Data Processing Addendum

This Data Processing Addendum (“DPA”) is between you (the “Customer”) and LiveChatBot (“we”), and forms part of the Terms of Service. It applies when we process personal data on your behalf while providing LiveChatBot, under laws such as the GDPR, the UK GDPR, the CCPA and India’s Digital Personal Data Protection Act, 2023.

1. Scope and roles

• Subject matter: providing the live chat widget, inbox, AI Agent, Flows, visitor insights and reports.
• Duration: while you have an account, plus the deletion period in section 8.
• Data subjects: visitors to your websites and people who chat with you.
• Personal data: chat messages; names, emails and phone numbers visitors give; IP address and approximate location; device and browser details; pages viewed and activity on your website.
• Roles: you are the controller (or “business”); we are the processor (or “service provider”).

2. Your instructions

We process personal data only to provide the service and as you configure it in the product (for example turning on the AI Agent, webhooks or email collection), or as the law requires. If we think an instruction breaks the law, we tell you.

3. Confidentiality

Everyone at LiveChatBot who can access personal data is bound to keep it confidential and only accesses it when needed to run or support the service.

4. Security

We use technical and organisational measures suitable for the risk, described on our Security page. They include encryption in transit, hashed passwords and API keys, access limited by account, and keeping card details out of our systems.

5. Sub-processors

You authorise the sub-processors listed on our Sub-processors page. We have written terms with each of them that protect personal data at least as well as this DPA. We update that page before adding a new sub-processor. If you object on reasonable data-protection grounds, tell us within 14 days: we’ll try to find a solution, and if we can’t, you may close your account.

6. Helping you

We help you, as far as we reasonably can, to answer data subject requests, carry out data protection impact assessments and talk to regulators. Visitor profiles in the product show what we hold about each visitor.

7. Personal data breaches

If we become aware of a breach affecting your personal data, we notify you without undue delay, with the information we have about what happened, the likely effects and what we are doing about it.

8. Deleting data

When you delete a website or close your account, we delete its personal data from our live systems within 30 days, and from backups when they are next replaced, unless the law requires us to keep it.

9. International transfers

We are based in India. Where personal data from the EEA or UK is transferred to a country without an adequacy decision, the transfer relies on Standard Contractual Clauses or another lawful safeguard.

10. Information and audits

On request, we give you the information you reasonably need to show you meet your obligations, such as answers to security questionnaires. Requests: support@livechatbot.in.