ITELSYSTEMS app privacy policy

• Data controller: the client business. For example, the clinic you write to on WhatsApp. That business decides what the data of its customers or patients is used for.
• Data processor: ITELSYSTEMS S.A.C. (RUC 20616088328, Alameda Monte Umbroso 225, Santiago de Surco, Lima, Peru). It processes that data only on the client's behalf, following its instructions and the contract, in accordance with Peruvian Law No. 29733 on Personal Data Protection and its Regulation (Supreme Decree No. 016-2024-JUS).
• On the ITELSYSTEMS test number (+51 981 349 108), which ITELSYSTEMS uses to show and test its agents, there is no client business: there, the data controller is ITELSYSTEMS S.A.C.
• What ITELSYSTEMS processes for itself (its website, its assistant Iris, people who write to ITELSYSTEMS) is governed by the website privacy policy.

The app processes the data that reaches the client's number through the WhatsApp API and the data the client's team records in its panel. Nothing else.

About the people who write to the client's number:

• Their phone number and their WhatsApp profile name.
• The content of their messages: text, images (for example, a medical order), voice notes and their transcription, documents and locations.
• The date and time of each message and its delivery status (sent, delivered, read or failed), with the cost reported by Meta.
• What the client's team records when serving them in the panel, for example an appointment: name, identity document if the person provides it, service, date, amount and status.
• If the client also uses its number in the WhatsApp Business app: the messages its team sends from that app and, if the client authorizes it when connecting its number, up to 6 months of previous conversations and its contacts, which Meta synchronizes at that moment.

Some of this data may be sensitive, such as the health data in a medical order. It is processed only on the client's behalf and with the measures described in section 6.

About the client business and its team:

• The data of its WhatsApp Business account: identifiers, number and display name.
• The authorization the client grants the app through Meta to use its number.
• Its team's panel accounts: name, email, role and activity.

The app does not receive Facebook or WhatsApp passwords, and it does not read group conversations.

The data is used only to provide the client with the WhatsApp customer service it contracted:

• Receiving messages, showing them to the client's team in its panel, and sending its replies.
• Letting the client's artificial intelligence agent answer or hand the conversation over to a person, as the client configures it.
• Sending the automatic messages the client turns on (confirmations, reminders, surveys), and only to people who wrote to the client's number first.
• Alerting the client's team when a conversation needs attention.
• Measuring for the client whether each message was delivered and what it cost.
• Keeping the service secure, supporting it and meeting legal obligations.

ITELSYSTEMS does not sell this data, does not use it for its own or third-party advertising, and does not use it to train its own artificial intelligence models.

To work, the app uses these technology providers. Each one receives only what its task requires:

The app's servers are in Brazil, and other providers, such as Meta and OpenAI, process data outside Peru. The data may therefore be subject to cross-border transfer, which is carried out with the safeguards of Law No. 29733 and its Regulation. ITELSYSTEMS only hands data over to an authority when the law requires it.

The data is kept while the contract with the client lasts and is then deleted, except for what the law requires to be kept.

• During the contract: conversations and panel records are kept so the client's team can serve people and follow up. The client can ask for a conversation to be deleted at any time.
• When the contract ends: the data is handed over to the client or deleted, as agreed, within 30 days.
• Backups: a daily copy of the database is made, kept for 14 days and then deleted automatically.
• System technical logs: rotated by size; the oldest entries are overwritten automatically.

The app applies technical and organizational measures to prevent unauthorized access, loss or misuse:

• All traffic is encrypted (HTTPS).
• Every notification Meta sends to the app is validated with its digital signature; anything not signed by Meta is rejected.
• The panel is used with individual accounts and roles: each member of the client's team sees only what their role needs.
• Images and documents from conversations, such as a medical order, are shown only to authenticated panel users.
• Access keys and authorizations are stored only on the server, never in the code.
• Administrative access to the servers is restricted to ITELSYSTEMS technical staff.
• ITELSYSTEMS staff and providers are bound by confidentiality.

You can ask for access to, rectification of, cancellation (deletion) of, or objection to the processing of your data.

• If you wrote to a business that uses ITELSYSTEMS: contact that business first, since it is the controller of your data. ITELSYSTEMS helps it handle your request.
• You can also write directly to ITELSYSTEMS at [email protected], stating your WhatsApp number and the business you wrote to. ITELSYSTEMS forwards your request to that business and, with its agreement, deletes your conversations and messages from the system within 10 business days. We will let you know when it is done.
• If you are a client business: when you remove the app's permission over your number in Meta, ITELSYSTEMS stops receiving data immediately. What is already stored is handed over or deleted as the contract establishes.

If you believe your request was not handled, you may go to the National Authority for the Protection of Personal Data (ANPD) of Peru's Ministry of Justice and Human Rights.

This policy may be updated when the way the app works or what the law requires changes. The current version is always the one published on this page, with its date at the top. If a change affects how your data is processed, we notify client businesses before it takes effect.

• ITELSYSTEMS S.A.C., RUC 20616088328.
• Alameda Monte Umbroso 225, Urb. Bella Luz, Santiago de Surco, Lima, Peru.
• Email for personal data matters: [email protected].