GDPR Templates for Your Chatbot

🔒 Privacy Notice

For the chat function we use the chatbot service Helpsy.ai. It stores a
session ID in your browser's local storage (localStorage) to maintain your
chat conversation. No cookies are set, and the data is not used for tracking
or advertising purposes.

For more information, please see our privacy policy.

Chatbot (Helpsy.ai)

Type and Purpose of Processing
We use a chatbot service from Helpsy - Karim Benziane on our website. The chatbot
serves to quickly and easily provide you with answers to frequently asked
questions.

Legal Basis
The processing is based on Art. 6 para. 1 lit. f GDPR (legitimate interest).
Our legitimate interest lies in improving customer service and answering
customer inquiries.

Recipients
Helpsy - Karim Benziane, as data processor

Transfer to Third Countries
To provide AI-based answers to your inquiries, chat messages are transmitted
to Microsoft Azure OpenAI and processed exclusively within the EU (West Europe
region). No transfer to a third country outside the EU/EEA takes place in this
respect.

Storage Duration
- Session ID (browser local storage/localStorage): Retained until 30 minutes of inactivity have passed, you clear your browser's local storage, or you withdraw your consent
- Chat conversations: Automatically deleted after 90 days

Right to Object
You can object to the storage of your chat messages at any time by
contacting us at [Your Email].

Data Subject Rights
You have the right to access, rectification, erasure, restriction of
processing, data portability, and objection pursuant to Art. 15-21 GDPR.

Data Processing Agreement (DPA)
pursuant to Art. 28 GDPR

Between

Controller (your company):
[Company name]
[Address]
[City, Postal Code]

Processor (Helpsy.ai):
Helpsy - Karim Benziane
Schwälmer Straße 5
60486 Frankfurt am Main

Subject Matter and Duration

The processor processes personal data on behalf of the controller within the
scope of providing the chatbot service.

Type of Data
- Chat messages (may contain personal data)
- Session IDs (technical identifiers)
- Timestamps

Categories of Data Subjects
Customers and website visitors of the controller

Technical and Organizational Measures (TOM)
- Encrypted data transmission (HTTPS/TLS)
- Access control to databases
- Regular backups
- Automatic deletion after 90 days
- ISO 27001 compliant data centers

Obligations of the Processor
1. Process data only on documented instructions
2. Ensure confidentiality
3. Support with data subject rights
4. Notification of data breaches

Obligations of the Controller
1. Ensure the lawfulness of processing
2. Inform data subjects about data processing
3. Update privacy policy