Legal

Chat on Page Data Processing Agreement

Version 1.6 · 1 November 2026

Dit document bestaat ook in het Nederlands.

1. Parties and scope

This Data Processing Agreement ("DPA") is concluded between the customer of Chat on Page ("Customer", the controller) and Gintronics BV, Tategemstraat 22, 8790 Waregem, Belgium, company number and VAT BE 0554.684.305, info@gintronics.com ("Processor").

1. This DPA forms part of the Terms of Service (the "Agreement") and applies as soon as the Customer accepts the Agreement. It implements article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"). Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the GDPR.
2. This DPA covers the personal data the Processor processes on behalf of the Customer when providing Chat on Page, as described in Annex 1. It does not cover data for which the Processor is itself the controller (such as account and billing data), which is described in the Privacy Policy.
3. If the Customer is itself a processor on behalf of a third party (for example a partner managing a bot for its client), the Customer warrants that its controller has authorised the use of the Processor and of the sub-processors in Annex 3.
4. In case of conflict, this DPA prevails over the Agreement as regards the protection of personal data. This DPA exists in Dutch and English; for Customers established in Belgium or the Netherlands the Dutch version prevails, for all other Customers the English version.

2. Instructions

1. The Processor processes the personal data only on documented instructions of the Customer, including with regard to transfers to third countries, unless required to do so by EU or member state law; in that case, the Processor informs the Customer before processing, unless the law prohibits this.
2. The Agreement, this DPA and the settings the Customer chooses in the portal, the account API or the MCP server (such as sources, retention period, handoff to staff, transcripts by email, integrations, and importing tickets and publishing articles in Field knowledge) constitute the Customer's complete instructions. Additional instructions must be agreed in writing.
3. The Processor immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions.
4. The Processor does not use the personal data for its own purposes and does not use it to train general AI models. The Processor may compile anonymised, aggregated statistics on the use of the Service that no longer relate to identifiable persons.

3. Obligations of the Customer

1. The Customer determines the purposes and means of the processing and is responsible for its lawfulness, including a valid legal basis and informing Visitors via its own privacy policy that the chat is provided by Chat on Page as processor and that answers are generated by AI.
2. The Customer sets an appropriate retention period in the portal, does not ask Visitors for special categories of personal data unless it is permitted to do so, and has leads and contact details it no longer needs deleted.
3. The Customer only uses sources (websites, documents) that it is entitled to use and that do not contain personal data that may not be processed in this way.
4. If the Customer has support correspondence imported for Field knowledge (from a mailbox, a ticketing system or a file), it only selects correspondence it is entitled to use for this purpose, excludes addresses whose messages may not be imported, and informs its customers via its privacy policy that answered questions are used, without personal data, for general help articles. The Customer reviews the proposed articles before publishing them; if it enables automatic publishing, it remains responsible for what is published.

4. Confidentiality

The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they only access the data insofar as necessary for providing, supporting or securing the Service.

5. Security

The Processor takes appropriate technical and organisational measures in accordance with article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks for data subjects. The measures are described in Annex 2. The Processor may update them, provided the overall level of protection is not reduced.

6. Sub-processors

1. The Customer gives the Processor general authorisation to engage sub-processors. The sub-processors engaged at the date of this DPA are listed in Annex 3.
2. The Processor informs the Customer at least 30 days in advance, by email or in the portal, of any intended addition or replacement of a sub-processor. The Customer may object on reasonable grounds relating to data protection within that period. If the parties cannot find a solution, the Customer may terminate the Agreement with effect from the change, without penalty and with a refund of fees paid in advance for the period after termination.
3. The Processor imposes on each sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA, and remains fully liable towards the Customer for the performance of the sub-processor's obligations.

7. Transfers outside the EEA

The Processor stores and processes the personal data within the European Economic Area. A transfer to a country outside the EEA only takes place if the conditions of chapter V GDPR are met, for example on the basis of an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the standard contractual clauses of the European Commission. At the date of this DPA, this only concerns the delivery of push notifications to the agent app via Google and Apple (Annex 3).

8. Assistance to the Customer

1. Taking into account the nature of the processing, the Processor assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights. The Customer can view, export and delete conversations and leads in the portal, and retrieve conversations via the account API. A deletion becomes final after a waiting period of 7 days; until then the Customer can cancel it. If a data subject contacts the Processor directly, the Processor forwards the request to the Customer without undue delay and does not respond itself, unless instructed by the Customer.
2. The Processor assists the Customer, insofar as reasonable and taking into account the information available to it, in complying with articles 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessments and prior consultation). The Processor may charge reasonable costs for assistance that goes beyond providing the information in this DPA and its annexes.

9. Personal data breaches

1. The Processor notifies the Customer without undue delay, and where possible within 48 hours after becoming aware of it, of a personal data breach affecting the Customer's personal data.
2. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not yet available is provided in phases.
3. The Processor takes reasonable measures to limit the consequences of the breach. The Customer remains responsible for notifying the supervisory authority and data subjects where required.

10. Deletion and return

1. Conversations are automatically anonymised after the retention period set by the Customer: identifiers of the Visitor are removed, and email addresses and telephone numbers in the messages are masked. Leads (contact requests) remain available to the Customer until they are deleted at the Customer's request or at the end of the Agreement.
2. For Field knowledge, imported support correspondence is stored encrypted until it has been processed and is then erased, in any case within 7 days; an uploaded file is deleted as soon as it has been read or reading it fails, and in that case too within 7 days (a temporary copy of the upload within one day). The anonymised question and answer are kept with the article they belong to until the Customer deletes that article or the Agreement ends. To avoid importing the same conversation twice, a hash of the message identifiers is kept for each imported conversation, with its date, language and the reason it was not used, if any, until the end of the Agreement. Access credentials for a mailbox or ticketing system are stored encrypted and deleted when the Customer removes the connection; an import that is running at that moment is stopped and what it has already read is deleted.
3. Until the end of the Agreement, the Customer can export its personal data in the portal and retrieve it via the account API, or ask the Processor for an export. The Processor then deletes the personal data within 90 days, unless EU or member state law requires storage. Data in backups is deleted in the normal backup cycle.

11. Information and audits

1. The Processor makes available to the Customer all information necessary to demonstrate compliance with article 28 GDPR, in the first place through this DPA, its annexes and written answers to reasonable questions.
2. If that information is insufficient, or if a supervisory authority requires it, the Customer may have an audit carried out, at its own expense, by an independent auditor bound by confidentiality, at most once a year and with at least 30 days' notice, during normal business hours and without disproportionately disrupting the Processor's operations or compromising the security and confidentiality of other customers' data.

12. Liability and duration

1. The liability of each party under this DPA is subject to the limitations in the Agreement, without prejudice to the rights of data subjects under article 82 GDPR.
2. This DPA applies as long as the Processor processes personal data on behalf of the Customer. Obligations which by their nature continue after the end (such as confidentiality and deletion) remain in force.
3. This DPA is governed by Belgian law. Disputes fall within the exclusive jurisdiction of the courts of Ghent, Kortrijk division (Belgium).

Annex 1: Description of the processing

Annex 2: Technical and organisational measures

• Hosting and location: servers in the EU; all data of the Service stored in the EU.
• Encryption: all connections to the website, portal, widget, API, MCP server and app are encrypted with TLS. Imported support correspondence and access credentials for mailboxes, ticketing systems and other integrations are also stored encrypted in the database and the cache.
• Separation of customers: every record is linked to one customer account; the application enforces this separation for every query.
• Access control: personal user accounts with roles (owner, editor, agent, viewer); optional two-step verification (app or email code); passwords stored with a strong hash; API keys and app tokens stored only as hashes and revocable at any time; partner access limited and revocable by the Customer.
• Internal access: only authorised personnel of the Processor have access to production systems, with personal accounts and SSH keys, for support and maintenance.
• Protection against abuse: rate limits and temporary blocks per IP address for the widget, the API and login attempts; fail2ban on the server.
• Logging: activity log of changes in the account; server logs kept for 14 days.
• Data minimisation: no tracking cookies in the widget; contact details only on the Visitor's initiative; voice recordings not stored; automatic anonymisation after the retention period. For Field knowledge: a mailbox is read without changing messages or flags, for Gmail and Microsoft 365 with a read-only permission; the API key of a help desk is only used to retrieve resolved tickets and their public messages, without changing or sending anything, and, only if the Customer sets this up, to create a ticket for a handoff; email addresses, telephone numbers, addresses, bank account numbers, order and customer numbers, personal links and the names of senders and recipients are removed with fixed rules before the text is sent to the language model; the language model is instructed not to include personal data, the result is checked again afterwards, and the Customer reviews each article before it is published, unless it enables automatic publishing.
• Availability: backups and recovery procedures.
• Development: changes are tested automatically before going live; dependencies are kept up to date.
• Incidents: monitoring of errors and availability, and a procedure for handling and reporting personal data breaches (article 9).

Annex 3: Sub-processors

Mollie B.V. (payments and invoices) processes only the Customer's billing data, for which the Processor is controller; it is therefore not a sub-processor under this DPA.