Privacy Policy

Sum Vivas Ltd (Company Number: 11923412), whose registered office is at B11 Block B Business First, Goodlass Road, Liverpool, L24 9HJ, (“Sum Vivas,” “we,” “our,” or “us”) is committed to protecting the privacy and security of your personal data.

This Privacy Policy explains how we collect, use, process, disclose, and safeguard your personal data when you interact with our website located at www.sumvivas.com, our services, and our conversational AI agents deployed across various communication platforms, including but not limited to WhatsApp, Instagram, Facebook Messenger, and Web chat interfaces (collectively, the “Services”).

This policy applies where we are acting as a data controller with respect to the personal data of our Service users; in other words, where we determine the purposes and means of the processing of that personal data.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy.

1. Personal Data We Collect

We collect personal data from you in various ways when you use our Services:

a. Information You Provide Directly

We collect personal data that you voluntarily provide to us when you interact with our Services.

• Contact and Identification Data: Such as your full name, email address, phone number, and company name when you contact us or register for certain services.
• Communication Data: The content of messages and other communications you send to us or our AI agents through chat interfaces, including any personal information contained within those messages.
• Support and Feedback Data: Information you provide when submitting customer service or support queries, survey responses, or feedback.

b. Information Collected Automatically

When you access and use our Services, we may automatically collect certain information from your device and your interaction with the Services.

• Technical Data: Device identifiers, browser type and version, operating system, IP address, timestamps, and interaction metadata (e.g., duration of interaction).
• Usage Data: Information about how you use our Services, such as pages viewed, features used, chat logs, message delivery status, and error logs. This data helps us understand user behaviour and identify technical issues.

c. Information from Third-Party Platforms

When you integrate with or use our Services through third-party platforms (Google, Microsoft, Meta), we receive information via the APIs and webhooks provided by those platforms.

Meta Platforms (Facebook, Instagram, WhatsApp)

• Platform Identifiers: Usernames, User IDs, Page IDs, and Business Account IDs.
• Message Content: Incoming messages, DMs, and metadata (timestamps, message direction) required to process and respond to inquiries.
• Page/Business Data: Lists of Pages you manage (to enable selection for connection) and basic business profile info.

Email Platforms (Gmail, Microsoft Outlook)

• Account Data: Your email address and basic profile information to identify the account.
• Email Content: The content of emails (headers, subject, body, attachments) to display them in your inbox and enable replies via our platform.

Calendar Platforms (Google Calendar, Microsoft Calendar)

• Event Data: Calendar event details (title, time, attendees, description) to check availability and schedule meetings.

We are not responsible for the privacy practices of these third-party platforms. Your use of these platforms is subject to their respective terms of service and privacy policies.

2. Purposes and Legal Bases for Processing Personal Data

We process your personal data for specific purposes and rely on defined legal bases under UK GDPR and DPA 2018:

Where we rely on legitimate interests, we ensure that our interests are balanced against your data protection rights and freedoms. We will not process your personal data on this basis if your rights override our legitimate interests.

Where we rely on consent, you have the right to withdraw your consent at any time.

3. Data Anonymisation and Aggregation

Where feasible and appropriate, particularly for large-scale analytics, service improvement, or data from public deployments (like kiosks), we anonymise or aggregate personal data. Anonymised data is data that cannot be linked back to an identifiable individual. Aggregated data is compiled from multiple sources in a way that individual data points are not identifiable.

Anonymised and aggregated data is not considered personal data and may be used for analytical, statistical, and service improvement purposes without restriction and retained indefinitely.

4. Sharing and Disclosure of Personal Data

We may disclose your personal data to the following categories of recipients where necessary and in accordance with this policy:

• Third-Party Platform Providers: With platforms like Meta Platforms Inc. (for Instagram, Facebook Messenger, WhatsApp Business API) to the extent necessary to send and receive messages and enable real-time conversational interactions via our Services.
• Service Providers: With third-party vendors, consultants, and other service providers who perform services on our behalf, such as cloud hosting providers, infrastructure providers, API processors, log aggregators, analytics providers, and security services. These third parties are contractually obligated to process data only in accordance with our instructions and to maintain appropriate security measures.
• Legal and Regulatory Authorities: If required to do so by law or in response to valid requests by public authorities (e.g., a court order, government regulator).
• Business Transfers: In connection with or during negotiations of any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.
• With Your Consent: We may disclose your personal data to any other third party with your prior consent.

We do not sell, rent, or trade your personal data to third parties for their direct marketing purposes without your explicit consent.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Our specific retention periods are determined based on the type of data, the purpose for processing, and legal requirements. Examples include:

• Chat Logs (from Social Media/Messaging Platforms): Retained for a period of up to 12 months. This duration allows for service continuity (e.g., maintaining context in conversations), troubleshooting, analytics, and service improvement. After this period, logs may be anonymised or deleted.
• Public Deployment Interaction Logs (Anonymised): Anonymised interaction logs may be stored indefinitely for long-term service improvement and statistical analysis.
• Client Configuration Files and Webhook Payloads: Retained as long as necessary for operational continuity of client-specific services.
• User profiles and identifiers from platforms (e.g., Facebook ID): Retained only while the integration enabling communication on that platform is active and required to maintain your interaction history on that platform.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

6. Your Data Protection Rights

Under UK GDPR and DPA 2018, you have the following rights regarding your personal data:

• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request correction of inaccurate or incomplete personal data we hold about you.
• Right to Erasure (“Right to Be Forgotten”): To request the deletion of your personal data, where there is no compelling reason for us to continue processing it (subject to certain legal exceptions).
• Right to Restriction of Processing: To request that we suspend the processing of your personal data in certain circumstances (e.g., if you contest its accuracy).
• Right to Data Portability: To request a transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format, where technically feasible and based on consent or contract.
• Right to Object: To object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
• Right to Withdraw Consent: If we are processing your personal data based on your consent, you have the right to withdraw that consent at any time.
• Rights in relation to Automated Decision Making and Profiling: The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in certain limited circumstances. Our core services do not currently involve automated decision-making that produces such effects.

These rights are subject to certain conditions and exceptions under the law.

To exercise any of these rights, please contact us using the details provided in Section 12. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

You also have the Right to Lodge a Complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Their website is: https://www.ico.org.uk. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

7. Data Security

We have implemented appropriate technical and organisational security measures designed to protect your personal data from accidental loss, unauthorised access, use, alteration, or disclosure. These measures include:

• Encryption of data in transit (e.g., using TLS/SSL for webhook and API traffic).
• Secure access controls and authentication mechanisms for our systems and administrative interfaces.
• Regular monitoring of system activity and security alerts.
• Undertaking regular assessments of the security of our systems.

While we strive to protect your personal data, no security system is completely impenetrable. We cannot guarantee the absolute security of your data transmitted to our Services.

Any transmission is at your own risk.

8. International Transfers

Your personal data may be stored and processed in countries outside of the United Kingdom (UK) or the European Economic Area (EEA). This may occur if our service providers, cloud infrastructure, or integrated platforms operate in such locations.

When transferring your personal data outside the UK or EEA, we take steps to ensure that your data is protected to the same standard as it would be within the UK/EEA. We rely on recognised international data transfer mechanisms, such as:

• Adequacy Decisions: Transferring data to countries deemed by the UK or European Commission to have an adequate level of data protection.
• Standard Contractual Clauses (SCCs): Implementing the relevant UK or EU Standard Contractual Clauses with the recipient, supplemented by additional safeguards where necessary. For UK transfers, we use the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs.
• Ensuring service providers adhere to approved codes of conduct or certification mechanisms where applicable.

By using our Services, you understand that your personal data may be transferred to countries outside the UK/EEA that may not provide the same level of data protection.

9. Children’s Privacy

Our Services are not intended for use by individuals under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently collected personal data from a child under 13, we will take steps to delete that information as quickly as possible.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The “Effective Date” at the top of this policy indicates when it was last revised.

If we make significant changes, we will notify you by posting a prominent notice on our website or through other appropriate communication channels before the changes take effect. Your continued use of the Services after the effective date of the revised policy constitutes your acceptance of the terms.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, or if you wish to exercise your data protection rights, please contact us:

Sum Vivas Ltd
B11 Block B Business First, Goodlass Road, Liverpool, L24 9HJ
UK Company Registration Number: 11923412
Email: privacy@sumvivas.com