This Data Processing Addendum ("Addendum") forms part of the Terms and Conditions or any other agreement between the Customer ("Controller") and ELXChatBot.ai ("Processor") where ELXChatBot.ai processes personal data on behalf of the Customer in accordance with the GDPR and UK GDPR.
This Addendum ensures compliance with:
- The EU General Data Protection Regulation (GDPR)
- The UK General Data Protection Regulation (UK GDPR)
- Applicable EU and UK data protection laws
1. Definitions
The following terms have the meanings given in GDPR and UK GDPR:
- Controller means the entity that determines the purpose and means of processing personal data
- Processor means the entity that processes personal data on behalf of the Controller
- Personal Data means any information relating to an identified or identifiable natural person
- Processing means any operation performed on personal data
- Subprocessor means any third party engaged by the Processor to process personal data
2. Purpose of Processing
The Processor will process personal data solely for the purpose of providing the ELXChatBot.ai platform, which includes:
- Chat processing and automation
- Product recommendation and order status features
- Account creation and authentication
- Analytics and performance monitoring
- Customer support
- Platform integrations requested by the Controller
The Processor will not process personal data for any purpose other than as instructed by the Controller.
3. Controller Instructions
The Processor will process personal data only according to written or electronic instructions provided by the Controller.
By using the Service, the Controller instructs the Processor to:
- Process personal data transmitted through the chatbot
- Store chat transcripts as configured by the Controller
- Access connected third party systems such as eCommerce platforms for order information
- Perform operational tasks necessary to deliver the Service
4. Categories of Personal Data
The Processor may handle the following categories:
- Contact details such as names and email addresses
- Order and transaction information
- Customer service queries
- Chat content generated by users
- Technical identifiers such as IP addresses and device information
- Any data voluntarily submitted through the chatbot, including potential sensitive information
As stated in the Privacy Policy, the Service does not intentionally collect special category data, but may temporarily process such data if submitted by end users.
5. Data Subjects
Data subjects may include:
- Customers of the Controller
- Employees or agents of the Controller
- Website visitors and chatbot users
6. Subprocessors
The Controller authorises the Processor to use trusted Subprocessors such as:
- Cloud hosting providers
- Database providers
- Logging and analytics tools
- Customer support and communication tools
- eCommerce platforms integrated by the Controller
A current list of Subprocessors will be provided upon request.
The Processor will ensure all Subprocessors implement equivalent data protection measures.
7. International Transfers
Where personal data is transferred outside the UK or EEA, the Processor will implement lawful safeguards such as:
- Standard Contractual Clauses (SCCs)
- Adequacy decisions
- Additional contractual security measures
8. Security Measures
The Processor will maintain technical and organisational measures that include:
- Encryption in transit and at rest
- Access controls and authentication
- Secure development practices
- System monitoring and logging
- Regular security reviews
Upon request, the Processor will provide a summary of security measures.
9. Confidentiality
The Processor ensures that all persons authorised to process personal data:
- Are subject to confidentiality obligations
- Receive appropriate training
- Only access personal data when necessary for their role
10. Data Breach Notification
If a personal data breach occurs, the Processor will notify the Controller without undue delay and provide all relevant information known at that time.
11. Assistance to the Controller
The Processor will provide assistance with:
- Responding to data subject rights requests
- Conducting data protection impact assessments
- Meeting breach notification requirements
- Complying with GDPR and UK GDPR obligations
12. Return or Deletion of Data
Upon termination of the Service, the Controller may request data retrieval.
After the retention period, all personal data will be securely deleted unless law requires further retention.
13. Audits
The Controller may request audit information limited to documentation about data protection and security.
Where necessary, the Processor will allow audits or inspections, provided they:
- Are reasonable and not disruptive
- Protect the confidentiality of other customers and system security
- Are limited to once per year unless legally required
14. Liability
Liability under this Addendum follows the terms of the main Service Agreement.
15. Term
This Addendum remains in effect for as long as the Processor processes personal data on behalf of the Controller.