Your data,
on your instructions.

01Scope and roles

This Data Processing Agreement (“DPA”) applies when TalkRobin processes personal data on behalf of a customer (“you”) in providing TalkRobin under our terms of service. For that data you are the controller (or “business”) and TalkRobin is the processor (or “service provider”). It covers the GDPR, the UK GDPR, the Swiss FADP and US state privacy laws such as the California Consumer Privacy Act, where they apply.

No signature is needed: the DPA applies automatically. If you need a countersigned copy, email privacy@talkrobin.com.

02Details of the processing

• Subject matter and purpose: providing live chat, visitor monitoring and profiles, session replays, reporting and support.
• Data subjects: visitors to your websites, your contacts and customers, and your team members.
• Categories of data: identifiers and contact details that visitors share, chat content, visit activity, device and browser data, approximate location, and replay recordings (form inputs masked unless you turn on showing typed text; password and payment card fields always masked).
• Sensitive data: you agree not to use TalkRobin to collect special categories of data, payment card numbers or government ID numbers.
• Duration: for as long as you use TalkRobin, plus the deletion periods below.

03Our obligations

• We process personal data only on your documented instructions, which are these terms, the DPA and your use of the product’s settings.
• We don’t sell it, share it for cross-context advertising, or combine it with other data except as needed to provide TalkRobin.
• Everyone at TalkRobin who can access it is bound by confidentiality.
• We tell you if we believe an instruction breaks data protection law.

04Security measures

We maintain technical and organizational measures appropriate to the risk. These include encryption in transit (HTTPS), hashed passwords, two-factor sign-in, logical separation of each customer’s data, role-based access for team members, masking of form inputs in replays, access to production systems limited to staff who need it, and regular backups. The measures are described further on our security page.

05Subprocessors

You authorize TalkRobin to use the subprocessors listed on our subprocessors page. We bind each one by written contract to data protection obligations at least as protective as this DPA, and remain responsible for their performance. We will give at least 30 days’ notice of a new subprocessor. If you object on reasonable data protection grounds and we can’t address the objection, you may terminate the affected service and receive a refund of prepaid fees for it.

06Data subject requests and assistance

The dashboard lets you find, export and delete visitor, contact and conversation data. If we receive a request from one of your data subjects, we will pass it to you and not answer it ourselves unless you tell us to. We will reasonably help you with data protection impact assessments and with consultations with supervisory authorities.

07Personal data breaches

We will notify you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your data. The notice will include what we know about the nature of the breach, the likely consequences and the steps we are taking, and we will update you as we learn more.

08International transfers

TalkRobin processes data in the United States. For transfers of personal data from the EEA, the Standard Contractual Clauses (Commission Decision 2021/914, Module Two, controller to processor) are incorporated into this DPA by reference. For the UK, the UK International Data Transfer Addendum applies, and for Switzerland the clauses apply with the necessary adaptations. The governing law and courts for the clauses are those of Ireland.

09Deletion and return

You can export your data at any time from the dashboard. When your account is closed, we delete your personal data within 30 days and remove it from backups within 90 days, unless the law requires us to keep it longer.

10Audits

On written request, and no more than once a year, we will provide information reasonably needed to demonstrate compliance with this DPA, such as answers to a security questionnaire. Where the law requires an on-site audit, it must be arranged with reasonable notice, during business hours and under confidentiality, at your cost.