Our role
For the personal data you and your customers put into the inbox, OonoBox acts as a data processor. You remain the data controller and decide what is collected and why. For account and billing data we hold about your business, we act as the data controller.
Lawful bases
We process personal data on the following lawful bases:
- Performance of a contract — to provide the service you signed up for.
- Legitimate interests — to keep the service secure, prevent abuse, and improve reliability.
- Consent — for optional features that depend on it, where applicable.
- Legal obligation — to comply with applicable law and lawful requests.
Data subject rights
Where applicable law gives data subjects rights (access, rectification, erasure, restriction, portability, objection), we support those rights:
- If you are an OonoBox customer, manage your data from workspace settings or email privacy@oonobox.co.zw.
- If you are an end customer of an OonoBox customer, please contact the business you were messaging; they control the data.
International transfers
Customer conversation data is stored in the region you selected at signup. Where data crosses borders, we rely on standard contractual clauses or equivalent safeguards.
Subprocessors
We use a small set of subprocessors to operate the service (cloud hosting, payments, email delivery, error monitoring, the WhatsApp Business Platform). A current list is available on request to privacy@oonobox.co.zw.
Retention & deletion
Conversation data is retained while your account is active. After cancellation, data is available for export for 30 days and deleted from production systems within 90 days. Backups are rotated within 12 months.
Security incident notification
In the event of a personal data breach affecting your data, we will notify you within 72 hours of becoming aware, with the information you need to meet your own notification obligations.
Contact
Reach our data protection contact at privacy@oonobox.co.zw.