Privacy Policy

1. Who is responsible

When you write to a business that uses FRONTDESK, that business is the controller of your data. P.I.M.P. processes the data on its behalf and on its instructions (processor, Art. 28 GDPR).

For the data of businesses that sign up for FRONTDESK and of the people who administer it, P.I.M.P. is the controller:

Company

Programmatic Internet Marketing Powerhouse Ltd.

Address

Startup Center Gozo 9, Office No 11, Triq l-Għarb, Għarb, Ghawdex GRB 1102, Malta

Registration

C 115429 (Malta Business Registry)

VAT

MT32918717

You can reach us by e-mail to [email protected] or through our contact form.

2. What we process

• Messages you send to a business through FRONTDESK, including their content, time and message IDs.
• Contact data: your phone number or WhatsApp user ID, the profile name you chose in WhatsApp, and your e-mail address when you write by e-mail.
• Booking data you provide in the conversation, such as dates, the vehicle or room, the price, your name and any extras or notes.
• Business account data when a business connects its WhatsApp number: the IDs of its WhatsApp Business Account and phone number, its display name, and the result of each setup step. With the business's consent, WhatsApp may also send us its contacts and up to six months of chat history from the WhatsApp Business app.
• Administrator data: e-mail address, login times and an audit log of actions in the FRONTDESK panel.

3. Why we process it

To answer your enquiry, check availability, quote prices, record a booking you ask for, and hand the conversation to a person at the business when needed. The legal basis is the performance of a contract or steps you request before entering into one (Art. 6(1)(b) GDPR), and the business’s legitimate interest in answering enquiries quickly (Art. 6(1)(f) GDPR).

We also keep technical logs and an audit trail to operate the service securely and to show what the system did (Art. 6(1)(f) GDPR). Logs contain IDs, never message content.

4. Automated replies

Replies may be written by an AI system on behalf of the business. The first reply in a conversation says so. The AI only answers from information the business has provided, and a person at the business can take over any conversation at any time. If you want to speak to a person, just say so.

5. Who receives data

We use the following providers to run FRONTDESK. Each receives only what its part requires:

• Meta Platforms Ireland Ltd. — the WhatsApp Business Platform, which carries the messages.
• Anthropic PBC (USA) — the AI model that drafts replies. Anthropic does not use this data to train its models.
• Google Ireland Ltd. — Google Sheets, where the business keeps its availability and bookings, if it uses them.
• Microsoft Ireland Operations Ltd. — Microsoft 365 mailboxes, for businesses that connect e-mail.
• The hosting provider of the server FRONTDESK runs on.

Transfers outside the European Economic Area are based on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. We do not sell personal data and do not use it for advertising.

6. How long we keep it

Message texts are deleted from FRONTDESK 90 days after they were received. Message IDs, timestamps and the audit trail — without content — are kept for as long as the business uses FRONTDESK. Bookings are stored in the business’s own spreadsheet or system, and the business decides how long it keeps them. Access tokens received during WhatsApp setup are used once and not stored.

7. Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability (Art. 15–21 GDPR). As the business is the controller, you can contact it directly; you can also contact us by e-mail to [email protected] or through our contact form and we will pass your request on or handle it ourselves. How to have FRONTDESK delete your data is described on the data deletion page.

You may lodge a complaint with a supervisory authority, in Malta the Information and Data Protection Commissioner (idpc.org.mt).

8. Security

Data is transmitted encrypted (TLS). Access to the panel requires a password and a one-time code. Credentials are kept outside the database, and every administrative action is logged.

9. Changes

We update this policy when the service changes. The date at the top shows the current version.