Data processing agreement

Definitions

This data processing agreement (“DPA”) forms part of the terms of service between PS Website Design Ltd, trading as Chati (“Chati”, “we”, “us”), and the business that has a Chati account (“you”). In it:

• Data protection law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any law that replaces them. Where the EU GDPR applies to you, it includes that too.
• Customer personal data means personal data we process for you when we provide the service, as described in the schedule below.
• Controller, processor, data subject, personal data, processing and personal data breach have the meanings given in data protection law.
• Subprocessor means a third party we engage to process customer personal data.

If this DPA and the terms of service conflict on data protection, this DPA wins.

Roles of the parties

For customer personal data, you are the controller and we are your processor. You are responsible for having a lawful basis to collect and use it, for giving visitors the information data protection law requires (for example in your own privacy notice, including that they are chatting with an AI assistant), and for the content and instructions you give us.

We are a controller in our own right for the personal data of your account users and billing contacts, which we handle under our privacy policy.

Processing instructions

We process customer personal data only on your documented instructions. Your instructions are these terms and this DPA, the settings you choose in your dashboard, and anything else you ask us in writing that we agree to. We won’t use customer personal data for any other purpose, sell it, or use it to train AI models, and we won’t let our AI providers do so.

If the law requires us to process customer personal data in another way, we’ll tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we’ll tell you and may pause that processing until it is resolved.

Confidentiality

Only our staff and contractors who need customer personal data to provide or support the service can access it, and only as far as they need to. All of them are bound by written confidentiality obligations. We access your workspace to give support only when you ask us to, or when we need to investigate a security or technical problem.

Security measures

We take appropriate technical and organisational measures to protect customer personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include:

• a separate database for each customer workspace, each with its own credentials;
• encryption in transit with TLS for all traffic, and encryption of database credentials and secrets;
• passwords stored only as secure hashes, and sessions held in secure, HTTP-only cookies;
• role-based access for your team, and restricted, logged administrative access for ours;
• servers in a UK data centre, with firewalls, security updates and Cloudflare protection;
• regular backups, and an audit log of significant account events;
• read-only, permission-checked access for any connection we build to your own systems.

We review these measures regularly and may update them, as long as the overall level of protection doesn’t go down.

Subprocessors

You give us general authorisation to use subprocessors. Our current subprocessors are:

• Prostack Hosting (United Kingdom): hosting of the Chati platform and all workspace databases;
• Cloudflare, Inc. (global network): security, DNS and content delivery;
• AI providers (United States): generating answers from the question, recent messages and relevant snippets of your content, through business APIs that don’t retain data for training;
• Pinecone Systems, Inc. (United States): a search index of your website pages, documents and saved answers, held as numerical vectors with page titles and addresses. Conversations, leads and visitor details are not stored there; a visitor’s question is sent only as a vector to run the search;
• our email delivery provider: sending service and notification emails.

We’ll send you the names of the specific AI and email providers we use on request. We’ll give you at least 30 days’ notice by email before we add or replace a subprocessor. If you have a reasonable data protection objection, tell us within that time and we’ll work with you to resolve it. If we can’t, you may cancel the affected part of the service and we’ll refund any fees paid for the period after cancellation.

We put a written contract in place with each subprocessor that protects customer personal data at least as well as this DPA, and we remain responsible to you for their work.

International transfers

We store customer personal data in the UK. Where a subprocessor processes it outside the UK, we make sure the transfer meets data protection law, by relying on UK adequacy regulations (including the UK–US data bridge for certified providers) or by putting in place the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any extra safeguards that are needed.

Data subject requests

We’ll help you find, export, correct or delete a visitor’s conversations and leads so you can respond to their requests on time. If we receive a request directly from one of your visitors, we’ll pass it to you without delay and won’t respond ourselves unless you ask us to. We’ll give you any other reasonable help you need to meet your obligations, including with data protection impact assessments and consultations with the ICO.

Breach notification

If we become aware of a personal data breach affecting customer personal data, we’ll tell you without undue delay, and in any case within 48 hours. We’ll explain what happened, the data and people likely to be affected, the likely consequences and what we are doing about it, and we’ll keep you updated as we learn more. We’ll take reasonable steps to contain the breach and help you meet any duty to notify the ICO or the people affected.

Deletion and return of data

You can remove content from Chati at any time, and ask us to delete specific conversations. When your account closes, you have 30 days to ask us for an export of your data in a common format. After that we delete your workspace, including all customer personal data, and backups are overwritten in the normal cycle within a further 30 days. The only exception is data the law requires us to keep, which we’ll keep secure and use only for that purpose.

Audits

We’ll make available the information you reasonably need to show that we comply with this DPA, including answering security questionnaires. If that isn’t enough, or a regulator requires it, you may audit our compliance, yourself or through an independent auditor bound by confidentiality. You’ll give us at least 30 days’ written notice, audits will take place during normal working hours no more than once a year (unless there has been a breach), and you’ll cover the costs.

Schedule: details of processing

• Subject matter and duration: providing the Chati service under the terms of service, for as long as you have an account and until customer personal data is deleted as described above.
• Nature and purpose: hosting, storing, searching and analysing your content and conversations; generating AI answers; handing chats to your team; capturing leads and bookings; and any custom connection you ask us to build.
• Types of personal data: chat messages and anything visitors choose to share in them, such as names, email addresses, phone numbers, booking or order details; technical data such as IP address, browser and pages visited during the chat; and any personal data in the content you add to Chati.
• Special category data: not intended. If your visitors may share health or other sensitive information, for example in a dental or veterinary practice, you are responsible for deciding whether that is appropriate and for configuring Chati to hand those chats to your team.
• Data subjects: visitors to your website and other channels who use the chat; your customers and prospects; and people named in your content.
• Retention: for as long as you keep the data in Chati, and until deletion when your account closes.