Privacy Policy

Effective Date: April 2026 · Version: 1.0

This Privacy Policy explains how Silver Sparrow Trading W.L.L., operating the CB360 | ConvoBot360 platform (https://convobot360.com), collects, uses, stores, and protects personal data in accordance with Bahrain Law No. 30 of 2018 (Personal Data Protection Law, "PDPL") and its implementing regulations. By using the CB360 Platform, you acknowledge and accept this Privacy Policy.

1. Who We Are

The data controller responsible for your personal data is:

CB360 | ConvoBot360
Powered by Silver Sparrow Trading W.L.L.
Address: Shop 116, Bldg 18, Road 4101, Block 0341, Juffair, Kingdom of Bahrain
CR: CR No. 170940-1
Email: info@convobot360.com
Telephone: +973 66907907
Website: https://convobot360.com

CB360 is an authorised Meta Business Solution Provider, providing WhatsApp Business API services to business clients ("Clients") and their customers ("End Users") across the Kingdom of Bahrain and the wider Gulf region.

2. Scope of This Policy

This Privacy Policy applies to:

Visitors to convobot360.com and its subdomains.
Business clients who register for and use the CB360 Platform.
End users who interact with CB360-powered WhatsApp Business accounts operated by our clients.

Where CB360 acts as a data processor on behalf of a business client (i.e., processing end-user data through the WhatsApp Business API), the client is the data controller and their own privacy policy governs how end-user data is used. CB360 processes such data strictly in accordance with the client's instructions and these principles.

3. Personal Data We Collect

3.1 Data You Provide to Us (Business Clients)

When you register for or use the CB360 Platform, we collect:

Full name, job title, and business role.
Company or business name, commercial registration number, and registered address.
Email address and telephone number.
Billing information (name, address, payment method details — payment card data is processed by our payment provider and not stored by CB360).
WhatsApp Business Account (WABA) details and Meta Business Manager information.
Support communications and correspondence with CB360.

3.2 Data Collected Automatically (Platform Usage)

When you use the CB360 Platform, we automatically collect:

IP address and device/browser information.
Log data including access timestamps, pages visited, and features used.
Session identifiers and authentication tokens.
Platform performance metrics and error logs.

3.3 WhatsApp End-User Data (Processed on Behalf of Clients)

Where CB360 processes WhatsApp messaging data on behalf of its business clients, this may include:

WhatsApp phone numbers and display names of end users.
Message content within business-initiated and customer-initiated conversation threads.
Media files (images, documents, audio) shared within conversations.
Order, payment, and catalogue interaction data where relevant to the client's service.

CB360 processes this data as a data processor acting on the client's behalf. CB360 does not use end-user WhatsApp data for its own commercial purposes, advertising, or profiling.

3.4 Cookies & Tracking

The CB360 website uses cookies and similar technologies to:

Maintain session state and authentication.
Analyse website usage and improve platform performance.
Remember your preferences.

You may configure your browser to refuse cookies, though some Platform features may not function correctly without them. A full Cookie Policy is available on our website.

4. Legal Basis for Processing

CB360 processes personal data on the following legal grounds under the Bahrain PDPL:

Contractual Necessity: Processing required to provide the CB360 Platform services under your subscription agreement.
Legitimate Interests: Processing for fraud prevention, platform security, service improvement, and direct marketing to existing clients where not overridden by your interests.
Legal Obligation: Processing required to comply with applicable Bahraini law, regulatory requirements, or court orders.
Consent: Where required by law, we will obtain your explicit consent before processing, including for certain marketing communications. You may withdraw consent at any time.

5. How We Use Your Personal Data

CB360 uses the personal data we collect for the following purposes:

To create, manage, and administer your CB360 account and subscription.
To provision and manage your WhatsApp Business Account (WABA) with Meta.
To process billing and payments for your subscription.
To provide technical support, respond to enquiries, and resolve issues.
To send service notifications, system alerts, and updates relevant to your account.
To send commercial communications about CB360 services, features, and offers (business clients may opt out at any time).
To monitor and enforce compliance with these Terms & Conditions and Meta's policies.
To improve the Platform through aggregated usage analytics.
To comply with applicable legal and regulatory obligations.
To protect the security and integrity of the Platform and our systems.

6. Sharing Your Personal Data

CB360 does not sell your personal data. We share personal data only with:

6.1 Meta Platforms, Inc.

As an authorised WhatsApp Business Solution Provider, CB360 shares certain business and WABA account data with Meta to provision and maintain WhatsApp Business API access. Meta's own Privacy Policy governs Meta's use of this data.

6.2 Service Providers & Sub-Processors

CB360 engages trusted third-party service providers who process data on our behalf, including:

Cloud infrastructure and hosting providers.
Payment processing providers.
Email and communications service providers.
Analytics and monitoring tools.

All sub-processors are bound by data processing agreements that require PDPL-equivalent protections.

6.3 Legal & Regulatory Authorities

CB360 may disclose personal data to competent authorities, courts, or regulators in Bahrain or other jurisdictions where required by law, court order, or for the prevention or detection of fraud and criminal activity.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of CB360's assets, personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. You will be notified of any such transfer.

7. International Data Transfers

CB360 operates primarily within the Kingdom of Bahrain and the GCC region. Some of our service providers may process data outside Bahrain. Where personal data is transferred outside Bahrain, CB360 ensures that appropriate safeguards are in place in compliance with the PDPL, including contractual data protection clauses with receiving parties.

WhatsApp Business API data is hosted by Meta on Meta's global infrastructure. Your use of the Platform acknowledges this cross-border data flow under Meta's Cloud API terms.

8. Data Retention

CB360 retains personal data only for as long as necessary to fulfil the purposes described in this Policy or as required by applicable law:

Client account data: Retained for the duration of your subscription and for 5 years after termination, to meet financial, legal, and audit record-keeping requirements under Bahraini law.
WhatsApp messaging data (processed on behalf of clients): Retained for the period agreed with the client or as required by law, and deleted within 30 days of account termination unless a longer period is legally required.
Website usage logs: Retained for up to 12 months for security and performance purposes.
Billing and payment records: Retained for 7 years in accordance with Bahraini commercial law requirements.

When data is no longer required, CB360 deletes or anonymises it securely.

9. Your Rights Under the Bahrain PDPL

As a data subject under Bahrain Law No. 30 of 2018, you have the following rights:

Right of Access: You may request a copy of the personal data CB360 holds about you.
Right of Rectification: You may request correction of inaccurate or incomplete personal data.
Right of Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to CB360's legal obligations.
Right to Object: You may object to processing of your personal data for direct marketing purposes at any time.
Right to Restrict Processing: You may request that CB360 restrict processing of your data in certain circumstances.
Right to Data Portability: Where technically feasible and legally applicable, you may request your data in a structured, machine-readable format.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please submit a written request to info@convobot360.com. CB360 will respond within the timeframe required by the PDPL (generally 30 days). We may require identity verification before processing your request.

10. Data Security

CB360 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction, including:

Encrypted data transmission (TLS/HTTPS) for all Platform communications.
Access controls and role-based permissions limiting data access to authorised personnel.
Regular security assessments and vulnerability monitoring.
Incident response procedures including breach detection and notification protocols.
Secure deletion and data disposal procedures.

No method of transmission over the Internet or electronic storage is 100% secure. While CB360 employs industry-standard protections, we cannot guarantee absolute security. In the event of a data breach affecting your personal data, CB360 will notify you as described in our Terms & Conditions.

11. Children's Privacy

The CB360 Platform is a business-to-business service intended for use by adults operating as or within registered businesses. CB360 does not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete such data without undue delay.

12. WhatsApp-Specific Privacy Notice

As a Meta WhatsApp Business Solution Provider, CB360 facilitates business messaging between our clients and their customers via the WhatsApp Business API. Users who interact with a CB360-powered WhatsApp Business account should note:

CB360 accesses message content and associated metadata on behalf of the business client operating that WhatsApp account.
The business client is the data controller for all messages exchanged with their end customers.
End users wishing to understand how their data is used should refer to the privacy policy of the specific business they are messaging.
CB360 does not use end-user WhatsApp data for profiling, advertising, or any purpose beyond delivering the contracted service to the business client.
Meta independently processes certain data under Meta's Privacy Policy and WhatsApp's Privacy Policy, which are independent of CB360.

13. Links to Third-Party Services

The CB360 Platform may contain links to third-party websites or services (including Meta, payment providers, and integration partners). CB360 is not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you use in connection with CB360.

14. Changes to This Privacy Policy

CB360 may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. Material changes will be communicated to registered clients by email at least 14 days before taking effect. The current version will always be available at convobot360.com/privacy. Your continued use of the Platform after the effective date constitutes your acceptance of the updated Policy.

15. How to Contact Us & Make a Complaint

For any privacy-related enquiries, data subject requests, or complaints, please contact:

CB360 | ConvoBot360 — Data Protection Contact
Powered by Silver Sparrow Trading W.L.L.
Address: Shop 116, Bldg 18, Road 4101, Block 0341, Juffair, Kingdom of Bahrain
Email: info@convobot360.com
Telephone: +973 66907907

If you are not satisfied with CB360's response to your privacy complaint, you have the right to lodge a complaint with the Bahrain Personal Data Protection Authority (PDPA):

Personal Data Protection Authority (PDPA) — Kingdom of Bahrain
Website: pdpa.gov.bh
Email: info@pdpa.gov.bh

CB360 is an authorised Meta Business Solution Provider for the WhatsApp Business API. Silver Sparrow Trading W.L.L. is not affiliated with, endorsed by, or an agent of Meta Platforms, Inc. or WhatsApp LLC. "WhatsApp" is a registered trademark of WhatsApp LLC.