Effective Date: May 1, 2026
1. Introduction
ChatReach, a general partnership (Vennootschap Onder Firma) registered with the Dutch Chamber of Commerce under number 98527029, is responsible for the processing of personal data as described in this Privacy Policy.
At ChatReach, we take your privacy seriously. This Privacy Policy explains which personal data we collect, why we collect it, how we use it, and what rights you have.
We process personal data in accordance with the General Data Protection Regulation (GDPR), the Dutch Implementation Act (UAVG), and the Dutch Telecommunications Act (Telecommunicatiewet).
2. Who we are
Company name: ChatReach VOF
Address: Kazernestraat 17, 5928 NL Venlo, The Netherlands
Email: hello@chatreach.com
KVK number: 98527029
We act as:
Data Controller
For personal data of:
• Customers (account holders)
• Website visitors
• Prospects
• Individuals who contact us
This Privacy Policy primarily applies to these activities.
Data Processor
For personal data processed on behalf of our customers through our platform (e.g. their contacts and message content).
In this role:
• We act strictly on instructions of our customers
• A Data Processing Agreement (Verwerkersovereenkomst) applies
• End users must contact the relevant ChatReach customer to exercise their rights
3. Personal data we process
3.1 Account and contact data
• First and last name
• Company name and business details
• Address data
• Phone number
• Email address
• Login credentials (passwords are securely hashed)
3.2 Payment and billing data
• IBAN / bank account number
• Payment details (via providers such as Stripe or Mollie)
• VAT number
• Invoicing data
3.3 Technical data
• IP addressLocation data (derived from IP, at country/city level)
• Browser and device type
• Usage and activity data
3.4 Communication data (as Data Processor)
• Message content sent via our platform
• Contact details of end users
• Phone numbers of recipients
• Conversation metadata (timestamps, delivery status, read receipts)
3.5 Marketing data
• Newsletter preferences
• Campaign engagement
• Interaction with content
3.6 Shopify data
When a merchant installs or connects ChatReach with Shopify, we may process personal data received through Shopify’s APIs and related services. Depending on the functionality enabled by the merchant, this may include:
• Customer first and last name
• Email address
• Phone number
• Shopify customer identifiers
• Order and fulfillment information
• Cart and checkout information
• Product and purchase information
• Marketing and consent status
• Information necessary to trigger customer journeys and automations
ChatReach only requests and processes Shopify personal data that is necessary to provide the functionality selected and used by the merchant.
4. Source of personal data
We collect personal data:
• Directly from you
• Automatically via cookies and logs
• From third parties, including:
• Meta Platforms Ireland Ltd. (WhatsApp Business integration)
• Integration partners (e.g. Zapier)
• Payment providers
• Public sources (e.g. Chamber of Commerce)
• Shopify, when a merchant installs or connects the ChatReach Shopify integration
5. Consequences of not providing data
Providing personal data is not legally required, but necessary for using our services.
Without required data, we cannot:
• Create your account
• Process payments
• Provide the platform
6. Protection of minors
Our services are intended for business users and not directed at individuals under 16 years of age.
If we become aware of data collected from minors without consent, we will delete it.
7. Purpose and legal basis
We process personal data based on Article 6 GDPR:
Contractual necessity (Art. 6(1)(b))
• Account creation and management
• Platform delivery
• Messaging services (WhatsApp campaigns, automations)
• Payments and invoicing
• Customer support
Legal obligation (Art. 6(1)(c))
• Tax and accounting compliance
• Regulatory obligations
• Legitimate interest (Art. 6(1)(f))
• Product improvement and analytics
• Security and fraud prevention
• Direct marketing to existing customers
• Service updates
Consent (Art. 6(1)(a))
• Marketing communications to prospects
• Non-essential cookies
• Cross-site trackingYou may withdraw consent at any time.
Shopify integration and merchant services
Where a merchant connects ChatReach with Shopify, we process Shopify data solely as necessary to provide the functionality requested by the merchant, including:
• Synchronizing customer and order information
• Sending transactional WhatsApp messages and order updates
• Creating and sending WhatsApp marketing campaigns
• Creating customer segments
• Running automated customer journeys
• Abandoned cart and checkout recovery
• Customer re-engagement and retention campaigns
• Providing campaign and performance analytics
We do not use Shopify customer data for purposes unrelated to providing and securing the ChatReach services.
8. Customer consent and marketing preferences
When ChatReach processes personal data on behalf of a merchant, the merchant is responsible for ensuring that it has an appropriate legal basis for the processing and communications it performs through ChatReach, including obtaining consent where required by applicable law.
ChatReach provides functionality to support merchants in managing customer communication preferences and marketing consent.Where a customer withdraws consent or opts out of marketing communications, ChatReach respects and applies the relevant consent or communication preference within the services we provide on behalf of the merchant.
ChatReach does not sell personal data or use merchant customer data for independent advertising purposes.
9. Automated decision-making
ChatReach does not use automated decision-making or profiling that produces legal or significant effects.
Automated marketing workflows configured by merchants do not constitute automated decision-making by ChatReach that produces legal or similarly significant effects on individuals.
10. Data retention
We retain personal data only as long as necessary:
• Account data: Duration + 2 years
• Financial data: 7 years
• Platform communication data: Duration of subscription
• Marketing data: Until consent withdrawal
• Support tickets: 3 years
• Analytics: Up to 26 months
• Logs: 12 months
• Cookie consent: 12 months
Shopify customer and order data:
Retained for as long as necessary to provide the services requested by the merchant. Following termination or disconnection of the Shopify integration, the data is deleted or anonymized in accordance with our deletion procedures, unless retention is required by applicable law.Platform communication data: Retained for the duration of the subscription and deleted or anonymized within 48 hours after termination, unless a longer retention period is legally required.Backups: Deleted according to our backup retention cycle within 48 hours after the data has been removed from our active systems.
11. Sharing personal data
We do not sell personal data.
We share data only when necessary with:
• Meta Platforms Ireland Ltd. (WhatsApp Business Platform)
• Payment providers (e.g. Stripe, Mollie)
• Hosting and infrastructure providers (EU-based where possible)
• Email and communication providers
• Analytics providers
• Accounting services
• Integration partners (when enabled by you)
• Legal advisors and authorities when required
ChatReach supports privacy and data subject requests received through Shopify. Where applicable, ChatReach processes requests relating to access to or deletion of Shopify customer personal data in accordance with applicable law and Shopify’s privacy requirements. When ChatReach receives a valid request through Shopify’s privacy mechanisms, we take the required action within the applicable timeframe, unless applicable law requires us to retain the relevant information. Following the uninstall of the ChatReach Shopify app, Shopify store and customer personal data is deleted or anonymized in accordance with our retention policy, unless retention is required by applicable law.
All processors operate under Data Processing Agreements.
12. International data transfers
Where data is transferred outside the EEA, we ensure appropriate safeguards:
• Standard Contractual Clauses (SCCs)
• EU adequacy decisions
• EU-U.S. Data Privacy Framework (where applicable)
13. Security
We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction.
Technical measures include, where applicable:
• TLS encryption for data in transit
• Encryption of personal data at rest
• Encryption of backups containing personal data
• Separation of production and test environments
• Firewalls and security monitoring
• Access logging and monitoring
• Secure password storage using appropriate hashing mechanisms
• Regular backups and recovery procedures
• Security updates and vulnerability management
Organizational measures include:
• Role-based and need-to-know access controls
• Strong password requirements and multi-factor authentication where appropriate
• Confidentiality obligations
• Security awareness and training
• Incident response procedures
• Periodic review of access permissions
14. Data breaches
IWe maintain procedures to identify, assess, investigate, and respond to personal data breaches.Where required under applicable law, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach. Where required, we notify affected individuals.
When ChatReach acts as a Data Processor, we notify the relevant Data Controller of a personal data breach in accordance with applicable law and our Data Processing Agreement.
15. Your rights
Under GDPR, you have the right to:
• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction (Art. 18)
• Data portability (Art. 20)
• Object (Art. 21)
• Withdraw consent
Requests can be sent to: hello@chatreach.com
We respond within one month.
16. Complaints
You may file a complaint with the Autoriteit Persoonsgegevens.
We encourage you to contact us first.
17. Cookies
We use:
• Necessary cookies
• Analytical cookies
• Marketing cookies (with consent)
A detailed overview is available in our Cookie Statement.
18. Changes
We may update this Privacy Policy.
Material changes will be communicated at least 30 days in advance.
19. Data Protection Officer
ChatReach has assessed Article 37 GDPR and determined that appointing a Data Protection Officer is not required.
21. Related documents
• Terms & Conditions
• Data Processing Agreement (DPA)
• Cookie Statement
