Article 28 GDPR terms covering the visitor data your agent collects.
This agreement is between [COMPANY NAME] ("Processor", "we") and the customer named on the Selraiz account ("Controller", "you"). It applies whenever we process personal data on your behalf and forms part of our Terms of Service. It takes effect when you open an account; no signature is required, though we will countersign a copy on request to privacy@selraiz.com.
Terms such as "personal data", "processing", "controller", "processor" and "personal data breach" carry the meanings given in the GDPR (Regulation (EU) 2016/679).
You are the controller of personal data collected from visitors through your agent. You decide why it is collected and what happens to it. We are your processor and act only on your documented instructions.
Separately, we are a controller for data about you as our customer - your account, billing and support records. That processing is governed by our Privacy Policy, not by this agreement.
| Item | Detail |
|---|---|
| Subject matter | Operating an AI sales agent on your website |
| Duration | For as long as your account is open, plus the deletion period in section 12 |
| Nature and purpose | Collecting, storing, retrieving, analysing and transmitting visitor conversations and enquiries so your agent can answer them and pass qualified leads to you |
| Types of personal data | Message content typed or spoken by visitors; contact details a visitor chooses to give (typically name, email, company, sometimes phone); pages viewed during a walk-through; session identifier and approximate language |
| Categories of data subject | Visitors to your website who interact with your agent |
| Special category data | None. The service is not designed for special category data and you must not configure an agent to collect it |
We will:
You warrant that you have a lawful basis for collecting visitor data through your agent, that you have given visitors the information required by Articles 13 and 14, and that your instructions to us comply with data protection law.
You must not configure an agent to collect special category data, data about children, or data you have no lawful basis to hold. You are responsible for the content you train your agent on and for the questions it asks.
Taking into account the state of the art, the costs of implementation and the risks involved, we maintain measures including:
We may update these measures, provided the level of protection is not reduced.
You give general authorisation for us to engage sub-processors. The current list is published at selraiz.com/legal/subprocessors.html and forms part of this agreement.
We impose data protection obligations on each sub-processor that are no less protective than those in this agreement, and we remain fully liable to you for their performance.
We will give you at least 30 days' notice by email before a new sub-processor starts processing. You may object within that period on reasonable data protection grounds. If we cannot offer a workable alternative, you may terminate the affected part of the service without penalty and receive a pro-rata refund of fees paid in advance.
Personal data processed under this agreement is stored in AWS Frankfurt (eu-central-1) and remains in the EU at rest.
Some sub-processors - the model providers, and our payment and email providers - are established outside the EEA, and personal data reaches them in the course of providing the service. Each such transfer relies on an approved safeguard under Chapter V GDPR: the European Commission's Standard Contractual Clauses, an adequacy decision, or certification under the EU-US Data Privacy Framework. The applicable safeguard for each provider is named on the sub-processor page, and a copy is available on request.
Where the Standard Contractual Clauses apply, they are incorporated into this agreement by reference, with you as data exporter and us as data importer, and a transfer impact assessment is available on request.
If a visitor contacts us directly to exercise their rights, we will not respond substantively. We will pass the request to you without undue delay and let the visitor know they should contact you.
The dashboard lets you search, export and delete conversations and leads yourself, which is normally the fastest way to satisfy a request. Where you need more, we will provide reasonable assistance at no charge for requests of ordinary volume.
We will notify you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting personal data we process for you. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.
Notifying supervisory authorities and affected individuals is your responsibility as controller; we will provide the information you reasonably need to do it.
We will make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.
Audits are limited to once per twelve-month period unless a breach has occurred or a supervisory authority requires more, require 30 days' written notice, must be conducted during business hours without unreasonable disruption, and are subject to confidentiality. Where available, current third-party reports or certifications will be offered first to satisfy the request.
On termination you may export your conversations and leads from the dashboard. At your choice we will delete or return all personal data processed under this agreement within 30 days of account closure, and delete existing copies, unless EU or member state law requires storage.
Backups are overwritten on a rolling cycle and are fully purged within [BACKUP CYCLE] days.
This agreement takes effect when you open an account and continues for as long as we process personal data on your behalf. The liability provisions of the Terms of Service apply to this agreement.
Where this agreement conflicts with the Terms of Service on the processing of personal data, this agreement prevails.
Questions or a countersigned copy: privacy@selraiz.com.