PingSales Privacy Policy

1. Identification of the data controller

The controller responsible for the processing of personal data is:

PINGSALES AI SOLUTIONS, LDA NIPC (Tax ID): 519518128 Registered office: Rua Francisco Costa Gomes, Edifício CIBT NERBE, n.º 2, 7800-591 Beja, Portugal Contact email: privacy@pingsales.pt General email: geral@pingsales.pt

For certain data processed on behalf of our clients, namely leads, messages, comments, business contacts and data imported into the platform, PingSales acts as a data processor, with the client being the controller responsible for that data.

2. What PingSales is

PingSales is a SaaS platform for sales management, CRM, marketing automation, artificial intelligence, lead management, and tracking of messages, comments, campaigns and business interactions.

The platform may allow the client to connect third-party accounts and digital assets, including Meta accounts, Facebook pages, professional Instagram accounts, ad accounts, Lead Ads forms, Messenger messages and comments.

3. Personal data we may process

We may process the following categories of data, depending on the features used:

a) User account data: Name, email, phone, company, job title, encrypted password, permissions, team, workspace, contracted plan and platform usage history.

b) Technical data: IP address, session identifiers, browser, device, operating system, access logs, date and time of use, pages visited and actions performed within the platform.

c) Billing and contract data: Name or company name, tax ID, billing address, billing email, payment data, contracted plan, commercial documents and payment history.

d) Meta integration data: When the user connects their Meta account to PingSales, we may process data necessary to provide the service, including Meta user identifiers, associated Facebook pages, professional Instagram accounts, ad accounts, Business Manager, granted permissions, access tokens, lead forms, campaigns, ads, performance metrics and integration technical data.

e) Lead data: Name, email, phone, company, message, lead source, campaign, form, ad, submission date, consents, sales status and interaction history.

f) Message and comment data: Messages received through integrated channels, comments on posts, conversation identifiers, page identifiers, profile identifiers when made available by the source platform, message content, attachments, conversation status and reply history.

g) Data processed by artificial intelligence: Content provided by the user or client, lead messages, comments, prompts, generated responses, sales classifications, summaries, purchase intent, suggested replies and other data necessary to automate or support business processes.

4. Data obtained through the Meta platforms

PingSales only accesses Meta data when the user expressly authorizes the connection of their account, page, ad account or Instagram account to the platform.

We may use data obtained through Meta's APIs to:

Retrieve and organize leads received through Facebook Lead Ads.

Display campaigns, ads, metrics and performance of authorized ad accounts.

Read and manage comments from authorized Facebook pages and professional Instagram accounts.

Receive, organize and enable replies to Messenger and Instagram messages, when authorized.

Synchronize authorized pages, ad accounts, forms and business assets.

Automate sales, CRM, support and lead qualification tasks.

We do not sell data obtained through Meta.

We do not use data obtained through Meta for purposes incompatible with the permissions granted by the user.

We do not transfer Meta data to third parties, except technical providers necessary to operate PingSales, subject to confidentiality and security obligations.

We do not use data obtained through Meta to create independent profiles outside the purpose contracted by the client.

We do not use Meta data to train public or general artificial intelligence models.

5. Data obtained through Google services and APIs

PingSales allows the user to voluntarily connect their Google account to the platform in order to use features integrated with Google Calendar and Gmail.

PingSales only accesses Google account data after the user's express authorization through Google's OAuth process and only requests the permissions needed to provide the features the user chooses.

Depending on the features enabled and the permissions granted, PingSales may process basic Google account information, such as name and email address, calendars, events, availability, email messages, metadata of those messages and other data strictly necessary for the authorized features.

This data is used exclusively to provide features requested by the user, namely:

Synchronizing calendars and availability.

Viewing, creating, updating and managing events.

Integrating Gmail into PingSales, including viewing and sending messages when the user authorizes it.

Running automations directly requested or configured by the user.

Data obtained through Google APIs is used exclusively to provide or improve PingSales features that are directly requested by and visible to the user.

Data obtained through Google APIs is not sold. It is not used for advertising, targeted marketing, advertising profiling, determining financial capacity, or any purposes unrelated to the features authorized by the user.

Data obtained through Google APIs is not used to train general-purpose artificial intelligence models.

When a feature requested by the user uses artificial intelligence, automation or other technology providers, only the data strictly necessary to perform that feature may be processed by the relevant provider. That data may not be used by the provider for its own purposes incompatible with the requested service or to train general-purpose artificial intelligence models.

PingSales does not allow employees or other people to access the content of data obtained through Google APIs, except where strictly necessary to provide support requested by the user and with the user's authorization, to investigate security incidents, to comply with legal obligations, or in other situations permitted by Google's policies.

Data obtained through Google APIs is retained only for as long as necessary to provide the features authorized by the user.

The user can disconnect the Google Calendar integration within PingSales. That action revokes the authorization with Google and deletes the access tokens stored for that integration. The user can also revoke Google Calendar and Gmail access in their Google Account and request deletion of the data at privacy@pingsales.pt or through the page https://pingsales.pt/data-deletion.

When the Google Calendar integration is disconnected or authorization is revoked in the Google Account, the access tokens for that integration are deleted and can no longer be used for new access. Bookings and messages already reflected in PingSales for the features requested by the user are kept only for as long as they are needed for those features or until a valid deletion request, unless a legal obligation requires their retention. Upon a valid request, that data is deleted or anonymized, subject to the same exception.

PingSales' use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use Requirements: https://developers.google.com/terms/api-services-user-data-policy

6. Purposes of processing

We process personal data for the following purposes:

Creating, managing and protecting user accounts.

Providing the services contracted on the PingSales platform.

Enabling the connection of Meta, Facebook, Instagram, Messenger accounts and ad accounts.

Synchronizing leads, messages, comments, campaigns and metrics.

Managing sales pipelines, CRM, contacts and opportunities.

Automating replies, classifications, notifications and sales tasks.

Generating analytics, reports and performance metrics.

Providing technical support and customer service.

Complying with legal, tax and accounting obligations.

Preventing fraud, abuse, unauthorized access and security incidents.

Improving the platform, provided this is done in a proportionate manner compatible with user privacy.

This generic purpose of improving the platform does not mean that data obtained through Google APIs may be used to develop unrelated features, advertising, the creation of advertising profiles, marketing or the training of general-purpose artificial intelligence models. The processing of Google data is limited to the conditions described in the section on Google services and APIs.

7. Legal grounds

The processing of personal data may be based on the following legal grounds:

Performance of a contract, when processing is necessary to provide the PingSales platform.

Consent, when the user authorizes integrations, permissions, optional communications or specific features.

Legitimate interest, namely for security, fraud prevention, platform improvement, support and operational management.

The legitimate interest in improving the platform does not cover data obtained through Google APIs, the processing of which is limited to the section on Google services and APIs.

Compliance with a legal obligation, namely tax, accounting and legal obligations.

Pre-contractual steps, when someone requests information, a demonstration or a commercial proposal.

8. Sharing data with third parties

We may share personal data only when necessary and proportionate, with:

Hosting, infrastructure, database, security and backup providers.

Email, notification, support and communication tool providers.

Payment, billing and accounting providers.

Artificial intelligence and automation providers, exclusively when necessary to perform features requested by the user. Where data obtained through Google APIs is involved, only the data strictly necessary to provide the authorized feature may be processed, in accordance with the Google API Services User Data Policy and the Limited Use Requirements.

Meta Platforms and its services, when the user decides to connect or use Meta integrations.

Public authorities, courts or administrative bodies, when required by law.

PingSales does not sell personal data.

9. International transfers

Some technology providers may be located outside the European Economic Area or process data on international infrastructure. When this occurs, appropriate safeguards will be adopted under the GDPR, including adequacy decisions, standard contractual clauses or other legally provided mechanisms.

10. Data retention

We retain data only for as long as necessary to fulfill the purposes described in this Policy, provide the contracted service, comply with legal obligations or protect the rights of PingSales, clients and users.

Account data is retained while the account remains active.

Lead, message and comment data is retained according to the client's configuration or for as long as necessary to provide the service.

Billing and accounting documentation is retained for the legally applicable periods.

Technical and security logs may be retained for the period necessary for security, auditing and abuse prevention.

Data obtained through Meta is deleted when it is no longer necessary, when the user removes the integration, when the client requests deletion, or when required by Meta's policies or by law.

Retention of data obtained through Google APIs is governed by the section on Google services and APIs.

11. Deletion of Meta data

The user can remove the connection to Meta within the PingSales platform or request the deletion of data through the page:

https://pingsales.pt/data-deletion

After a valid request, PingSales will delete or anonymize the associated personal data, except when retention is necessary to comply with a legal obligation, defend rights or prevent abuse.

12. Rights of data subjects

Under the GDPR, data subjects may exercise, where applicable, the following rights:

Right of access.

Right to rectification.

Right to erasure of data.

Right to restriction of processing.

Right to object.

Right to data portability.

Right to withdraw consent, when processing is based on consent.

Right not to be subject to decisions based solely on automated processing that produce legal effects or significantly similar effects.

These rights may be exercised through the email:

privacy@pingsales.pt

The data subject must identify themselves sufficiently to allow validation of the request. PingSales will respond within the legally applicable deadlines.

The rights of data subjects are set out in the GDPR, including access, rectification, erasure, restriction, objection, portability and rights related to automated decisions. The CNPD is the national supervisory authority in Portugal.

13. Complaints

The data subject has the right to lodge a complaint with the National Data Protection Commission:

Comissão Nacional de Proteção de Dados Av. D. Carlos I, 134, 1.º 1200-651 Lisboa Website: www.cnpd.pt

14. Security

PingSales adopts appropriate technical and organizational measures to protect personal data, including access control, encryption where applicable, segregation of permissions, backups, monitoring, security logs and internal limited-access policies.

Despite the measures adopted, no system is entirely immune to risk. In the event of a relevant incident, PingSales will act as legally required.

15. Clients' data processors

When a client uses PingSales to manage leads, contacts, messages, comments or campaigns of their own clients or prospects, the client is responsible for ensuring it has an adequate legal basis for that processing.

PingSales will process such data only according to the client's instructions, within the scope of providing the service, unless the law requires different processing.

16. Commercial communications

PingSales may send communications related to the service, security, billing and relevant changes to the platform.

Optional commercial communications will only be sent when there is an adequate legal basis. The user may unsubscribe when applicable.

17. Minors

PingSales is intended for professional and business use. It is not directed at persons under 18 years of age. If data on minors is found to have been processed improperly, PingSales may delete that data.

18. Changes to this Policy

PingSales may update this Privacy Policy whenever necessary, namely due to legal, technical or operational changes. The updated version will be published on this page indicating the update date.

19. Contact

For questions related to privacy, data protection or data deletion:

PINGSALES AI SOLUTIONS, LDA Email: privacy@pingsales.pt Address: Rua Francisco Costa Gomes, Edifício CIBT NERBE, n.º 2, 7800-591 Beja, Portugal