Kanalia

Data Processing

When an organisation uses Kanalia to communicate with its own contacts, the organisation is the data controller and Kanalia is the processor. This page describes the processing we carry out and forms the basis of the data processing agreement we sign with customers.

Subject matter and duration

Provision of the Kanalia platform — unified inbox, AI bots, automations, campaigns, consent management and CRM — for the duration of the customer's subscription and any agreed migration period.

Nature and purpose

Collection, storage, routing, enrichment, automated processing and transmission of customer communications so that the customer can serve its own contacts across WhatsApp, voice and email.

Categories of data subjects

  • The customer's end customers, prospects and enquirers.
  • The customer's employees and agents using the workspace.

Categories of personal data

  • Identifiers: name, telephone number, email address, WhatsApp identifier.
  • Message content, attachments, call metadata and voice recordings if enabled.
  • CRM records: notes, tasks, tags, segments, timeline and activity history.
  • Consent records, opt-in source and opt-out events.
  • Technical data: timestamps, delivery status and interaction events.

Customers should not upload special category data unless expressly agreed in writing.

Sub-processors

We use cloud hosting, messaging channel providers (including Meta for the WhatsApp Business Platform), email delivery, telephony and monitoring providers. Each is bound by written terms with obligations no less protective than ours. Customers are notified of new sub-processors before they begin processing and may object on reasonable data protection grounds.

International transfers

Transfers outside the UK or the EEA rely on adequacy decisions, the EU Standard Contractual Clauses or the UK International Data Transfer Addendum, supported by encryption in transit and at rest.

Security measures

Encryption, role-based access control, workspace segregation, audit logging on Enterprise plans, continuous monitoring and tested backups. Details are set out on our security page.

Assistance, deletion and audits

We assist customers with data subject requests, breach notification and impact assessments. On termination, customer data is deleted or returned in a structured export within 30 days of request. Customers may request our security documentation and, where required by law, audit information.

Requesting an agreement

To receive a countersigned data processing agreement, email sales@kanalia.co.