I had a similar situation using a replacement phone whilst mine got repaired. A factory reset had been performed, but the Android OS still contained some quite sensitive WhatsApp sent images, including personal photos and even a credit card balance screenshot.
Businesses need to get more savvy in this area.