Data processing addendum

Processing of visitor conversations and related data in order to run the customer's AI assistant, for as long as the customer uses the service.

Storing and retrieving knowledge, generating answers to visitor messages, flagging hand-offs and leads, and showing conversations to the customer. Data types: visitor messages, optional visitor email addresses, pseudonymous visitor identifiers. Data subjects: the customer's website and chat visitors.

Process personal data only on the customer's documented instructions, which are the use of the service and these terms.

Ensure that persons authorised to process the data are bound by confidentiality.

Apply appropriate technical and organisational measures, including access controls, encryption in transit, row-level access rules per customer, enforcement of knowledge visibility in the database, and rate limiting.

Assist the customer with data subject requests and with security and impact assessments, to the extent reasonable.

Notify the customer without undue delay after becoming aware of a personal data breach.

Delete or return personal data at the end of the service on request, unless law requires retention.

Make available the information needed to show compliance and allow for audits on reasonable notice.

The customer gives general authorisation for the sub-processors below. We will inform the customer of intended changes and the customer may object on reasonable grounds.

Transfers outside the EEA rely on an adequacy decision or the standard contractual clauses, with supplementary measures where needed.

Liability under this addendum is subject to the limits in the terms of service. If this addendum conflicts with the terms regarding personal data, this addendum prevails.