PRIVACY POLICY
How we handle your data
Effective 31 October 2026. This policy covers gdatech.ae, the WhatsApp Reception service we run for businesses, and our own WhatsApp receptionist.
Who we are
GDA Consulting Ltd (“GDA”, “we”) is a software company registered in the United Kingdom that serves businesses in the UAE. Questions about this policy or your data: contact@gdatech.co.uk.
Visiting this website
gdatech.ae sets no cookies and runs no analytics, advertising or tracking scripts. Our hosting provider, Cloudflare, processes the technical data any website receives (such as your IP address and browser type) to deliver the pages and protect them from abuse.
The browser demo at gdatech.ae/wa-demo is a simulation: what you type stays in your browser and is never sent to us. The “Book a call” links open Calendly, which has its own privacy policy.
Messaging a WhatsApp receptionist
When you message GDA’s own WhatsApp number, or the WhatsApp number of a business that uses our service, we process:
- your WhatsApp phone number and profile name;
- the messages you send and the replies you receive;
- details you choose to share, such as your name, the service you want, job details and preferred dates;
- any appointment you book, move or cancel.
We use this to reply to you, answer from the business’s approved information, book appointments, send the reminders you’d expect, and pass the conversation to a person when needed. We never sell it or use it for advertising.
Who is responsible. For GDA’s own number, GDA decides how your data is used. For a business’s number, that business decides, and GDA processes the data on its behalf, under its instructions, to provide the service. Contact the business, or us, to exercise your rights.
Replies are generated with the help of an AI model. Messages are sent to the model only to write the reply, and our provider does not use them to train its models.
Google Calendar
A business using our service can choose to connect its Google Calendar so the receptionist only offers times when the owner is free, and adds each booking to the owner’s calendar.
What we access
- Free/busy times of the connected calendar, meaning only when it is busy. We do not read event titles, descriptions, attendees or locations.
- Events the service creates: we create one event per booking (with a Google Meet link), and update or delete only those events when the booking is moved or cancelled.
- The email address of the connected Google account, to show the business which account is connected.
How we use and protect it
- Busy times are checked when slots are offered and are not stored.
- We store the account email and an access token, encrypted, so the service can keep the calendar up to date. Only the business’s own receptionist uses it.
- Google user data is never sold, used for advertising, used to train AI models, or shared with anyone except as needed to provide this feature.
- The business can disconnect at any time from its dashboard. We then revoke our access at Google and delete the stored token. Access can also be removed at myaccount.google.com/permissions.
GDA’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Service providers
We use these providers to run the service. Each processes data only to provide its part of it.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner | Servers that run the service | Germany (EU) |
| Supabase | Database and staff sign-in | Frankfurt (EU) |
| OpenAI | AI model that writes replies | United States |
| Resend | Alert emails to the business | EU |
| Cloudflare | Website hosting and security | Global network |
| WhatsApp (Meta) | Carries the messages | Global |
| Calendar, only if a business connects it | Global |
Where data leaves the UK, the EU or the UAE, we rely on the provider’s contractual safeguards for international transfers.
How long we keep data
We keep conversation and booking data while the business concerned uses our service, so its team can see past enquiries and appointments. A business can export or delete a customer’s data at any time, and we delete it when asked by the business or by you. When a business stops using the service, we delete its data.
Security
Data is encrypted in transit. Calendar tokens are encrypted at rest. Only staff the business has approved, and GDA when supporting the service, can sign in to a business’s dashboard.
Your rights
Depending on where you live, including under the UK GDPR and the UAE Personal Data Protection Law, you can ask to access, correct, export or delete your data, or object to how it is used. To stop automated messages, reply STOP in the chat. For anything else, email contact@gdatech.co.uk and we will reply within 30 days. In the UK you can also complain to the Information Commissioner’s Office (ico.org.uk).
Changes
If we change this policy, we will update the date at the top of this page. Significant changes will be communicated to businesses using the service before they take effect.