Data processing agreement

Subject and duration

We process personal data only to provide the service described in the terms, for as long as your workspace exists, and then delete it as set out below.

People and data involved

• Visitors of your websites: messages, attachments, name and email address if they give them, data your website passes with identify(), language, browser (user agent), current page, approximate location (country, city and its coordinates) worked out from the IP address, which is not stored, and the times of their visits.
• Members of your team: name, email address, languages, role, availability and the messages they write.
• You decide what you ask your visitors. Do not collect special categories of data, such as health data, unless you need them and have a legal basis.

Your instructions

We process the data only on your documented instructions: these terms and the settings of your workspace (retention period, allowed domains, privacy link, team). The law can require otherwise; in that case we tell you first, unless the law forbids it. If we think an instruction breaks data protection law, we tell you.

Confidentiality

Only the people who run the service can access the data, and they are bound to confidentiality. They do not read your conversations, except when needed for support you ask for, for security, or because the law requires it.

Security measures

• Every connection to the panel and the widget uses HTTPS.
• Passwords are stored only as a hash; the visitor code kept by the widget is stored only as a hash too.
• IP addresses of visitors are not stored.
• The data of each workspace is available only to its members, according to their role. Attachments are stored outside the public folder of the site, with random names, and reach only the workspace and the visitor of the conversation.
• The content of push notifications is encrypted for the agent’s device.
• Conversations, visitors and attachments are deleted automatically at the end of the retention period you chose.

Sub-processors

You authorise us to use these sub-processors, each bound by data protection obligations equivalent to these:

• DreamHost (United States): hosting of the service, the database and the attachments, and delivery of email.
• The push services of browser makers (for example Google, Mozilla, Apple or Microsoft): delivery of encrypted notifications to your team, only for the members who turn them on.

Changes to sub-processors

We tell you by email at least 30 days before we add or replace a sub-processor. If you object for reasons related to data protection, you can stop using the service before the change, and get a refund for the unused part of any paid period.

Transfers outside the European Union

Where data is transferred outside the European Economic Area, the transfer relies on an adequacy decision, where the recipient is covered by one, or on the Standard Contractual Clauses of the European Commission.

Help with your obligations

• Requests from data subjects: in the panel you can see the conversations of a visitor, block them, and delete a visitor with all their conversations and attachments. If a visitor writes to us, we forward the request to you. When you need more, we help you within a reasonable time.
• Data breaches: we inform you without undue delay after becoming aware of a breach affecting your workspace, with the information you need to notify the supervisory authority and, where required, the people involved.
• Impact assessments and prior consultations: we give you the information about the service you need for them.

Deletion at the end

When a workspace is deleted, from its settings or at the end of the contract, its data is removed at once from the database and its attachments from storage. Copies kept by the hosting provider for disaster recovery, if any, expire in their normal cycle.

Audits

On request we give you the information needed to show that we meet these obligations. Audits by you or an auditor you appoint, bound to confidentiality, can be agreed with reasonable notice, at your cost, at most once a year unless there has been a breach.

Your responsibilities

• You need a legal basis for processing the data of your visitors and your team through Telloox.
• You must inform your visitors about the chat, for example with a link to your privacy policy in the widget.
• You choose a retention period suited to your purposes.

Contact

For anything about this agreement or the processing of your data, write to [email protected].