1. Parties and roles
This Data Processing Addendum (“DPA”) forms part of the agreement between the owner of a TalkThem workspace (“Customer” or “Controller”) and TalkThem (“Processor”) to the extent TalkThem processes Customer Personal Data on Customer’s behalf. For account, security, billing and service-operation data, TalkThem may act as an independent controller as described in the Privacy Policy.
2. Subject matter, duration and instructions
TalkThem processes Customer Personal Data only to provide and secure live chat, visitor presence, message routing, history, analytics, automation, operator applications, notifications and storage, and only on Customer’s documented instructions, including product settings and API usage. Processing continues for the service term and applicable retention/deletion period.
3. Data subjects and categories
Data subjects: Customer website visitors, end users, operators and other persons whose data Customer submits through the service. Data: messages, IP address, approximate IP-derived location, user agent, URL/referrer, session/profile identifiers, timestamps, visitor timeline, notes/tags, attachments, operator activity and other information voluntarily submitted through the widget.
4. Confidentiality and security
TalkThem restricts access to personnel who need it to provide the service, applies confidentiality obligations and maintains reasonable technical and organisational measures appropriate to risk, including TLS, role-based access, protected sessions, optional 2FA, encryption of sensitive secrets at rest, rate limiting, network protection, logging and backups. Customer remains responsible for its endpoints, credentials, content and access configuration.
5. Assistance to Controller
Taking account of the nature of processing, TalkThem provides reasonable assistance with data-subject requests, security obligations, risk assessments and DPIAs. Customer remains responsible for deciding how to respond to visitor requests and for establishing the lawful basis for its processing.
6. Personal Data Breaches
After becoming aware of a confirmed security incident involving Customer Personal Data, TalkThem will notify Customer without undue delay and provide reasonably available information needed for Customer to meet applicable obligations.
7. Subprocessors
Customer grants general written authorisation for TalkThem to use providers identified as subprocessors on the Subprocessors page. TalkThem remains responsible for applicable processor obligations performed by its subprocessors and will impose appropriate contractual data-protection duties. TalkThem will provide reasonable electronic notice of an intended material subprocessor change before the new subprocessor begins processing where practicable, will update the public list, and Customer may raise a reasonable data-protection objection.
8. International transfers
If an EEA transfer requires an Article 46 GDPR mechanism, the then-current European Commission Standard Contractual Clauses apply in the appropriate module, with required annexes and supplementary measures. For a restricted transfer under UK GDPR, the parties use the then-current UK International Data Transfer Addendum to the EU SCCs or the IDTA, as applicable, together with the required data-protection assessment.
9. Deletion and return
After service termination and on lawful Customer instruction, TalkThem deletes or returns Customer Personal Data unless continued retention is required by law or for limited legitimate purposes such as security, dispute resolution and evidence of contractual actions. Backups are removed through ordinary rotation.
10. Audit information
TalkThem will make available information reasonably necessary to demonstrate compliance with this DPA and permit reasonable audit procedures on prior notice, subject to security, other-customer confidentiality and trade-secret safeguards. The parties will ordinarily use documentation and remote review before an onsite audit.
11. California and US state service-provider terms
Where US state privacy law applies and TalkThem acts as a service provider or contractor, TalkThem will not sell or share Customer Personal Information for cross-context behavioral advertising, will process it only for the specific business purposes of providing and securing TalkThem, and will not retain, use or disclose it outside purposes permitted by the contract and applicable law, and will not combine it with personal information received from another person or from its own consumer interactions except where applicable law permits.
12. SCC Annex information
Where SCCs apply, Customer is the data exporter and TalkThem is the data importer/processor (or subprocessor where Customer itself acts as processor). Processing is continuous or on-demand for the service term; data subjects and categories are described in Section 3; purposes are described in Section 2; retention follows Section 9 and the Privacy Policy. The technical and organisational measures in Section 4 and the Security & Trust page form Annex II, and providers identified as subprocessors on the current Subprocessors page form Annex III. Party contact details and the required governing-law/court selections are completed from the Customer account/order and TalkThem legal identity information.
13. Order of precedence
If this DPA conflicts with the general Terms regarding processing of Customer Personal Data, this DPA controls. Mandatory SCC or UK Addendum provisions control to the extent required by their terms.