Data Processing Terms

These terms are part of our Terms of Service. They cover the personal data of your customers that Halcyo processes for you, under the Bangladesh Personal Data Protection Act 2026.

1. Roles

You are the data controller. Halcyo is your data processor and acts only on your documented instructions.

2. What we process and why

• People: your customers and prospects who message you, and your staff users.
• Data: messages, contact details, the profile fields you choose (for example study plans, pet details or preferred appointment time), appointments and source ad.
• Purpose: answering questions, booking, notifying your staff, reporting and support.
• Not processed: national ID, passport, bank or card numbers (masked if sent), medical records, legal case files.

3. Your obligations

• Have a lawful basis and a privacy notice for your customers that mentions Halcyo; the assistant shows a short notice and a link in its first message.
• For customers under 18, follow the PDP Act rules on parental consent.
• Give us accurate instructions and knowledge.

4. Our obligations

• Process data only to provide the service and keep it confidential.
• Limit staff access to people who need it for support or maintenance.
• Encrypt data in transit and secrets at rest, keep each client's data separate, back it up and test restores.
• Tell you without undue delay, and within 72 hours, after we become aware of a personal data breach affecting your data.
• Help you answer requests from your customers to access, correct or delete their data.

5. Sub-processors

We use the providers listed in our Privacy Policy (hosting in Singapore, AI models in the United States, Meta and Telegram for channels, email delivery). We will tell you at least 30 days before adding a new one, and you may object.

6. Transfers abroad

Some processing happens outside Bangladesh, with providers bound by their own security and confidentiality terms.

7. Retention and deletion

Messages are deleted after 12 months unless you set a shorter period. When the service ends you can export everything; we then delete your data within 30 days, except records the law requires us to keep.

8. Audits

On reasonable written request, once a year, we will answer your security questions and share how we protect your data.

9. Signed version

If you need a signed data processing agreement, email contact@halcyo.tech.