1. Parties and roles
This Data Processing Agreement (the “DPA”) is concluded between the customer who uses MivoChat on its website (the “Customer”), as controller, and MIVO STUDIO S.R.L., Strada Teilor, Nr. 49B, Corp C3, Ap. 2, 407280 Sat Floreşti, Comuna Floreşti, Jud. Cluj, Romania (“MivoChat”), as processor. It forms part of the Terms of Service for every Customer that processes personal data of visitors through MivoChat.
The Customer decides why and how visitor personal data is collected through its website. MivoChat processes that data only on the Customer’s documented instructions, which are given through the Customer’s use of the service, its configuration, and this DPA.
2. Subject matter and duration
MivoChat processes visitor personal data to provide the AI live chat service: answering visitor questions, relaying conversations to the Customer’s team, storing the conversation history, and applying the Customer’s retention settings. Processing lasts for as long as the Customer uses the service, and ends when the Customer’s account or website is deleted, subject to the deletion rules in section 8.
3. Nature and purpose of processing
- Receiving visitor messages and generating AI replies using the Customer’s knowledge sources.
- Translating messages where the visitor and the Customer’s team use different languages.
- Relaying conversations to the Customer’s team through Telegram, Slack, WhatsApp or the MivoChat web inbox.
- Storing conversations, lead and quote details, booking requests, and image attachments in the Customer’s workspace.
- Deleting data according to the Customer’s retention settings.
4. Categories of data subjects and personal data
- Data subjects: visitors of the Customer’s website who open the chat, and the Customer’s team members who reply to conversations.
- Personal data: names, email addresses and phone numbers the visitor gives; message content; the web address of the page where the chat was opened; attached images; a random visitor identifier; a hashed IP address; and, for team members, name and email address.
- Special categories: visitors may include health or other sensitive information in their messages. The Customer decides whether to collect it and is responsible for the lawful basis, including the explicit consent required by Article 9(2)(a) GDPR where applicable. MivoChat does not classify or separately protect that content.
5. MivoChat’s obligations
- Process personal data only on the Customer’s documented instructions, including with regard to transfers to third countries, unless required to do otherwise by EU or Member State law.
- Ensure that people authorised to process the data are bound by confidentiality.
- Implement the technical and organisational security measures described in section 7.
- Engage subprocessors only under section 6.
- Assist the Customer, taking into account the nature of the processing, in responding to requests from data subjects and in meeting its security and breach-notification obligations.
- Notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s visitor data.
- Make available the information needed to demonstrate compliance with Article 28 GDPR, and allow for reasonable reviews on written request.
- Delete or return visitor data at the end of processing, as described in section 8.
6. Subprocessors
The Customer authorises MivoChat to use the subprocessors listed on the subprocessors page. Each is bound by a data processing agreement with equivalent obligations. MivoChat will inform the Customer in advance of any intended addition or replacement of a subprocessor, and the Customer may object on reasonable data-protection grounds. If the parties cannot resolve an objection, the Customer may end its use of the service.
7. Security and international transfers
MivoChat protects visitor data with encryption in transit, row-level security in the database, webhook signature checks, rate limiting, and restricted access to stored tokens and customer data. Some subprocessors process data outside the EEA. Those transfers are protected by appropriate safeguards under Chapter V GDPR, including the EU Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework. The privacy policy describes the locations in more detail.
8. The Customer’s responsibilities
- Give visitors a privacy notice that covers the chat and the processing described in this DPA.
- Tell visitors that the chat is AI-assisted and that their messages are processed by MivoChat and its AI provider.
- Have a lawful basis for the personal data it collects through the chat, and obtain consent where required, including through the consent text on lead, quote and booking forms.
- Set a retention period for each website that matches its own obligations.
- Handle requests from visitors. MivoChat will help, but the Customer is the first point of contact.
- Choose which team members can access conversations, and keep that access current.
9. Deletion and return of data
Conversations are deleted automatically once the retention period set for the website has passed since the last message. When a website or account is deleted, its conversations, lead details, attachments and knowledge are removed, and the deletion is recorded only as an ID and a count. Records that the law requires us to keep are kept for the period the law sets. The Customer can export its own data by asking MivoChat before it closes its account.
10. Precedence and liability
If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails. Liability between the parties for breach of this DPA is governed by the limitation of liability in the Terms of Service.
11. Contact and signed copies
For DPA questions or a countersigned copy, email hello@mivochat.app.