At Wiraya Solutions AB, we prioritize the privacy and security of your information. This Privacy Policy
outlines how we collect, use, and protect your data when using our communications platform as a service
(CPaaS) to send communication messages. We are committed to managing as little personally identifiable
information (PII) as possible and ensuring transparency in data handling. Please note that our clients are
responsible for ensuring the lawful processing of contact data used on our platform.
1. Information We Collect
We minimize the collection of personal data to ensure the highest level of privacy. Typically, only the phone
number of the recipient is required for communication through our platform. The categories of data we
may collect include:
- Platform Usage Data: Data on how clients interact with our platform, including log data, IP
addresses, device information, and analytics to improve service functionality and security. - Client Account Information: Data needed to manage client accounts, including names, email
addresses, etc. - Contact Information: Clients may upload contact details such as phone numbers or email
addresses to facilitate communication with their customers. It is the client’s responsibility to
ensure that this data is accurate and that this processing is lawful. - Demographic Information: Depending on the client’s preferences and requirements, additional
demographic data (e.g., language, age, gender) may be provided by the client in order to personalize
communications. - Customer Segment Information: Clients may provide enrichment data about their customers
based on segments (e.g., product, service type) to better target communications. This data is
processed as instructed by the client. - User-Generated Data: Actions taken by data subjects, such as responses to messages,
interactions with calls, or other engagement activities, may be collected as Interaction Data to
track the effectiveness of the communication. - Communication Metadata: While using our platform to send communication, we may collect
metadata such as message timestamps, delivery statuses, and communication logs, etc.
2. Client Responsibility for Legal Processing of Contacts
Our clients are solely responsible for ensuring that the processing of contacts, including the collection,
storage, and sharing of contact information (e.g., phone numbers, etc.), complies with applicable data
protection laws. This includes but is not limited to, obtaining proper consent from individuals to receive
communication messages and respecting the rights of data subjects as defined by GDPR.
Clients are responsible for ensuring they have a lawful basis for sending communications, such as obtaining
explicit consent or relying on legitimate interests or contractual necessity. We act solely as a data processor
in facilitating the communication, while our clients are the data controllers, ensuring lawful data collection,
processing, and storage.
3. How We Use Your Information
- We use the information collected to:
- Provide and maintain the functionality of our communication platform
- Facilitate the sending of communication messages on behalf of clients
- Improve the performance and user experience of our platform through analytics and technical
enhancements - Ensure compliance with applicable legal obligations
- Provide customer support and communicate about updates, security alerts, and important notices
4. Data Processing and Storage
Wiraya Solutions AB operates as a service provider (processor) to our clients processing data on their
behalf and under their instructions. We do not access or use message content or contact data for any
purpose beyond what is necessary to provide our services.
We do not share or disclose PII except in the following situations:
- Service Providers: We may share data with trusted third-party service providers who assist in
operating and maintaining our platform. These providers offer services such as cloud storage,
infrastructure, and communication delivery, (e.g., SMS, email, WhatsApp messages, phone calls).
We ensure that our sub-processors comply with the same data protection standards. - Legal Compliance: We may disclose information to comply with legal obligations or respond to
legal processes, such as subpoenas or court orders.
5. Minimization of Personally identifiable information (PII)
We are committed to minimizing the collection and storage of PII. Where possible, we use aggregated or
anonymized data for analytics and reporting purposes. Any contact information provided to us (such as
phone numbers) is processed securely in accordance with this policy.
6. Data Subject Rights
Under GDPR, individuals whose data is processed have specific rights, which our clients, as data
controllers, are responsible for upholding:
- Right to Access: Individuals have the right to access their personal data.
- Right to Rectification: Individuals can request corrections to their personal data.
- Right to Erasure (Right to be Forgotten): Individuals can request the deletion of their personal
data. - Right to Data Portability: Individuals have the right to request the transfer of their personal data
to another controller. - Right to Object or Restrict Processing: Individuals can object to certain types of processing, such
as direct marketing.
We provide tools within our platform to assist clients in managing these requests.
7. Data Security
We implement robust technical and organizational measures to protect personal information against
unauthorized access, loss, or disclosure, in full compliance with the General Data Protection Regulation
(GDPR). Our security measures include encryption, secure data transmission protocols, and strict access controls.
We regularly assess and update our security practices to align with GDPR Article 32 and evolving
standards.
8. Data Breach Notification
In the event of a data breach involving personal information, we will notify the client (data controller)
without undue delay in accordance with our Incident Response and Management Policy, in compliance with
GDPR, to allow them to meet their obligations for informing data subjects and relevant supervisory
authorities.
9. Data Retention
We retain personal data only as long as necessary to fulfill the purposes outlined in this policy or as
required by law. Our default retention period for personal data is 120 days. After this period, personal data
is securely deleted or anonymized. Clients may adjust retention periods as needed in compliance with legal
obligations in our platform.
10. Data Processing Agreement (DPA)
Wiraya Solutions AB enters into a Data Processing Agreement (DPA) with each client, detailing the
responsibilities of both parties concerning the processing of personal data. The DPA outlines the scope of
data processing, security measures, and obligations in line with GDPR.
11. International Data Transfers
All of our data is stored within the EU and EEA regions. However, as a global CPaaS provider, we may
transfer data across borders to deliver our services in accordance with our client’s instructions. Any such
transfers are conducted in full compliance with applicable data protection regulations, including GDPR,
using appropriate safeguards such as Standard Contractual Clauses (SCCs). By using our platform, you
consent to these transfers as necessary for the provision of our services.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an
updated effective date. We encourage clients to review this policy regularly to stay informed about our data
protection practices.
13. Contact Us
If you have any questions or concerns about this Privacy Policy, please contact us at:
- Email: compliance@wiraya.com
- Address: Slöjdgatan 9, 111 57 Stockholm, Sweden
- Website: www.wiraya.com