Data Processing Agreement

This DPA governs how SiteHelp ("the Processor") processes personal data on behalf of its customers ("the Controller") under the GDPR, the UK GDPR, and India's DPDP Act 2023. It applies automatically to every paid and trial account as part of our terms — print this page or save it as PDF for your records; counter-signed copies are available on request from hello@example.com.

1. Roles and scope

The Customer is the Controller (or "Data Fiduciary" under the DPDP Act) of personal data processed through the service: website-visitor records, chat and channel conversations, leads, tickets and knowledge-base content. SiteHelp is the Processor ("Data Processor") and processes this data solely to provide the service, on the Customer's documented instructions, and never for its own purposes. Conversation content is never used to train AI models — ours or anyone else's.

2. Processing details

3. Processor obligations

• Instructions: process only per this DPA and the Customer's configuration (retention windows, consent mode, channel connections).
• Confidentiality: personnel access is role-limited, logged, and bound by confidentiality obligations.
• Security (Art. 32): TLS in transit, encryption of credentials/keys at rest, tenant isolation, two-factor authentication, IP allowlisting, audit logging, payment-card redaction at ingest, and the controls described on the Security page.
• Sub-processing: only the sub-processors on the public register; 30 days' notice before adding one, with a right to object. Equivalent obligations flow down in writing.
• International transfers: where data moves across borders (including to LLM providers), EU Standard Contractual Clauses (2021/914, Module 3) apply.
• Data-subject rights: the console provides export (Art. 15/20) and erasure (Art. 17) tooling; we assist with any request we receive directly by forwarding it within 72 hours.
• Breach notification: we notify affected Customers without undue delay and no later than 72 hours after becoming aware of a personal-data breach, with the details required by Art. 33(3), and cooperate on onward notification duties (including DPDP Board notification for Indian fiduciaries).
• Deletion & return: on termination the Customer may export all data for 30 days, after which it is deleted; deletion is available immediately on request.
• Audit: we answer security questionnaires (see the pre-filled questionnaire) and make available the information reasonably necessary to demonstrate compliance.

4. Customer obligations

The Customer warrants that it has a lawful basis for the data it collects through the service, configures consent mode and disclosure notices appropriate to its audience (the widget ships with strict consent mode, AI disclosure and recording notices built in), and does not direct the service at children without verifiable parental consent.

5. Signature

This DPA is incorporated into the service terms and takes effect on account creation — no signature is required for validity. For procurement processes requiring a countersigned copy: print this page, sign below, and email it to hello@example.com; we return a countersigned PDF within 5 business days.

Version 1.0 — August 2026. Material changes are announced on the changelog with 30 days' notice.