Privacy Policy
1Who we are
This Privacy Policy explains how DESMA International Private Limited ("DESMA International", "we", "us", "our") collects, uses, shares and protects personal data in connection with our business application (Meta App ID 1074053418482215) and the services made available at https://desma.in/ (together, the "Service").
- Registered address
- XVI 195/C, First Floor, Keltron Road, Aroor, Kerala 688534, India
- CIN
- U70200KL2023PTC084811
- GSTIN
- 32AAKCD4674Q1Z1
- Contact
- hello@desma.in
Our application is used by DESMA International to manage customer communications and enquiries. It connects to Meta Platforms services — the WhatsApp Business Platform (Cloud API), Facebook Pages and Messenger, Instagram, and the Meta Marketing API — so that messages and enquiries reaching those channels are delivered into our customer relationship management (CRM) system.
We act as the data controller (a "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023) for the personal data described in this policy.
2What the Service does
When you message one of our WhatsApp business numbers, our Facebook Page, or our Instagram account, or when you submit a lead form on one of our advertisements, Meta delivers that interaction to our application. Our application records it in our CRM so that a member of our team can respond to you and keep track of the conversation.
We do not use the Service to send unsolicited marketing to people who have not contacted us or opted in.
3Information we collect
3.1 Information you give us directly
- Your name, phone number and email address, when you provide them
- The content of the messages, images, documents, voice notes and other media you send us
- Information you enter into a lead form or contact form
- Any other information you choose to share in the course of a conversation
3.2 Information we receive from Meta Platforms
Depending on which channel you use to contact us, Meta provides us with:
- WhatsApp: your WhatsApp phone number, your WhatsApp profile display name, the content and timestamps of messages you send to our business number, and delivery/read status of messages we send you
- Messenger and Instagram: your platform-scoped user ID, your public profile name and profile picture, and the content and timestamps of messages you exchange with us
- Facebook Pages: comments, reactions and enquiries you post on our Page
- Lead ads: the fields you complete in a Meta lead generation form, such as name, phone number, email address and any custom questions we ask
- Marketing API: aggregated and de-identified advertising performance data, which is statistical and does not identify you individually
3.3 Technical information
- Log data generated by our servers, including timestamps, request identifiers and error records
- Basic security and diagnostic information needed to keep the Service running
We do not collect payment card details, government identification numbers, precise location, or biometric data through the Service.
4How we use your information
- Receive, read and respond to your messages and enquiries
- Maintain a record of our conversation so that any member of our team can assist you without asking you to repeat yourself
- Send you information, quotations, order updates and service messages you have requested or consented to receive
- Provide customer support and resolve complaints
- Keep records required for our legitimate business and accounting purposes
- Detect, prevent and investigate fraud, abuse and security incidents
- Comply with applicable law and respond to lawful requests from authorities
We do not sell your personal data, and we do not share it with third parties for their own advertising purposes.
5Legal basis for processing
Where the law requires us to identify a legal basis, we rely on:
You may withdraw consent at any time (see Section 9). Withdrawal does not affect processing carried out before withdrawal.
6How we share information
| Recipient | Purpose |
|---|---|
| Meta Platforms, Inc. / Meta Platforms Ireland Ltd. | Meta operates WhatsApp, Messenger, Instagram and Facebook and necessarily processes your messages in order to transmit them. Meta's own handling of your data is governed by its privacy policies, linked in Section 13. |
| Hosting and infrastructure providers | To host our CRM and application servers |
| Business solution providers | We use authorised WhatsApp Business Solution Providers to help operate our WhatsApp channel. They process message data on our instructions only. |
| Professional advisers | Lawyers, accountants and auditors, where necessary and under a duty of confidentiality |
| Authorities | Where disclosure is required by law, court order or a valid legal request |
| A successor entity | If our business is merged, acquired or reorganised, subject to this policy continuing to apply |
All service providers who process data on our behalf are bound by contract to use it only for the purposes we specify and to keep it secure.
7International transfers
Meta and some of our service providers operate servers outside India. Where personal data is transferred outside your country, we take reasonable steps to ensure it remains protected to a standard consistent with this policy and applicable law, including through contractual safeguards with our processors.
8How long we keep your information
| Type of record | Retention period |
|---|---|
| Message and conversation records | 24 months from the date of last contact |
| Customer and order records | 8 years from the end of the relevant financial year, in line with Indian tax, GST and companies law record-keeping requirements |
| Lead records that do not convert | 12 months from the date the lead was received |
| Server and security logs | 90 days |
After these periods we delete the data or irreversibly anonymise it, unless a longer period is required by law or is necessary to establish, exercise or defend a legal claim.
9Your rights and how to exercise them
Your rights
Subject to applicable law, you have the right to:
Data deletion instructions
To request deletion of the personal data we hold about you, email hello@desma.in with the subject line "Data Deletion Request", or send a WhatsApp message containing the word DELETE to the business number you have been corresponding with.
- Send the request as described above.
- Tell us the phone number, email address or account name you used to contact us, so we can locate your records.
- We will verify that the request comes from you or someone authorised to act for you.
- We will delete your personal data within 30 days of verifying the request and confirm to you once it is done.
We may need to retain a minimal record of the deletion request itself, and any data we are legally required to keep — for example invoices required under tax law. We will tell you if this applies and explain what has been retained and why.
Deleting data from our systems does not delete the message history stored in your own WhatsApp, Messenger or Instagram app, and does not delete data held by Meta. To manage data held by Meta, use the tools in Section 13.
Grievance Officer
If you are not satisfied with how we have handled your data or your request, contact:
- Grievance Officer
- Shibin Raj
- hello@desma.in
- Address
- DESMA International Private Limited, XVI 195/C, First Floor, Keltron Road, Aroor, Kerala 688534, India
We will acknowledge your complaint within 7 working days and aim to resolve it within 30 days. If you remain dissatisfied, you may escalate to the Data Protection Board of India, or to your local supervisory authority if you are in the EU or UK.
10Security
- Encryption of data in transit using TLS/HTTPS
- Access controls limiting CRM access to authorised personnel on a need-to-know basis
- Verification of the authenticity of webhook requests received from Meta
- Secure storage of API credentials and access tokens, which are never shared outside our organisation
- Logging and monitoring of access to personal data
No method of transmission or storage is completely secure. While we work to protect your data, we cannot guarantee absolute security. If a breach occurs that is likely to result in a risk to you, we will notify you and the relevant authorities as required by law.
11Children
The Service is not directed at children and we do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, contact us at hello@desma.in and we will delete it.
12Automated decision-making
We do not use your personal data to make decisions about you by purely automated means that produce legal or similarly significant effects.
13Meta's own privacy practices
When you communicate with us through Meta's platforms, Meta processes your data under its own policies, which we do not control:
You can review and manage the data Meta holds about you in your Meta Accounts Center settings.
14Changes to this policy
We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If the changes are significant, we will take reasonable steps to notify you — for example by a message on the channel you use to contact us. Please review this page periodically.
15Contact us
Questions, requests or complaints about this policy or your personal data:
- Company
- DESMA International Private Limited
- Address
- XVI 195/C, First Floor, Keltron Road, Aroor, Kerala 688534, India
- CIN
- U70200KL2023PTC084811
- GSTIN
- 32AAKCD4674Q1Z1
- hello@desma.in
- Website
- https://desma.in/