Data processing agreement
Placeholder. Not written. This is the document a buyer’s legal team asks for by name, and it needs drafting by somebody qualified rather than generated. Everything it has to cover is already true of the product; what is missing is the wording.
It has to cover, at minimum:
- That the customer is the controller and we are the processor, acting only on their instructions.
- The subject matter: live chat conversations, the visitor details they contain, and how long we keep them.
- Our security measures, and the subprocessors on the subprocessor list, with notice before that list changes.
- Assistance with data subject requests, which the export and delete endpoints already provide.
- Breach notification, with a stated timeframe.
- Deletion or return of data on termination, and the retention window a customer can set themselves.
- International transfers, and which standard contractual clauses apply.
- Audit rights, and what evidence we will provide in place of an on-site audit.