Legal
Data Processing Agreement
This agreement forms part of every Delegait AI assistant agreement. It applies when Delegait processes personal data for you, for example the chats and leads your assistant collects. You do not need to sign it separately, but we will sign a copy if you ask. To save a copy, use your browser's print option and choose "Save as PDF".
1. Who is who
You, the client, are the controller. Delegait Ltd is your processor. Words such as personal data, processing, controller, processor and data subject have the meaning given in the UK GDPR.
2. What we process
- Subject matter: running an AI chat assistant on your website.
- Duration: while the service runs, then until deletion under section 10.
- Purpose: answering your website visitors' questions and sending you their enquiries.
- Data subjects: visitors to your website who use the assistant, and your staff who use the service.
- Types of data: chat messages, names, email addresses, phone numbers, event dates, guest numbers and anything else a visitor types in. Technical data such as browser type and a chat ID.
- Special category data: not intended. Please set up the assistant so it does not ask for health or other sensitive data.
3. Our duties
- We process personal data only on your documented instructions. Your instructions are this agreement, the service agreement and any written request from you. If an instruction breaks data protection law, we will tell you.
- Everyone at Delegait who can access the data is bound by confidentiality.
- We keep appropriate technical and organisational security measures in place, as set out in section 7.
- We help you respond to requests from data subjects, such as access or deletion requests, within 5 working days of your request.
- We help you with security, breach notification, data protection impact assessments and consultation with the ICO, as far as our role allows.
- We give you the information you need to show compliance with Article 28 of the UK GDPR, and allow reasonable audits on 30 days' notice, no more than once a year unless there has been a breach.
4. Sub processors
You give general written authorisation for us to use these sub processors:
- Chatbase Inc (United States). Hosts and runs the assistant and stores chats and leads.
- The AI model providers Chatbase uses, such as OpenAI, Anthropic and Google. They generate replies. Chatbase states that customer data is not used to train models.
- Google (Google Workspace). Lead emails pass through our email.
- Attio Ltd. Only if you ask us to keep your leads in our customer records.
We will tell you by email at least 30 days before we add or replace a sub processor. You can object on reasonable data protection grounds. If we can't resolve it, you can end the service without penalty. Each sub processor is bound by a written contract with data protection duties no less protective than this agreement. We remain responsible to you for their work.
5. International transfers
Chatbase and the model providers process data in the United States. These transfers are covered by the EU standard contractual clauses with the UK addendum in Chatbase's data processing agreement, or by certification under the UK Extension to the EU US Data Privacy Framework where a provider holds it. We will not make any other restricted transfer without a lawful safeguard.
6. Personal data breaches
We will tell you without undue delay, and within 48 hours, after we become aware of a breach affecting your data. We will tell you what happened, what data is involved, what we are doing about it and who to contact. We will help you decide whether to notify the ICO or the people affected.
7. Security measures
- Data is encrypted in transit and at rest by Chatbase and our other providers.
- Two factor authentication on every account that can reach your data.
- Access limited to the people who need it. Today that is Tom Hamill only.
- Chat retention in Chatbase set to match your instructions.
- Your assistant's knowledge base, prompt and test questions are kept in a private, access controlled repository.
8. Your duties
- You have a lawful basis for the processing and tell your visitors about it in your own privacy notice, including that an AI assistant is used.
- You do not ask the assistant to collect special category data.
9. Liability
The limits of liability in our Terms and Conditions apply to this agreement, except where the law does not allow them to.
10. When the service ends
On request, we send you an export of your leads and your assistant's content. Within 90 days of the end of the service we delete your personal data from Chatbase and our own systems, unless the law requires us to keep it. We will confirm deletion in writing if you ask.
11. Law
This agreement is governed by the law of England and Wales.
12. Contact
Data protection questions: Tom Hamill, tom@delegait.co.uk, 07356 246484. ICO registration ZC152324.