Privacy Policy
Last updated: October 14, 2026
This Privacy Policy explains how DigiFist BV (BE 0769.399.149), Ellermanstraat 14, 2000 Antwerpen, Belgium (“DigiFist”, “Galantis”, “we”, “us”, or “our”) collects and processes personal data in relation to Galantis and its related services, including Galantis Connect, Galantis WhatsApp, Galantis Marketing and associated websites, applications and features (together, the “Services”).
This Privacy Policy is intended to provide transparency about what personal data we process, why we process it, how it may be shared, how long we retain it, and the rights available to individuals.
Important: Galantis enables business customers to communicate with, manage and automate interactions with their own customers and contacts, including through Meta’s WhatsApp Business Platform. In these situations, DigiFist generally processes personal data on behalf of the relevant business customer.
1. WHO THIS POLICY APPLIES TO
1.1 Business Users / Authorized Users
Individuals who create, administer or use a Galantis account on behalf of a business customer.
1.2 End Recipients
Individuals whose personal data is uploaded, synchronized, generated or otherwise processed within Galantis by our business customers, including individuals who receive WhatsApp or other communications from those customers.
1.3 Website Visitors and Support Contacts
Individuals who visit our websites, request a demo, contact support, submit forms or otherwise communicate with us regarding the Services.
2. CONTROLLER VS PROCESSOR (GDPR ROLES)
2.1 When DigiFist acts as a controller
We generally act as a controller for personal data relating to:
account creation and administration;
business contact information;
contracts and billing;
support communications;
website usage;
security and access logs;
product and website analytics;
sales and business communications; and
our own legal, operational and security obligations.
2.2 When DigiFist acts as a processor
We generally act as a processor when our business customers use Galantis to process personal data relating to their customers, prospects or other End Recipients.
This Customer Data may include, for example:
phone numbers;
names;
email addresses;
customer identifiers;
audience attributes;
tags and segments;
order or e-commerce information;
opt-in and opt-out information;
WhatsApp message content;
message templates;
conversation information;
automation data; and
delivery and interaction metadata.
In these situations, the Galantis customer generally acts as the controller and determines the purposes and legal basis for processing.
If you are an End Recipient wishing to exercise rights relating to data processed by one of our customers, you should normally contact the relevant business directly. We will assist our customer with such requests where required under applicable law and our contractual obligations.
3. PERSONAL DATA WE COLLECT
3.1 Data provided by Business Users and Customers
We may collect:
name;
business email address;
telephone number;
job title;
company name;
account information;
authentication information;
roles and permissions;
billing and invoicing information;
transaction references;
support communications;
attachments;
configuration information; and
other information voluntarily provided to us.
3.2 Customer Data processed through the Services
Depending on how a customer configures and uses Galantis, Customer Data may include:
End Recipient contact details;
phone numbers and customer identifiers;
customer attributes and segmentation data;
e-commerce and order-related data;
WhatsApp message content;
message templates;
timestamps;
delivery and interaction information;
conversation metadata;
opt-in and opt-out information;
suppression lists;
automation and workflow data; and
other information submitted, synchronized or generated through integrations enabled by the customer.
3.3 Usage, device and analytics data
When you use our websites or Services, we may automatically collect technical and usage information, such as:
IP address;
browser type and version;
operating system;
device information;
pages and screens viewed;
actions performed;
session information;
timestamps;
error and diagnostic information;
performance data;
approximate geographic information; and
cookie or similar identifiers.
We use Google Analytics and similar technologies to understand how visitors and users interact with our websites and Services, measure performance, identify usage trends and improve our products.
Google Analytics may process information such as browser and device information, page views, session information, approximate location information and pseudonymous identifiers stored through cookies or similar technologies.
Where required by applicable law, non-essential analytics cookies and similar technologies are used subject to the choices and consent provided through our cookie consent mechanism.
3.4 Data received from third parties
We may receive information from third-party services where necessary to provide the Services, including:
Meta and the WhatsApp Business Platform;
Shopify and other e-commerce platforms;
CRM systems;
ERP systems;
marketing platforms;
integration providers; and
other services enabled by a customer.
For example, Meta may provide message delivery status, conversation events and other information required to provide WhatsApp functionality.
3.5 Data processed through AI-powered features
Certain Galantis features use artificial intelligence to help customers create, analyse, classify, evaluate or automate content and workflows.
Where a customer uses these features, information submitted to or required by the relevant AI functionality may be processed by our AI service providers. Depending on the feature, this may include prompts, instructions, message content, conversation context, customer information or other Customer Data selected or made available by the customer.
We use OpenAI as a subprocessor for certain AI-powered functionality. Where Customer Data is processed by OpenAI on our behalf, such processing is performed for the purpose of providing the relevant AI functionality and is subject to applicable contractual data protection obligations, including a Data Processing Agreement (“DPA”).
Where DigiFist processes Customer Data as a processor, OpenAI acts as a subprocessor in relation to such processing.
4. WHY WE USE PERSONAL DATA (PURPOSES)
We process personal data for:
4.1 Providing and operating the Services (account provisioning, authentication, delivering features).
4.2 Customer relationship management (contracting, onboarding, billing, support).
4.3 Security and abuse prevention (fraud detection, rate limiting, enforcing policies).
4.4 Compliance with legal obligations (accounting, tax, responding to lawful requests).
4.5 Improving our Services (analytics, debugging, product performance, feature planning).
4.6 Marketing to business contacts (where permitted): informing customers/prospects about DigiFist/Galantis updates and offerings, consistent with applicable law and opt-out rights.
5. LEGAL BASES (GDPR)
Where DigiFist is a controller, we rely on:
5.1 Contract performance: to provide the Services and support.
5.2 Legitimate interests: to secure, operate, and improve our business and Services (balanced against your rights).
5.3 Legal obligations: accounting/tax and compliance obligations.
5.4 Consent: for certain marketing communications or cookies where required; you can withdraw consent.
Where DigiFist is a processor, processing is based on the customer’s instructions and their legal basis as controller.
6. HOW WE SHARE PERSONAL DATA
We do not sell personal data.
We may disclose or make personal data available only where necessary for the purposes described in this Privacy Policy.
6.1 DigiFist affiliates and corporate successors
Data may be shared within the DigiFist corporate structure where necessary for administration, operations, security or delivery of the Services.
In the event of a merger, acquisition, restructuring, financing or sale of all or part of our business, personal data may be transferred as part of that transaction subject to applicable law.
6.2 Service providers and subprocessors
We use service providers to host, secure and operate the Services. Where they process Customer Data on our behalf, they act as our subprocessors. Where appropriate, such providers are subject to contractual confidentiality, security and data protection obligations.
Key providers include:
Laravel Cloud: Hosting of the Galantis app, its database, cache and file storage, in the European Union
Cloudflare: Domain name services, encryption certificates, network protection, and hosting of web front ends and of the Web SDK assets used on customers' storefronts
Meta / WhatsApp Business Platform: WhatsApp messaging, message delivery, templates, WhatsApp Flows, conversation events and related platform functionality
OpenAI: AI-powered functionality, including content generation, analysis, classification, evaluation and automation features
Mailtrap: Delivery of service emails, such as sign-in links, invitations, account and service notifications, service alerts and payment notices
Stripe: Payment processing for customers who subscribe directly with us
Shopify: Billing for customers who subscribe through the Shopify App Store
PostHog: Product analytics in the Galantis app, only with consent
Customer-enabled integration providers: E-commerce, review, measurement and other integrations activated by the customer (see section 6.4)
Payments. If you subscribe directly with us, you enter your card and billing details on a payment page hosted by Stripe. We do not receive or store your full card details. We share with Stripe only internal references to your organization and workspace. If you subscribe through the Shopify App Store, Shopify bills you for the Galantis app under its own terms.
Service emails. We send service emails (sign-in links, invitations, account and service notifications, service alerts and payment notices) through Mailtrap. We do not use Mailtrap for marketing emails.
OpenAI
We use OpenAI as a subprocessor for certain AI-powered Galantis functionality. When these features are used, relevant Customer Data may be transmitted to and processed by OpenAI on our behalf to the extent necessary to provide the requested functionality.
Such processing is subject to applicable contractual data protection obligations, including a DPA. Where we act as a processor for our customer, OpenAI acts as a subprocessor for the relevant Customer Data.
6.3 Meta / WhatsApp
Where customers use WhatsApp functionality, information is shared with Meta, the WhatsApp Business Platform and relevant infrastructure providers as necessary to deliver messages and provide the requested WhatsApp functionality.
The use of WhatsApp is also subject to Meta’s and WhatsApp’s applicable terms, privacy policies and data processing arrangements.
6.4 Customer-enabled integrations
Where a customer enables an external integration, information may be transmitted to or received from that integration according to the customer’s instructions.
6.5 Legal disclosures
We may disclose information where reasonably necessary to:
comply with applicable law;
comply with a valid court order or governmental request;
enforce our agreements;
protect our rights, users or systems;
investigate fraud, abuse or security incidents; or
protect the safety of individuals.
6.6 At your direction
We may also share information where you or our customer has expressly instructed or authorised us to do so.
7. INTERNATIONAL TRANSFERS
Galantis, its customers and its service providers may operate in different countries.
As a result, personal data may be processed outside Belgium or the European Economic Area.
Where personal data is transferred to a country that has not been recognised as providing an adequate level of data protection, we use appropriate safeguards where required under applicable law. These may include contractual safeguards such as the European Commission’s Standard Contractual Clauses or another legally recognised transfer mechanism.
Our service providers may also maintain their own international processing infrastructure and subprocessors subject to their respective contractual data protection arrangements.
8. RETENTION
8.1 General principle
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.
After the applicable retention period, data is deleted, anonymised or otherwise rendered inaccessible in accordance with our technical and legal obligations.
8.2 Account, contract and billing information
Account, contractual and billing information may be retained throughout the customer relationship and afterwards where necessary for accounting, tax, legal, dispute resolution or compliance purposes.
8.3 Customer Data
Customer Data is generally retained according to:
the customer agreement;
customer configuration;
functionality of the relevant Service;
deletion instructions from the customer;
technical backup cycles; and
applicable legal requirements.
9. SECURITY
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure, misuse or unauthorised access.
These measures may include access controls, authentication mechanisms, encryption, logging, monitoring, infrastructure security and internal organisational controls.
No method of transmission or storage can provide absolute security, and we cannot guarantee that all security incidents can be prevented.
10. CHILDREN / MINORS
The Services are intended for businesses and professional users and are not directed at children. We do not knowingly offer Galantis directly to individuals under 18 years of age.
11. YOUR RIGHTS
Subject to applicable data protection law, you may have rights including:
the right to be informed about how your personal data is processed;
the right to access personal data relating to you;
the right to request correction of inaccurate data;
the right to request deletion of personal data;
the right to restrict certain processing;
the right to data portability where applicable;
the right to object to processing based on legitimate interests;
the right to withdraw consent where processing is based on consent; and
the right to lodge a complaint with a competent data protection authority.
These rights may be subject to limitations and exceptions under applicable law.
If you are an End Recipient whose personal data is processed by one of our business customers through Galantis, the relevant business is normally the controller. Requests concerning such processing should therefore generally be directed to that business.
We will assist our customers in responding to valid data subject requests where required by applicable law and our contractual arrangements.
12. HOW TO EXERCISE RIGHTS / CONTACT
For privacy questions or requests relating to processing for which DigiFist is the controller, you may contact us at:
Please include “Galantis Privacy Request” in your request where applicable.
You may also contact us at:
DigiFist BV
BE 0769.399.149
Ellermanstraat 14
2000 Antwerpen
Belgium
We may request information reasonably necessary to verify your identity before fulfilling certain privacy requests.
13. LINKS TO OTHER WEBSITES / THIRD-PARTY SERVICES
Our Services may contain links to, integrate with or depend on third-party platforms and services.
Those third parties may process personal data under their own terms and privacy policies where they act independently from DigiFist.
We encourage users and customers to review the privacy information applicable to third-party services they choose to use or integrate with Galantis.
14. CHANGES TO THIS POLICY
We may update this Privacy Policy periodically to reflect changes to our Services, subprocessors, technology, business practices or applicable legal requirements.
Where changes are material, we may provide additional notice through the Services, our website, email or another appropriate channel.
The “Last updated” date at the top of this Privacy Policy indicates when it was most recently revised.
