Privacy Policy
Last updated: 20 October 2026 · Draft for legal review
Work messages only
Onebox Teams processes only WhatsApp messages sent directly to your company’s designated work number. We never access your personal WhatsApp chats, contacts, calls or unrelated groups. Sending a work update does not grant access to the rest of your WhatsApp account.
What we process and why
Work updates may contain text, voice notes, photos, sender phone numbers and job, property or client details. We use these to generate structured work items, tasks and follow-ups for your workspace. Audio is used solely for task generation, including transcription and extracting relevant work details. Avoid sending unnecessary personal information or sensitive documents.
Who is responsible
Your employer or workspace organisation determines the purposes and lawful basis for processing work content and normally acts as its data controller. Onebox Teams processes that content on its behalf. Onebox Teams is responsible for its own account administration and service security data. The organisation must inform its team and relevant clients about its use of this service.
Lawful basis
Depending on the context, processing may be necessary to provide the contracted service or for legitimate interests in coordinating work and maintaining accurate operational records. Where consent is required, the responsible organisation must obtain it. You may object to processing based on legitimate interests.
Access, providers and security
Work records are made available to authorised workspace users according to their access permissions. Field workers see their own work items; the workspace Office/Owner sees all team updates. Service providers supporting hosting, storage, WhatsApp delivery and AI transcription or extraction may process the relevant data to provide those services. Where data is transferred outside the EEA or UK, applicable transfer safeguards are required. Access controls and private photo storage help protect work data; no system can guarantee absolute security.
Retention
Work content should be retained only as long as necessary for the organisation’s operational and legal requirements. Contact your workspace administrator to request removal of work records or clarification of retention periods. Service records and backups may need separate retention to meet security and legal obligations.
Your GDPR rights
Under EU GDPR and UK data protection law, you may request access, correction, erasure, restriction or portability of your personal data, and object to certain processing, subject to applicable conditions. Where processing relies on consent, you may withdraw it. Start with your workspace organisation for work-content requests. You may also complain to the Irish Data Protection Commission, the UK Information Commissioner’s Office, or your local supervisory authority.
Cookies and account storage
Essential browser storage supports sign-in, session security and reliable capture submission. Non-essential tracking, if introduced, requires appropriate notice and consent where applicable.
Contact and policy updates
Contact: support@oneboxteams.com (placeholder contact, pending confirmation). Before launch, the legal operator’s name and address, live contact details, provider arrangements and specific retention periods must be confirmed. This draft is not legal advice. Material changes will be reflected in the updated policy.