The purpose of this statement is to set out how we use personal information that we may obtain about you. Webio is committed to protecting your privacy. This Privacy Notice explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services. Please read this notice carefully to understand our policies and practices regarding your information and how we will treat it.
Our Role Under GDPR
Wingnut Labs T/A Webio ("we", "us", "our") operates in two distinct roles under GDPR:
-
As a Data Controller for:
- Our business client relationships
- Website visitors
- Marketing activities
- Business development
-
As a Data Processor for:
- Customer conversation data processed through our platform on behalf of our clients
- All end-user data handled through our conversational AI and messaging services
This privacy notice primarily addresses our role as a controller for our business relationships. For information about how your data is processed when you interact with our clients' services through our platform, please refer to the relevant client's privacy policy.
Who We Are
Webio provides a platform for businesses to communicate with their customers across multiple messaging channels, using a combination of AI assistants and human advisors.
Our registered address is 25 Temple Lane South, Temple Bar, Dublin, D02 VK80.
We are ISO27001 certified and maintain comprehensive security measures to protect all data processed through our systems.
Controller Activites
What Business Data We Collect
As a controller, we collect and process the following business contact information:
How We Collect Business Data
-
Direct provision during business relationships
-
Website forms and inquiries
-
Webinar registrations
-
Marketing events
-
Public business sources (e.g., LinkedIn)
-
Website analytics
How We Use Business Data
We process this data to:
Legal Basis for Processing Business Data
We process business contact data under:
-
Contract necessity (for service delivery)
-
Legitimate interests (for business development)
-
Consent (for marketing communications)
Processor Activities
Our Role as a Processor
When our clients use our platform to communicate with their customers, we act solely as a processor. This means:
-
We process data only on our clients' documented instructions
-
We do not determine the purposes of processing
-
We implement appropriate security measures
-
We support our clients in fulfilling their controller obligations
Sub-Processors
We maintain strict control over sub-processors:
-
All sub-processors are contractually bound to data protection obligations
-
Clients are informed of sub-processor changes
-
Current sub-processor lists are available to clients
Security Measures
We implement comprehensive security measures including:
-
Data encryption in transit and at rest
-
Strict access controls
-
Regular security testing
-
Automated security monitoring
-
ISO27001 certified controls
International Transfers
-
We are based in the Republic of Ireland and the UK
-
We process data within the EU/UK where possible
-
Any international transfers are conducted under appropriate safeguards
-
We support clients in maintaining compliant data transfers
Data Subject Rights Support
When we receive data subject requests concerning data we process for clients:
-
We promptly forward these requests to the relevant client.
-
We assist clients in fulfilling these requests.
-
We maintain appropriate technical measures to support rights execution.
-
We do not respond directly to end-user requests.
Data Rights
For Business Contact Data (Where Webio is Controller)
As a business contact whose data we control, you have the following rights:
-
Right of Access:
You can request a copy of your personal data that we hold.
We will respond within one month of your request.
We will provide the information in a structured, commonly used format.
-
Right to Rectification:
You can request corrections to inaccurate personal data.
You can have incomplete personal data completed.
We will update our records promptly upon verification.
-
Right to Erasure ('Right to be Forgotten'):
You can request deletion of your personal data when:
- The data is no longer necessary for its original purpose
- You withdraw consent (where processing was based on consent)
- You object to processing and we have no overriding legitimate interests
- The data was unlawfully processed
- We may retain data needed for legal compliance
-
Right to Restriction of Processing:
You can request restriction of processing when:
- You contest the accuracy of the data
- Processing is unlawful but you oppose erasure
- We no longer need the data but you require it for legal claims
- You have objected to processing pending verification of legitimate grounds
-
Right to Data Portability:
You can request your data in a structured, commonly used format.
You can request direct transfer to another controller where technically feasible.
Applies to data provided by you and processed by automated means.
-
Right to Object:
You can object to processing based on legitimate interests.
You can object to direct marketing (including profiling).
We will stop processing unless we demonstrate compelling legitimate grounds.
-
Rights Related to Automated Decision Making:
You have the right to not be subject to decisions based solely on automated processing which significantly affect you.
You can request human intervention.
You can contest automated decisions.
How to Exercise Your Rights
To exercise any of these rights:
-
-
Provide sufficient information to identify yourself
-
Specify which right(s) you wish to exercise
-
We will respond within one month
-
We may extend this period by two months for complex requests
Verification
-
We will verify your identity before processing requests.
-
We may request additional information if necessary.
-
This is to protect your data from unauthorized access.
Limitations
-
We may not be able to comply if legal obligations prevent us.
-
We will explain any inability to fully comply with your request.
-
We will not charge a fee unless requests are manifestly unfounded or excessive.
For Customer Data (Where Webio is Processor)
If you are a customer of one of our clients and wish to exercise your data rights:
-
Contact the relevant business directly (our client).
-
They will work with us to fulfill your request.
-
We will support our clients in responding to your rights requests promptly.
Cookies and Tracking
For our website visitors, we use:
-
Essential cookies for site functionality
-
Analytics cookies with consent
You can manage cookie preferences through your browser settings.
Business Data Retention
We retain business contact data for:
-
The duration of our business relationship
-
Legal and regulatory compliance periods
-
As long as necessary for legitimate business purposes
Changes to This Notice
We reserve the right to update this notice. Changes will be:
Contact Information
For privacy inquiries:
-
-
Business Hours: 9am-5pm GMT
-
Address: 25 Temple Lane South, Temple Bar, Dublin, D02 VK80
Complaints
Complaints can be addressed to:
Webio
25 Temple Lane South, Temple Bar, Dublin 2, D02 VK80, Ireland
