Data processing

These data-processing terms describe how Uprounded handles personal data on a customer’s behalf when providing OpenLiveChat. They form part of the service agreement when incorporated into the customer’s accepted order or agreement.

Parties and roles

The parties are the customer identified in the accepted order or service agreement and Uprounded, KvK 90374894, at Sint Elisabethstraat 12, 5261 VM Vught, the Netherlands. Uprounded is referred to as “we” or “us”. The privacy contact for this agreement is privacy@openlivechat.com.

The customer is the controller of personal data submitted to its workspace, and we act as its processor for the services covered here. If the customer processes data for another controller, it must have authority to appoint us as a further processor and pass on the relevant instructions. Roles follow the actual processing, not just these labels.

Our own account administration, billing, fraud prevention and direct customer support may involve processing for which we are a controller. That processing is covered by our privacy policy. These terms take priority over conflicting general service terms in relation to processing on the customer’s behalf.

What the processing covers

The subject matter is the provision of the customer’s configured inbox, chat widget, channels, knowledge content and AI-assisted support features. Processing lasts for the service agreement and the period needed to return or delete data as set out below. Features that the customer does not enable are not a separate instruction to process data for those features.

• Purpose and operations: receive, transmit, store, organise, retrieve, display, search, analyse and delete customer-support records; provide selected AI results and service communications; and secure, maintain and troubleshoot the service.
• People concerned: the customer’s website visitors, customers, prospective customers, correspondents, employees, contractors and other authorised workspace users whose information is submitted.
• Data involved: names and contact details; messages and supported attachments; channel and visitor identifiers; page context and timestamps; internal comments, tags and assignments; knowledge content; and enabled AI inputs and results.
• Sensitive information: the service does not require special-category data or criminal-offence data for ordinary use. The customer must avoid submitting it unnecessarily and ensure any intended use involving such data is lawful and supported by appropriate safeguards.

Customer instructions

We process customer personal data only on documented instructions, including the accepted agreement, authorised workspace settings and requests from authorised customer representatives. These instructions include the customer’s choice to connect channels or send relevant content to a selected AI provider. We do not use customer personal data for our own advertising or to train general-purpose AI models.

If applicable law requires other processing, we inform the customer of the requirement before processing unless the law prohibits that notice on important public-interest grounds. We inform the customer if we believe an instruction infringes applicable data-protection law and may pause the affected processing while the issue is resolved.

The customer is responsible for its lawful basis, visitor notices, required consent, the accuracy of its instructions and the permissions of its authorised users. This does not remove our own obligations as a processor.

Confidentiality and security

We must ensure that people authorised to process customer personal data are bound by confidentiality and have access only as needed for their authorised duties. We apply technical and organisational measures appropriate to the processing and risks, taking account of the nature of the data, available technology and the likelihood and severity of harm.

The service uses authenticated accounts, workspace and inbox permissions, encrypted transport, and encryption for stored chat content and connection credentials. The main application server and configured file and backup storage are hosted by Hetzner in Falkenstein, Germany.

Daily encrypted backups cover the database, uploaded files and configuration needed for recovery. Copies are stored outside the application server in our existing private object-storage bucket, under the same hosting provider account and in the same region. The private backup decryption key is held separately from the application server. Uploaded backup archives are downloaded and checked for integrity. Recovery of the database, files and configuration has been verified in an isolated restore test.

Security arrangements must address access control, availability and recovery, incident handling and periodic review. We will make relevant information about the measures and their operation available to the customer on reasonable request, subject to confidentiality and protection of other customers. These terms do not promise end-to-end encryption, uninterrupted availability or a certification we have not expressly identified.

Service providers and subprocessors

The customer gives general written authorisation for subprocessors engaged to provide the agreed service, subject to this section. We must impose data-protection obligations appropriate to their work that provide the protection required by Article 28 of the GDPR, and we remain responsible to the customer for a subprocessor’s performance of those obligations.

The current platform providers relevant to the service include Hetzner Online GmbH for application hosting, file storage and backups in Falkenstein, Germany, and Resend, operated by Plus Five Five, Inc., for transactional email. Resend stores email-service data in the United States. The data each receives depends on its function: hosting holds the service’s stored records, while email delivery receives recipient details and message content needed for the particular service email.

OpenAI also provides embeddings for platform knowledge indexing and search through an OpenLiveChat-managed API connection, independently of the customer-selected reply provider. It receives imported text, skill names and descriptions and relevant search queries, which can include customer-conversation text. Zoho Mail hosts our support and privacy correspondence in its European data centre and can receive customer personal data included in a support or rights request. Where that correspondence is processed on the customer's behalf, the applicable subprocessor obligations in this section also apply.

Stripe processes subscription and payment information. It is not engaged to host customer conversations, and its independent payment and regulatory processing is not treated as processing customer chat content on our behalf. A customer-selected channel or AI provider may have a direct agreement with the customer; its role depends on the actual arrangement. Using a customer’s API key does not by itself settle the provider’s role or remove applicable processor obligations.

We will notify the customer of intended additions or replacements of our subprocessors before they receive customer personal data, allowing a reasonable opportunity to object on data-protection grounds. We will discuss a reasonable alternative where available. If a justified objection cannot be resolved, the customer may end the affected service before the change, with a proportionate refund of prepaid fees for the service no longer provided. An instruction to connect a provider selected by the customer is handled as that customer’s instruction.

Customers can request the current provider details, the processing involved and information about relevant safeguards at privacy@openlivechat.com.

International transfers

The location of the main server does not guarantee that all processing takes place in the European Economic Area. Service email, a connected channel or a selected AI provider can involve processing elsewhere. The customer’s configuration and the provider’s terms determine the data involved.

The platform OpenAI connection uses its global API service. OpenAI's published data-processing addendum provides for relevant international-transfer safeguards. Zoho's European mailbox storage can involve technical-support access outside the European Economic Area. These services therefore require consideration separately from the location of our main application server.

Where a transfer requires safeguards under applicable data-protection law, we must ensure an applicable adequacy decision or appropriate transfer mechanism, such as Standard Contractual Clauses with any necessary supplementary measures, applies to processing we arrange. Resend’s published data-processing agreement includes Standard Contractual Clauses for relevant transfers. We will provide information about the safeguards applicable to the customer’s processing on request; confidential information and other people’s data may be redacted.

Requests, incidents and assistance

Taking account of the nature of processing and the information available to us, we assist the customer with requests to access, correct, export, restrict or erase personal data, and with objections to processing. Requests can be sent to privacy@openlivechat.com. We may verify the requester’s authority before disclosing or changing workspace data.

If a person contacts us directly about data the customer controls, we direct the request to the customer or tell the person how to contact it. We do not independently decide the customer’s response unless instructed or required by law.

We notify the customer without undue delay after becoming aware of a personal-data breach affecting data processed on its behalf. As information becomes available, we describe the nature of the breach, affected data and people, likely consequences, measures taken or planned and a contact for follow-up. We provide updates where the initial information is incomplete and assist with the customer’s notification obligations.

We assist the customer, as required by applicable law, with security obligations, data-protection impact assessments and prior consultations concerning this processing. The customer remains responsible for decisions and notices it must make as controller. Ordinary support hours do not change a legal duty to notify a breach without undue delay.

Return, deletion and backups

The standard service retention schedule is 24 months for closed conversations, measured from the latest closure or later message or internal-discussion activity; reopening pauses expiry. It covers associated attachments, internal comments, stored AI results and conversation records held by OpenLiveChat. Spam and Trash expire after 30 days. Separate conversation-event and pseudonymous widget visit records expire after 25 months, or earlier when their parent conversation or workspace is erased. Open conversations and unresolved linked tickets require review rather than age-only deletion. The customer must assess these defaults for its purposes and may send instructions for a shorter period to privacy@openlivechat.com. Longer exceptions require documented necessity and a review deadline. Expiry is processed in batches with retry handling for failed file removal; required deletion instructions take precedence over the standard schedule.

When the service ends, the customer may choose to have its personal data returned or deleted. Send instructions to privacy@openlivechat.com before closing the workspace where possible so that access and the requested export can be arranged. Cancelling a paid plan or disconnecting a channel is not, by itself, an instruction to erase every workspace record.

After providing the requested return, we must delete remaining customer personal data and copies unless applicable law requires retention. We will explain any legal retention requirement and restrict retained data to that purpose. The scope and practical steps are confirmed with the authorised customer; no general conversation-expiry period is substituted for a valid deletion instruction.

Routine backups use a 14-day retention setting, enforced through scheduled cleanup and a storage lifecycle rule limited to backup objects. Cleanup and storage processing can delay final removal. Removal from live storage does not instantly erase recovery copies. We must account for both routine backups and any copies outside that cycle when carrying out the customer’s instructions, limit any interim retention to necessary recovery or legal purposes and tell the customer about any delay and its reason. Customer data retained solely in backups must not be used for ordinary operations. If a recovery copy is restored, previously required deletions must be reapplied before the restored data is returned to ordinary use.

Information and audits

We make available information needed to demonstrate compliance with these processing obligations and allow and contribute to audits, including inspections, by the customer or an auditor it appoints, as required by Article 28 of the GDPR.

The parties coordinate reasonable notice, scope and confidentiality to protect the service and other customers. Existing documentation may be used where it adequately answers the request, but it does not replace an inspection that is necessary under applicable law. These arrangements do not limit a supervisory authority’s powers or justify delaying urgent legally required action.

These terms apply for as long as we process personal data on the customer’s behalf. Confidentiality, deletion and other duties that must continue after the service ends remain in effect for the relevant data.