Data Processing Addendum

In this Addendum, “Applicable Data Protection Law” means the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended (“CCPA”) and any other privacy law that applies to the processing under the Terms. Terms such as “controller”, “processor”, “personal data”, “data subject” and “personal data breach” have the meanings in those laws.

For personal data contained in Customer Data (for example visitor chat messages and lead details), the Customer is the controller (or business) and Chatsloop is the processor (or service provider). For account, billing and security data about the Customer's own users, Chatsloop is an independent controller as described in the Privacy Policy.

We will process personal data only on the Customer's documented instructions, which are the Terms, this Addendum, and the Customer's configuration and use of the dashboard and API — unless required to do otherwise by law, in which case we will tell the Customer first where legally permitted. We will tell the Customer if we believe an instruction infringes Applicable Data Protection Law. We will not use Customer Data to train AI models.

Everyone we authorise to process personal data is bound by a duty of confidentiality and receives appropriate training. Access is limited to what is needed to run, secure and support the service.

We maintain appropriate technical and organisational measures as described on our Trust & Security page, including encryption in transit and at rest, tenant isolation using row-level security, role-based access, rate limiting, logging and monitoring, and secure development practice. We may update these measures if the overall level of protection is not reduced.

The Customer gives general authorisation for us to engage the subprocessors listed on our Subprocessors page. We will bind each to data protection terms no less protective than this Addendum and remain responsible for their performance. We will give at least 30 days' notice of any new or replacement subprocessor by updating that page and emailing customers who have subscribed to notices. The Customer may object on reasonable data-protection grounds within that period; if we cannot reasonably accommodate the objection, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.

Taking into account the nature of the processing, we will help the Customer respond to requests to exercise rights of access, rectification, erasure, restriction, portability and objection. The dashboard lets the Customer search for, export and delete an individual visitor's conversations and lead record. If we receive a request directly from a data subject about Customer Data, we will redirect them to the Customer and will not respond substantively unless required by law.

We will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe, to the extent known, the nature of the breach, the data and approximate volume affected, likely consequences, and the measures taken or proposed. We will cooperate with the Customer's reasonable efforts to investigate and meet any notification duty it has to regulators, clients or individuals.

We will give reasonable assistance with data protection impact assessments and prior consultations related to the service. On request, and no more than once a year (or after a breach), we will provide information reasonably necessary to demonstrate compliance with this Addendum, such as our current security summary and responses to a security questionnaire. Where that is insufficient, the Customer may carry out an audit on reasonable notice during business hours, subject to confidentiality and without unreasonable disruption.

Some subprocessors are located in the United States. Where personal data from the European Economic Area, Switzerland or the United Kingdom is transferred to a country without an adequacy decision, the parties rely on, in this order: (a) the subprocessor's certification under the EU–US Data Privacy Framework (and the UK Extension / Swiss–US framework) where available; otherwise (b) the Standard Contractual Clauses.

• EU transfers: the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) between the Customer (exporter) and Chatsloop (importer), incorporated by reference. Option 7 (docking clause) applies; Option 2 (general authorisation) applies in clause 9(a) with the notice period in section 6; the optional independent-dispute-resolution wording in clause 11 does not apply; the governing law and forum under clauses 17–18 are those of Ireland; the competent supervisory authority is the one that supervises the Customer.
• UK transfers: the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, incorporated by reference, with the tables completed by the information in this Addendum and the Subprocessors page.
• Swiss transfers: the clauses above apply, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as competent authority.
• Annex content: Annex I is section 2 of this Addendum; Annex II is section 5 and the Trust & Security page; Annex III is the Subprocessors page.

We will assess, and on request tell the Customer about, our ability to comply with the clauses and will promptly notify the Customer if we receive a legally binding request from a public authority for Customer Data (unless prohibited), and challenge requests we reasonably consider unlawful.

To the extent the CCPA or another US state privacy law applies, we act as the Customer's service provider (processor). We will process personal information only for the business purposes in the Terms and this Addendum; will not sell or share it; will not retain, use or disclose it outside the direct business relationship or for any purpose other than those business purposes; will not combine it with other personal information except as the law allows; will comply with applicable obligations and give the same level of privacy protection as the law requires; will tell the Customer if we can no longer meet those obligations; and the Customer may take reasonable steps to stop and remediate unauthorised use.

The Customer can export or delete Customer Data at any time in the dashboard. After termination we will delete Customer Data within 90 days of account closure (and from backups within 30 further days), unless the law requires us to keep it, in which case we will protect it and use it only as the law requires. On request, we will confirm deletion in writing.

Each party's liability under this Addendum is subject to the limitations in the Terms, except where the Standard Contractual Clauses or applicable law say otherwise. If this Addendum conflicts with the Terms, this Addendum prevails on data protection; if it conflicts with the Standard Contractual Clauses or the UK Addendum, those prevail.