Your Data Rights

Last updated: 10 October 2026 This page explains how to raise a data-protection request relating to BotMessaging and how the service's export, retention and privacy controls support business customers. Our Privacy Policy explains the categories of information processed, purposes, recipients and handling in more detail. 1. Who is responsible for your information For information used to administer BotMessaging's own website, accounts, subscriptions and support, BotMessaging determines the purposes of processing. For customer information held in a business's workspace, the business generally determines the purposes and instructs BotMessaging to process the information on its behalf. If your request concerns a conversation, order, enquiry, booking or campaign from a business using BotMessaging, contact that business first. It is normally responsible for deciding and responding to the request. You can also use our contact page to help identify the relevant workspace or direct your request appropriately. 2. Rights that may apply Where the General Data Protection Regulation applies to the processing, individuals have rights subject to the conditions and exceptions in that law. Depending on the circumstances, these include: Receiving understandable information about how personal information is used. Accessing personal information and obtaining a copy. Correcting inaccurate information or completing incomplete information. Requesting erasure when the legal conditions for erasure are met. Restricting processing in applicable circumstances. Receiving certain information in a portable format. Objecting to processing in applicable circumstances, including direct marketing. Withdrawing consent where processing relies on consent. Receiving the protections that apply to certain decisions based solely on automated processing. Withdrawing consent does not affect the lawfulness of earlier processing. Erasure and other rights can be limited by requirements such as retaining legally necessary records or protecting another person's rights. Other applicable laws may provide additional or different rights. 3. Making a request Use our contact page and identify the account, business or interaction concerned. Explain what you are requesting and provide a way for us to reply. Do not send account passwords, API keys, payment-card details or unrelated sensitive information. We may ask for proportionate information to verify your identity or your authority to act for someone else. We also consider whether a disclosure would expose another person's information. For workspace information processed on a business's behalf, we assist that business with the request within our role. Where the GDPR response timetable applies, a response is normally due within one month. The law allows an extension of up to two further months for qualifying complex or numerous requests, with an explanation within the first month. If a request cannot be fulfilled, the response should explain the reason and the available complaint or challenge routes. 4. Workspace exports and contact controls Authorised workspace administrators can request available workspace or contact-linked exports. Exports contain the records covered by that function and must be reviewed before they are disclosed to another person. Provider credentials are excluded, and an export does not automatically include every copy held by an external service. The contact privacy controls provide a preview before erasure and require appropriate confirmation. A request may need additional administrator review where records are shared, processing is still active, the data volume exceeds the automatic limit or media references need checking. Ordinary removal of a contact is different from a reviewed privacy-erasure operation. Deletion from active workspace records does not by itself delete external-provider copies, delivered communications, calendar events, backups, operational logs, downloaded archives or manually copied material. These locations must be assessed separately. New messages or imports can also create new records. 5. Retention decisions A business should keep personal information only for purposes and periods that it can justify under applicable law. BotMessaging's optional retention settings cover eligible older resolved conversation history and certain generated audio. They do not set a complete retention policy for every type of information. Contact identities, leads, commerce records, invoices, usage records and other information have separate handling requirements. Cancelling a subscription does not automatically erase them. Contact us about a closure, export or deletion request that the available controls do not cover. 6. Responsibilities of business customers Businesses remain responsible for identifying their lawful basis, providing notices, obtaining consent where required, managing team permissions, keeping information accurate, honouring communication preferences and responding to their customers' rights requests. Consider the purposes, sensitivity and volume of information before enabling AI, media processing, marketing, calendar or other connected features. Review the providers involved and apply suitable human oversight to automated interactions. A stored opt-in field, a cookie preference or a functioning export tool does not by itself establish that a particular use is lawful. Where processing on behalf of a business requires a data processing agreement, the relationship must be covered by an appropriate agreement. Contact us before beginning processing that depends on particular contractual, security or transfer arrangements, so the requirements for that use can be addressed. 7. Providers and international processing Connected features can send information to messaging, AI, speech, calendar, payment and other providers. The relevant providers and processing locations depend on the features and accounts in use. Processing outside a person's country can require additional legal arrangements. Contact us for information about the providers, locations and arrangements applicable to your proposed use. This page does not identify any particular international-transfer mechanism as applying to every connection. 8. Concerns and complaints You can raise a concern through our contact page. Where applicable, you also have the right to complain to the data protection authority competent for your situation or seek a judicial remedy. You do not need to give up those rights to use the service. For the wider explanation of BotMessaging's information handling, read the Privacy Policy. For cookies and browser storage, read the Cookie Policy.