Processing your customers’ data

This is an English translation for convenience. The Ukrainian version is the legally binding one and prevails in case of any discrepancy. Read the Ukrainian version.

1. Roles

The store that has installed the Talkoly widget (the “Customer”) is the controller of the personal data of its website visitors. [ПІБ ФОП або назва компанії] (the “Processor”) processes this data on the Customer’s instructions in accordance with Article 4 of the Law of Ukraine “On Personal Data Protection” (and, where applicable, Article 28 of the GDPR). This document constitutes such instructions.

2. What data and why

Chat messages and files; contact details the visitor provided themselves; delivery address; pages viewed and traffic source; approximate city based on IP; device type; ratings and feedback. Purpose: operating the live chat, delivering messages to the Customer’s operators, issuing invoices and arranging delivery through services connected by the Customer, and analytics for the Customer.

3. Processor’s obligations

• process the data only on the Customer’s documented instructions (the account settings are deemed to be such instructions);
• not use the data for its own purposes, not sell it and not share it with other customers;
• ensure confidentiality: only persons who need access to support the service have access to the data;
• take technical and organizational security measures (encrypted connections, password hashing, access separation, backups);
• help the Customer handle visitors’ requests: provide a copy of, correct or delete their data;
• provide, on request, the information needed to demonstrate compliance with these terms.

4. Customer’s obligations

• have a legal basis for processing visitors’ data and inform them about it, in particular in the privacy policy of its website (ready-made text is in Section 8);
• not collect through the chat data that is not needed for sales and service (for example, full bank card details);
• configure operator permissions so that only those who need it have access to phone numbers and emails;
• enter into its own agreements with the payment, logistics and other services it connects.

5. Sub-processors

The Customer agrees that the Processor engages: a hosting provider; an email service for sending emails; Telegram — if the Customer has enabled Telegram notifications. Integrations with monobank, LiqPay, PrivatBank, Nova Poshta, Checkbox and SMS services are enabled by the Customer using its own keys, and data is transferred to them on the Customer’s instructions. The Processor notifies the Customer of any replacement of sub-processors at least 14 days in advance.

6. Incidents

If a leak or other incident affecting the Customer’s data occurs, the Processor notifies the Customer without undue delay, and no later than 72 hours after becoming aware of it, and provides the available information about the nature of the incident and the measures taken.

7. End of processing

After the account is deleted, the Processor deletes visitors’ data within 30 days. Before that, the Customer can export contacts and conversations to CSV.

8. Text for your website’s privacy policy

Add this paragraph to your store’s privacy policy: