Data Processing Agreement

This Data Processing Agreement (the DPA) forms part of the Terms of Service between you (the Customer) and the provider of Shukai (the Provider; details at the end of this page). It applies to personal data the Provider processes on the Customer’s behalf when the assistant answers on the Customer’s sites. Words defined in the Terms have the same meaning here.

1. Roles

1.1. For Visitor data, the Customer is the controller (in Ukrainian law, the володілець) and the Provider is the processor (the розпорядник).

1.2. This DPA is written to meet the requirements of the Law of Ukraine “On Personal Data Protection” and, where it applies, Article 28 of the EU General Data Protection Regulation (GDPR). Where those laws use different words for the same thing, they are to be read together.

2. What is processed, why and for how long

The subject matter, nature and purpose of the processing, the kinds of personal data and the people they concern, and how long the data is kept are set out in Annex 1.

3. Instructions

3.1. The Provider processes Visitor data only on the Customer’s documented instructions. The Terms, this DPA and the settings the Customer chooses in the panel — which content the assistant reads, which language model it uses, whether it reads values from the page, which tools it calls and where it delivers contact requests — are those instructions.

3.2. The Provider may process Visitor data otherwise only when Ukrainian law or the law of the European Union or a member state requires it; in that case it tells the Customer first, unless that law forbids it.

3.3. The Provider tells the Customer if, in its opinion, an instruction breaks data protection law.

3.4. The Customer informs Visitors and has a legal basis for the processing as section 7.2 of the Terms requires. The Service supports this: a Visitor who leaves contact details is told in the widget that they go to the site owner.

4. Confidentiality

Everyone who has access to Visitor data on the Provider’s side is bound to keep it confidential.

5. Security

The Provider applies the technical and organisational measures described in Annex 2 and keeps them appropriate to the risk. It may change them as long as the level of protection does not fall.

6. Subprocessors

6.1. The Customer authorises the Provider to engage the subprocessors listed on the Subprocessors page.

6.2. The Provider tells the Customer by email at least 30 days before it adds or replaces a subprocessor. The Customer may object within that time on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may end the contract, and the Provider refunds the unused part of the current period.

6.3. The Provider binds each subprocessor to data protection obligations no weaker than this DPA and remains responsible to the Customer for its subprocessors.

6.4. Systems the Customer connects as its own tools, or to which it has contact requests delivered, are the Customer’s own recipients and not the Provider’s subprocessors.

7. Requests from visitors

7.1. The Customer answers requests from Visitors who exercise their rights. The panel lets the Customer read and delete conversations and contact requests and export its account data, conversations included.

7.2. If a Visitor sends such a request to the Provider, the Provider passes it to the Customer without answering it itself, unless the Customer asks it to. Where the panel’s tools are not enough, the Provider helps the Customer at its request.

8. Personal data breaches

8.1. The Provider notifies the Customer without undue delay, and in any case within 48 hours after becoming aware of a personal data breach affecting Visitor data.

8.2. The notification describes, as far as is then known, what happened, what data and how many people are affected, the likely consequences and what the Provider has done and proposes to do. The Provider adds what it learns later as it learns it.

9. Other assistance

At the Customer’s request, the Provider gives the information it holds that the Customer needs for a data protection impact assessment or a consultation with a supervisory authority about processing under this DPA.

10. Deletion

10.1. During the contract, conversations are deleted automatically when the retention period of the Customer’s Plan has passed (Annex 1), and the Customer may delete them sooner.

10.2. When the Customer deletes its account, the Provider deletes Visitor data from its database at once and from backups within 14 days. When the contract ends in any other way, the Provider deletes it within 30 days after the end. In both cases this does not apply to data the law requires the Provider to keep. Before that, the Customer can export its data in the panel.

10.3. Daily totals derived from conversations — counts by day, page, language, type of device and approximate location — are kept after the conversations are deleted, so that the Customer’s statistics remain. They contain no text of a message and no identifier of a Visitor, and identify no Visitor.

11. Information and audits

11.1. The Provider makes available the information needed to show that it complies with this DPA.

11.2. If that information is not enough, the Customer may have the processing audited by an independent auditor bound to confidentiality, at its own cost, with at least 30 days’ notice, during business hours and no more than once a year, unless a supervisory authority requires otherwise or a personal data breach has occurred.

12. Transfers

Where the Provider or a subprocessor processes Visitor data outside Ukraine and the European Economic Area, the transfer is made under appropriate safeguards — the European Commission’s standard contractual clauses where the GDPR requires them, or the safeguards the Law of Ukraine “On Personal Data Protection” provides.

13. Liability and precedence

Liability under this DPA is governed by the Terms. If this DPA and the Terms conflict on the processing of Visitor data, this DPA prevails.

Annex 1. Details of the processing

Subject matter and purpose. Providing the Service to the Customer: answering Visitors on the Customer’s sites by text and voice, handing them to the Customer’s team, performing the actions the Customer allows, and giving the Customer the conversations and their statistics.

Nature. Collection, recording, storage, retrieval, use, transmission to subprocessors, and deletion.

People concerned. Visitors of the Customer’s sites; and, where the Customer passes the signed-in user’s token to the widget, the Customer’s own users.

Personal data.

• messages and the conversation’s history;
• voice, streamed for speech recognition and not stored;
• contact details and comments a Visitor leaves in a contact request (the contact details stored encrypted);
• an identifier of the Customer’s signed-in user, where the Customer passes one to the widget;
• technical context: user-agent string, device type, operating system and browser, browser language, time zone, the full page address, referrer, campaign tags, and approximate location (country, region, city) where the network provides it — IP addresses are not stored;
• the names of the fields, buttons, headings and links on the page the Visitor is looking at, so that the assistant can describe and use it; and, where the Customer enables it, the values in its fields;
• data returned by tools the Customer connects.

Kept on the Visitor’s device. The widget keeps the Visitor’s recent conversations (up to 10, for 7 days) and their preferences, such as the widget’s position, in the browser’s local storage. It sets no cookies.

Special categories. The Service is not designed for special categories of personal data. The Customer does not configure it to request them.

Duration and retention. For the duration of the contract. Conversations are kept for the retention period of the Customer’s Plan as shown on the pricing page (from 30 to 365 days after the conversation was last active); daily totals with no text and no identifiers are kept for statistics. Contact requests are kept until the Customer deletes them or the Customer’s site or account.

Annex 2. Technical and organisational measures

• Servers, database and backups in the European Union (AWS, Frankfurt, Germany).
• Encryption in transit (HTTPS and secure WebSockets).
• Application-level encryption of contact details left by Visitors, of payment tokens and of the credentials of the Customer’s tools; passwords and management API keys stored as hashes.
• Each customer’s data separated logically from every other customer’s; every request to the management API checked against the account that owns the data.
• IP addresses of Visitors not stored: an address is used only as a one-way keyed code, held in memory for at most 24 hours, to limit automated abuse; the widget sets no cookies.
• Access to production systems limited to the Provider.
• Reading values from the Customer’s page off by default; password, hidden and file fields, and fields the Customer marks private, never read.
• Daily automatic deletion of conversations past the retention period.
• Database backups kept for 14 days.
• Account sign-in with a verified email address, or with Google.

Annex 3. Subprocessors

The current list is on the Subprocessors page.