Privacy Policy

1. Who we are

This Privacy Policy explains how Platform Commons Pvt. Ltd. (“Platform Commons”, “we”, “us”, “our”) collects, uses, shares and protects personal data. It applies to our website https://www.platformcommons.org, our platforms and applications, and our WhatsApp Business messaging services, together the “Services”.

Registered address: R904, HM Tambourine, Kananpura Road, Bangalore, India
Contact email: privacy@platformcommons.org

We are a technology provider. We build digital platforms that help organisations deliver services to farmers, communities and other beneficiaries, including through the WhatsApp Business Platform operated by Meta Platforms, Inc. and its affiliates (“Meta”).

2. Our role: Data Fiduciary and Data Processor

  • As a Data Fiduciary: we decide how and why personal data is processed for visitors to our website, people who contact us, and the representatives of the organisations we work with.
  • As a Data Processor: when we provide WhatsApp messaging and platform services to client organisations, we process their end-users’ data on their behalf and on their documented instructions. The client is the Data Fiduciary for that data and is responsible for getting valid consent from its end-users.

We follow the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), its Rules, the Information Technology Act, 2000, and other applicable laws.

3. Data we collect

a) From client organisations and their representatives

  • Name, job title, organisation name, business email, phone number and address
  • Business verification details and billing information
  • Account login details and usage logs for our platform

b) Through the WhatsApp Business Platform (on behalf of our clients)

  • WhatsApp phone number and WhatsApp profile name
  • Content of messages sent and received, including text, images, documents, audio, video and location shared by the user
  • Message metadata, such as timestamps and delivered, read and failed status
  • Message templates, WhatsApp Business Account (WABA) IDs, phone number IDs and related configuration data obtained through Meta’s APIs
  • Opt-in and opt-out records

c) Data about end-users and beneficiaries (on behalf of our clients)

  • Data a client organisation chooses to process through our platform. Examples: name, contact details, village or location, details of services availed, and programme records.

d) Automatically collected data

  • IP address, device and browser type, pages visited, and cookies (see Section 10)

We do not ask for or knowingly collect passwords to your WhatsApp or Facebook accounts.

4. How we use data (purposes)

We use personal data only for the following purposes:

  1. To send and receive WhatsApp messages on behalf of our client organisations
  2. To create, submit and manage message templates and WhatsApp Business Accounts for our clients
  3. To onboard clients through Meta’s Embedded Signup and to verify businesses
  4. To deliver programme services that our clients offer to their end-users
  5. To provide customer support, troubleshoot problems and keep our Services secure
  6. To produce aggregated, de-identified reports and analytics for our clients
  7. For billing, accounting and meeting our legal obligations
  8. To communicate with you about the Services, where you have agreed to this

Data received through Meta’s platforms (including WhatsApp Business Platform data) is processed only for the purposes described in this Policy and in line with Meta’s Platform Terms and the WhatsApp Business Messaging Policy. We do not use it for unrelated advertising, profiling or any other purpose.

5. Legal basis and consent

  • We process personal data with consent or for legitimate uses permitted under the DPDP Act.
  • Client organisations must get a clear opt-in from end-users before contacting them on WhatsApp, and must honour opt-out requests. End-users can stop messages at any time by replying “STOP” or by contacting the organisation that messaged them.
  • You may withdraw consent at any time by writing to us (Section 12). Withdrawing consent does not affect processing that took place before it.

6. How we share data

We do not sell personal data. We share it only as follows:

  • Meta / WhatsApp: messages are carried through the WhatsApp Business Platform (Cloud API), which Meta operates. Meta processes this data under its own terms and privacy policy: https://www.whatsapp.com/legal/business-policy and https://www.facebook.com/privacy/policy
  • Client organisations: we share data with the organisation on whose behalf it was collected
  • Service providers: cloud hosting ([e.g. AWS / Google Cloud / Azure]), [WhatsApp Business Solution Partner, if any, e.g. 360dialog], payment processors and support tools. Each is bound by contract to protect the data and use it only to provide services to us.
  • Legal requirements: where required by law, court order or a government authority, or to protect rights, safety and security

7. Where data is stored and international transfers

Data is stored on secure servers in [India / region, e.g. AWS Mumbai (ap-south-1)]. Some processing, including processing by Meta, may happen outside India. Any such transfer will follow the DPDP Act and any countries or territories restricted by the Government of India.

8. How long we keep data

  • We keep personal data only as long as it is needed for the purposes above or for as long as the law requires.
  • WhatsApp message content and metadata are kept for [e.g. 90 days / the duration of the client contract], unless the client tells us to delete them sooner.
  • When a client contract ends, we delete or return the client’s data within [30] days, unless the law requires us to keep it.
  • We delete personal data when (a) it is no longer needed for a legitimate business purpose, (b) we stop offering the Service that collected it, (c) the user asks us to delete it, or (d) the user closes their account. The exception is data the law requires us to keep, such as tax and accounting records, or data that has been aggregated or de-identified.

9. How we protect data

We use reasonable security safeguards, including:

  • Encryption of data in transit (TLS) and at rest
  • Role-based access controls and the least-privilege principle
  • Secure storage of API access tokens
  • Regular security reviews
  • Staff confidentiality obligations

If a personal data breach occurs, we will notify the Data Protection Board of India and the affected people as the DPDP Act requires.

10. Cookies

Our website uses essential cookies so it works properly, and may use analytics cookies to understand how it is used. You can control cookies through your browser settings.

11. Children’s data

Our Services are not directed at children under 18. We do not knowingly process children’s personal data without verifiable consent from a parent or lawful guardian, as the DPDP Act requires. We do not track, monitor behaviour or target advertising at children.

12. Your rights

Subject to applicable law, you have the right to:

  • Access a summary of your personal data and how it is processed
  • Correct, complete or update your personal data
  • Erase your personal data
  • Withdraw consent at any time
  • Nominate another person to exercise your rights if you die or become incapacitated
  • Raise a grievance and, if it isn’t resolved, complain to the Data Protection Board of India

To exercise any of these rights, email privacy@platformcommons.org. We respond within 30 days. If your data was processed for a client organisation, we will pass your request to that organisation and help it respond.

13. How to request deletion of your data {#data-deletion}

Any user of our Services can ask us to delete their data:

  1. Email privacy@platformcommons.org with the subject line “Data Deletion Request”.
  2. Include your name and the phone number or email address linked to your data. If you know it, also name the organisation that contacted you.
  3. We confirm we have received your request within 7 days.
  4. We delete your personal data, including data received through Meta’s platforms, within 30 days, and email you to confirm. The only exception is data the law requires us to keep.

To stop receiving WhatsApp messages immediately, reply “STOP” to the message.

14. Grievance Officer

Name: Aashish Aadarsh
Designation: Grievance Officer & Data Protection Officer
Email: privacy@platformcommons.org.
Address: R904, HM Tambourine, Kanankura Road, Bangalore, India.

We acknowledge grievances within 48 hours and resolve them within 30 days.

15. Changes to this Policy

We may update this Policy from time to time. Changes are posted on this page with a new “Last updated” date. For significant changes, we will notify affected users by email or through the Services.