Gumon Shop Agent Privacy Notice

1. Who is responsible for your data

• - The shop you are messaging is the data controller. It decides why and how your data is used, and it is your main point of contact for questions about your data. The shop's name and contact details are shown in its WhatsApp business profile.
• - Gumon Technology Co., Ltd. (registration no. 0405566007844, Thailand) provides and operates the Shop Agent as a data processor. Gumon processes your data on behalf of the shop and only on the shop's instructions.
• - Gumon does not use shop customers' data for its own purposes, does not sell it, and does not share one shop's customer data with another shop.
• - WhatsApp is provided by Meta. Meta handles your WhatsApp account and the delivery of your messages under its own terms and privacy policy, which this notice does not cover.

2. Data we process

• - Your WhatsApp phone number and profile name.
• - Messages you exchange with the shop, including text and any photos, videos or other files you choose to send.
• - Booking details: the services you ask about or book, dates and times, appointment history, and deposit or payment status. Card details are entered on the payment provider's page and are not received by the Shop Agent.
• - Details you choose to give, such as your name, email address, preferred language, or notes for your appointment.
• - Health information, only if you choose to share it (for example an injury or pregnancy), so the shop can provide your treatment safely.
• - Whether you have agreed to, or opted out of, updates and offers from the shop.
• - Details the shop already holds in its own booking system, such as your appointments and contact details, which may be used to send you booking confirmations and reminders.
• - Technical records such as message IDs, delivery status and timestamps.

3. How your data is used

• - To answer your questions about services, prices, opening hours and availability.
• - To make, change or cancel bookings, and to send confirmations and reminders about your bookings.
• - To pass your conversation to the shop's staff when a person needs to help, including translating messages for staff where needed.
• - To send updates or offers only where you have agreed or the law otherwise allows. You can ask the shop to stop these messages at any time.
• - To keep the service secure, prevent misuse and fix problems.
• - To meet the shop's legal obligations, such as keeping accounting records.

4. Automated replies

Many replies are written by an AI system (Claude, provided by Anthropic) on the shop's behalf, using the shop's own information and your conversation. The shop's staff oversee the service and take over when needed, and you can ask to speak to a member of staff at any time. The AI does not make decisions that have legal or similarly significant effects on you.

5. Legal bases

The shop, as controller, decides the legal basis for each use. Depending on the law that applies to the shop (for example UK GDPR, EU GDPR or Thailand's Personal Data Protection Act), these are typically: steps you ask for before a booking and the performance of your booking; the shop's legitimate interests in answering enquiries, running its business and keeping the service secure; your consent for marketing messages where consent is required, and your explicit consent for health information you choose to share; and the shop's legal obligations, such as keeping accounting records. Records of treatments already provided, including related health information, may be kept after a deletion request where they are needed to establish or defend legal claims.

6. Service providers (sub-processors)

• - Meta Platforms, WhatsApp Business Platform: carries messages between you and the shop.
• - Anthropic, Claude API: produces replies, summaries and translations from the conversation content it is given, under Anthropic's commercial API terms.
• - Vultr: cloud hosting for the application, database and backups (servers in the United Kingdom) and storage for files sent in chats (in the Netherlands).
• - Gumon-operated servers in Thailand: service monitoring and operational logs.
• - Staff calendars (for example Google Calendar), where a shop's staff connect one: appointment entries show the time and service, with no more than your first name or initial.
• - Providers that the shop engages itself, such as its own booking system or payment provider, are covered by the shop's own privacy notice.
• - If these providers change, we will update this page and its date.

7. International transfers

Gumon is based in Thailand, and the providers above operate in several countries, including the United Kingdom, the Netherlands, Thailand and the United States. Where UK GDPR or EU GDPR applies and data is transferred to a country without an adequacy decision, the transfer must rely on a safeguard recognised by those laws, such as the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or the recipient's certification under the EU-US Data Privacy Framework and its UK Extension. You can write to data@gumon.io to ask which safeguard applies to a particular provider.

8. How long data is kept

• - Each shop sets its own retention periods, and Gumon follows the shop's instructions. Some shops keep conversations and customer records until you ask for them to be deleted. You can ask the shop for its retention period.
• - Records that the law requires a shop to keep, such as booking and payment records for accounting and tax, are kept for at least the legal period (in the United Kingdom, generally six years). After a deletion request they are kept without your name or phone number.
• - Deleted data stays in encrypted backups until they are replaced by 14 later successful daily backups.

9. Your rights

• - Depending on where you live, you can ask to access, correct or delete your data, receive a copy of it, object to or restrict its use, and withdraw consent at any time. Withdrawing consent does not affect processing that took place before.
• - You can stop marketing messages from a shop at any time.
• - Send requests to the shop, on WhatsApp or through its usual contact details. You can also write to data@gumon.io; we will pass your request to the shop and help it respond.
• - We may ask you to confirm that you control the phone number before acting on a request.
• - Requests are answered within the time the law sets, which is one month under UK GDPR and EU GDPR.

• How to delete your data

10. Security

We protect data with measures that include encryption in transit, encrypted backups, and access restricted to Gumon's technical staff. No system is completely secure. If a security incident affects your data, Gumon will inform the shop without delay, and notifications will be made as the law requires.

11. Children

The service is intended for people arranging their own appointments and is not directed at children. If you believe a child has shared personal data with a shop through the service, please contact the shop or data@gumon.io so it can be deleted.

12. Complaints

If you have a concern, please contact the shop or data@gumon.io first so we can try to resolve it. You also have the right to complain to a data protection authority: in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in Thailand, the Personal Data Protection Committee; in the European Economic Area, the authority in your country.

13. Changes to this notice

We may update this notice when the service or the law changes. The date at the top of this page shows the latest version.

14. Contact

• - Privacy and data rights: data@gumon.io
• - Gumon Technology Co., Ltd., 10/17 Moo 1, Bang Chalong, Bang Phli, Samut Prakan 10540, Thailand

Related pages

• Gumon Shop Agent data deletion instructions
• Gumon Shop Agent terms of service
• Privacy policy for the gumon.io website