By using this website, you agree to our use of cookies to enhance your experience.
Graham Awards


GDPR: PropTech firm warns agencies on risk of WhatsApp breach

A new PropTech product uses WhatsApp to communicate within agency teams as soon as a lead is received from a portal.

However, the firm behind the product says some agencies currently using staff members’ personal WhatsApp accounts risk breaking GDPR data protection laws

Stitch says using WhatsApp is not only an effective way of communicating within a sales team, but is also a means of communicating with sellers and buyers because - it claims - “it is becoming increasingly challenging to contact customers by phone or email.”


It creates what it calls “a team inbox” on its platform, allowing anyone in the team to see a lead and generate a WhatsApp response to customer and other team members; a bot makes an initial response to out-of-hours leads. 

Stitch emphasises that it uses a purpose-built WhatsApp account for each agency with costs starting at £199 per month.

It claims that agencies already using the personal WhatsApp accounts of individual staff members to share business information are in fact breaking the messaging system’s own regulations and - apparently - are also contravening the new General Data Protection Regulation.

  • Simon Shinerock

    Forgive me for being sceptical but I’d like to see some more robust advice on this issue. It seems to me that GDPR only applies where data is kept on a searchable database and I’m not sure if that applies to a WhatsApp message. Secondly I’m not sure if there is a legal distinction between a company and personal phone. Surely an employer can require an employee to provide a phone for business purposes. If you extend this argument, phone calls from a personal mobile would also be excluded. In terms of WhatsApp’s rules, if business messages are forbidden then billions of users are in default and I can’t see how creating a prop tech add on could possibly change this. I’m open to an explanation

    Andrew Roberts

    GDPR applies to any processing of personal data irrespective of the media used or whether its manually processed or automated. If an employee is conducting business communications with an individual there is an obligation on that employee and his/her employer to ensure that the data subjects data is safe and used appropriately. Agree that prop-tech is not necessarily the answer however, better training and awareness and a large dose of common sense is.

  • icon

    'costs starting at £199 per month'. Just what agents need, another monthly subscription!


Please login to comment

MovePal MovePal MovePal
sign up