Data Processing Terms
Our commitments when we process personal data on your behalf.
These Data Processing Terms (“DPA”) form part of the Terms of Service between you (the “Customer”) and Way2Chat (“we”). They apply when we process personal data on your behalf as your processor, and reflect the requirements of Article 28 of the GDPR and the UK GDPR.
1. Roles and scope
For personal data of the visitors who use chat on your websites, and of your agents, you are the controller and we are the processor.
| Subject matter | Providing the Way2Chat live chat service |
|---|---|
| Duration | The term of your subscription, and until the data is deleted as described below |
| Nature and purpose | Hosting, storing, transmitting and displaying chat conversations and related records so you can communicate with your website visitors |
| Types of personal data | Names and email addresses visitors provide; chat messages and files; IP address, browser and page information; satisfaction ratings; agent names and emails |
| Data subjects | Your website visitors, your agents and your assistants |
2. Our obligations
- Instructions. We process personal data only on your documented instructions, which are these Terms and your use and configuration of the service, unless the law requires otherwise — in which case we will tell you first, unless the law prohibits it.
- Confidentiality. Everyone we authorise to process the data is bound by a duty of confidentiality.
- Security. We maintain appropriate technical and organisational measures to protect the data, as described on our Security page.
- Sub-processors. You authorise the sub-processors listed on our Sub-processors page. We will notify you before adding or replacing one, and you may object on reasonable data protection grounds; if we cannot resolve the objection, you may end the affected service. We impose equivalent data protection obligations on each sub-processor and remain responsible for them.
- Data subject requests. Taking into account the nature of the processing, we help you respond to requests from individuals to exercise their rights. If an individual contacts us directly about data we process for you, we will pass the request to you.
- Assistance. We help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to us.
- Personal data breaches. We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you reasonably need to meet your own obligations.
- Deletion. When your subscription ends we delete the personal data within 30 days, unless the law requires us to keep it. During the subscription, closed conversations are also deleted once the chat-history period of your plan has passed, as the Terms describe.
- Audits. We make available the information reasonably necessary to demonstrate our compliance with these Terms, and allow for and contribute to reasonable audits, conducted on reasonable notice, no more than once a year unless a breach or an authority requires it.
3. Your obligations
- You have a lawful basis for the processing you instruct, and provide your visitors with the notices the law requires.
- You obtain any consent needed on your websites, including for the storage the chat widget uses.
- You do not instruct us to process special category data or payment card data through chat, except as the law permits and with appropriate safeguards.
4. International transfers
Our service is hosted in the United States. Where personal data subject to the GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses approved by the European Commission (Module Two, controller to processor, or Module Three where you are yourself a processor) are incorporated into these Terms by reference, together with the UK International Data Transfer Addendum for UK data and the equivalent Swiss amendments for Swiss data.
5. Precedence
If these Data Processing Terms conflict with the rest of the Terms of Service on the processing of personal data, these Data Processing Terms prevail.