Vizaible Front Desk — Data Processing Agreement (DPA)
Version 1.1 — effective 15 November 2026
This DPA forms part of the Vizaible Front Desk Terms of Service between you (the business using the service, the "controller") and Tamar Holdings SRL, trading as Vizaible, BCE 0831.349.089, 1 avenue du Gui, 1180 Uccle, Belgium (the "processor"). It meets Article 28 of the General Data Protection Regulation (GDPR) and, for UK customers, the UK GDPR.
1. What we process for you
| Purpose | Running the AI assistant on your website: answering visitors, passing enquiries and appointment requests to you, counting visits and visitor topics, producing your reports. |
| Data subjects | Visitors to your website who use the assistant. |
| Personal data | Name, email address, phone number (optional) and the message of visitors who send an enquiry; the "how did you hear about us" answer; chat messages; language. |
| Not collected | No cookies; no IP addresses stored; no identifiers that follow a visitor between visits. Visit counts and topics are aggregated and not linked to a person. |
| Special-category data | Not intended. In health mode the assistant stores no chat content beyond what is needed to pass on an appointment request (name, contact details, preferred time), stores topic labels only (never a visitor's words or condition), and gives no advice. |
| Duration | For as long as the Terms of Service apply, then deletion under section 8. |
2. Retention
| Data | Kept for |
|---|---|
| Chat transcripts | 30 days, then deleted automatically |
| Enquiries and appointment requests (in our system) | 12 months; the copy emailed to you is yours |
| Visitor topic labels | 90 days |
| Aggregated visit counts | 13 months |
| Approval records of fixes | for the duration of the contract |
3. Our obligations as processor
We will: 1. process personal data only on your documented instructions — these terms, your settings and your approvals are your instructions — unless the law requires otherwise, in which case we tell you first where allowed; 2. ensure that anyone authorised to process the data is bound by confidentiality; 3. apply the security measures in section 6; 4. use sub-processors only under section 5; 5. help you, as far as reasonably possible, answer requests from visitors exercising their rights (access, correction, deletion, objection), and forward to you within 5 working days any request we receive directly; 6. help you meet your obligations on security, breach notification and, where needed, data protection impact assessments; 7. delete or return the data at the end of the contract (section 8); 8. give you the information needed to show compliance with Article 28, and allow audits by you or an auditor you appoint, at your cost, with 30 days' notice, no more than once a year, unless a breach justifies it.
We tell you immediately if, in our view, an instruction breaks data protection law.
4. Your obligations as controller
You confirm that: - you have a legal basis for the processing (for enquiries, usually the visitor's request to be contacted); - your privacy notice tells visitors about the assistant (our customer paragraph can be used); - where your country requires consent for page-level visit tracking, you enable it only behind your consent tool; - health and care practices use health mode.
5. Sub-processors
You authorise the following sub-processors:
| Sub-processor | What for | Where | Safeguard |
|---|---|---|---|
| Anthropic PBC | AI model producing the assistant's answers and drafts | United States | EU Standard Contractual Clauses (and UK addendum) in Anthropic's commercial data processing terms; API data is not used to train models |
| DigitalOcean LLC | Server hosting the assistant and its database | Amsterdam, Netherlands (EU) | DigitalOcean DPA; data stored in the EU region chosen |
| Microsoft Ireland Operations Ltd | Sending enquiry and report emails (Microsoft 365) | EU / as per Microsoft's EU Data Boundary | Microsoft Products and Services DPA |
The weekly AI visibility checks put general questions to AI assistants (Anthropic, OpenAI, Google) built from common topics, never a visitor's message or any personal data. Those providers therefore receive no personal data from your visitors and are not sub-processors under this agreement.
We give you at least 30 days' notice by email before adding or replacing a sub-processor. You can object on reasonable data protection grounds; if we can't address the objection, you can end the contract without penalty. We impose on each sub-processor data protection obligations equivalent to this DPA, and remain responsible to you for them.
6. Security measures
- Encrypted connections (HTTPS) for all traffic to the assistant; access to the server only by SSH key.
- Firewall allowing only web traffic and SSH; automatic security updates.
- Secrets (API keys) stored only on the server, readable by the service account only.
- Separation of customers by account; admin access protected by a secret key.
- Daily backups kept 7 days, in the same EU location.
- Automatic deletion according to section 2.
- Hard spending limits on AI usage per account.
- Logs that record errors without storing visitors' message content.
7. Personal data breaches
We notify you without undue delay, and at the latest within 48 hours of becoming aware of a breach affecting your data, with what we know about its nature, the data and people concerned, likely consequences and the measures taken. We update you as we learn more.
8. End of the contract
Within 30 days after the contract ends, we delete your visitors' personal data and the content of your account, including backups as they expire (at most 7 days later). You can ask for an export of your enquiries before the end. We keep only what the law requires us to keep (for example invoices, which contain no visitor data).
9. International transfers
Apart from the sub-processor listed for the United States, we do not transfer your visitors' personal data outside the EU/EEA. Any new transfer will be covered by an adequacy decision or Standard Contractual Clauses, and announced under section 5.
10. Order of precedence
If this DPA and the Terms of Service conflict on personal data, this DPA prevails.
Contact for data protection questions: contact@vizaible.com