed only to deliver it to the Client.

• Provide the service: relay messages between the WhatsApp Business Platform (Cloud API) and the Client's systems, and manage templates, phone numbers and webhooks.
• Onboard Clients through Meta's Embedded Signup flow and manage the WhatsApp assets each Client authorizes.
• Provide technical support, ensure security, prevent fraud and abuse, and check compliance with WhatsApp policies.
• Bill and manage the contractual relationship.
• Comply with legal obligations and requests from authorities.

We do not sell personal data or use message content for advertising.

To provide the service, we share data with:

• Meta Platforms, Inc. and WhatsApp LLC, which provide the WhatsApp Business Platform (Cloud API). Their processing is also governed by their own terms and policies.
• Amazon Web Services, Inc. (AWS), with servers in the United States, where our platform and databases are hosted.

This involves an international transfer of data to the United States, carried out under Colombian Law 1581 of 2012 and its regulations, with contracts that require providers to protect the data. We do not share data with other third parties, except when ordered by a competent authority.

• Message content and files: up to 1 year from when they are sent or received.
• Metadata and delivery logs: up to 3 years, for support, security and auditing.
• Client data: for the duration of the contract and afterwards for the periods required by accounting, tax and commercial law.

When the contract ends, the Client may request the export or deletion of its End Users' data. We delete it within 30 days, unless the law requires us to keep it.

We apply reasonable technical and administrative measures: encryption in transit (TLS), encryption at rest for access tokens and credentials, role-based access control, audit logs and signature validation of Meta webhooks. No system is infallible. If an incident affects personal data, we will notify the affected Clients and the Superintendence of Industry and Commerce as required by law.

Under Article 8 of Law 1581 of 2012, data subjects may:

• Access, update and correct their data.
• Request proof of the consent they gave.
• Be informed of how their data has been used.
• File complaints with the Superintendence of Industry and Commerce (SIC).
• Revoke consent or request deletion of their data where applicable.
• Access their data free of charge.

End Users should first contact the business they messaged on WhatsApp, which is the controller of their data. If a request reaches us, we will forward it to that business and help it respond.

Send requests to privacidad@domitienda.co with your name, ID number, the related phone number and the specific request.

• Inquiries: answered within 10 business days, extendable by 5 more business days.
• Claims: answered within 15 business days, extendable by 8 more business days.

Clients: to disconnect your account and request deletion of your data, email privacidad@domitienda.co with the subject "Data deletion", including your tax ID and WhatsApp Business Account ID. You can also remove Domitienda's access to your assets in your Meta business portfolio settings.

End Users: you can request deletion from the business you messaged, or email us at privacidad@domitienda.co with your phone number.

We confirm every deletion by email.

This policy is effective from the last updated date shown above. If we make material changes, we will notify Clients by email and publish the new version on this page.