GDPR Compliance

1. Our commitment

Qnect is committed to complying with the UK GDPR and, where applicable, the EU General Data Protection Regulation. This page explains how GDPR principles apply to merchants using Qnect and to the customers who interact with a merchant's AI agent.

2. Controller & processor roles

For a merchant's account and business data, Qnect acts as the data controller. For customer data collected through a merchant's WhatsApp AI agent (names, phone numbers, orders), the merchant is the data controller and Qnect acts as a data processor, acting only on the merchant's instructions.

3. Legal basis for processing

We process personal data under one or more of the following legal bases: performance of a contract (providing the Service), legitimate interests (improving and securing the Service), consent (for optional analytics or marketing), and compliance with legal obligations (such as tax record-keeping).

4. Your rights under GDPR

Where GDPR applies, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure ("right to be forgotten"), subject to legal retention requirements.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with a supervisory authority.

To exercise these rights, contact hello@qnect.ai. If your data was collected through a merchant's AI agent, we may need to direct part of your request to that merchant, as the controller of that data.

5. Sub-processors

We use a small number of trusted sub-processors to deliver the Service:

• Vonage — routes messages to and from the Meta / WhatsApp Business Platform.
• Shopify — stores catalogue, order, and store configuration data.
• Stripe — processes payments and merchant payouts.
• Infrastructure and hosting providers used to run our servers and store data securely.

A full, up-to-date sub-processor list is available on request.

6. Data retention & deletion

When a merchant closes their Qnect account:

• The account enters a 14-day grace period, during which the AI agent is deactivated but the account can still be reinstated.
• Once the grace period ends, we take a final snapshot of account data for audit and legal purposes, and deletion begins.
• Personal data is permanently removed within 30 days of closure becoming final.
• Transactional and financial records are anonymized and retained for up to 7 years, as required for accounting and tax purposes.
• Any remaining snapshot data is permanently purged shortly after the deletion process completes.

7. International data transfers

Where personal data is transferred outside the UK or EEA — for example, to a sub-processor with infrastructure abroad — we rely on appropriate safeguards such as Standard Contractual Clauses to keep that data protected to UK/EU standards.

8. Data breach notification

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected merchants and, where required, the relevant supervisory authority, without undue delay and in line with GDPR requirements.

9. Data Processing Agreement

Merchants who need a signed Data Processing Agreement (DPA) covering Qnect's role as processor of their customer data can request one by contacting hello@qnect.ai.

10. Supervisory authority

UK-based merchants and customers can raise concerns with the Information Commissioner's Office (ICO), our lead supervisory authority.

11. Contact our Data Protection lead

For any GDPR-related question or request, contact hello@qnect.ai.