1. Parties and roles
You, the customer, are the controller. Gijs Rommers, handelend onder de naam GIR-IT (eenmanszaak), enterprise number 1034.062.065, is your processor. This agreement supplements the terms and conditions and applies as soon as you use Model Relay, for as long as we process personal data for you. It follows Regulation (EU) 2016/679 (GDPR) and the Belgian Act of 30 July 2018.
2. Subject of the processing
| Purpose | Making the Model Relay chat work on your website: answering visitors’ questions from the pages of your website you have not excluded and passing messages on to your team. |
| Nature | Receiving and temporarily using questions to generate answers, forwarding contact messages directly by email without database storage, counting questions by topic and page used, keeping cleaned unanswered questions for at most 30 days so you can add missing information, and retaining limited technical usage data. |
| Type of data | Questions and earlier conversation messages for answering, the text of unanswered questions without email addresses, phone numbers, links, account numbers, street addresses, long numbers and self-introduced names, as far as recognised, the name, email address and contact message for email forwarding, and a technical key derived from the IP address. The conversation is not included in the contact email. |
| Data subjects | Visitors to your website who use the chat. |
| Duration | For as long as the agreement lasts. |
Special categories of personal data (such as health data) are not the purpose of the service. You make sure the chat is not deliberately used for such data.
You allow us to also use the counts and the cleaned unanswered questions to improve Model Relay, including testing and training AI models. For that use we are the controller ourselves and inform visitors through our privacy policy. Full conversations are not included, because we do not keep them. Questions containing health data or other special categories of personal data are excluded as soon as we recognise them.
3. Our obligations
We process the personal data only on your documented instructions, which consist of this agreement, the terms and conditions and the settings you choose in the workspace. If we consider an instruction to infringe the GDPR, we’ll tell you. We:
- make sure that people with access to the data are bound by confidentiality;
- take appropriate technical and organisational measures (see article 5);
- assist you, within reasonable limits and for the data we process, with data subject requests; you manage received emails in your own mailbox;
- help you with your obligations on security, breach notification, data protection impact assessments and prior consultation, as far as this relates to our role;
- don’t use the data for our own purposes, for advertising or to train models.
4. Sub-processors
You give us general authorisation to engage sub-processors. We impose the same data protection obligations on them and remain liable to you for their compliance. If we change sub-processors, we’ll notify you in advance so you can object. If we cannot resolve it together, you can terminate the agreement.
| Sub-processor | Task | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, search index, queues, running AI models and sending email notifications | Global network; parent company in the United States |
Mollie B.V. processes your account’s payments. That is not your visitors’ data, and Mollie acts as its own controller for it.
5. Security measures
- encrypted connections (HTTPS) between visitors, the chat and our API;
- access to the workspace only after sign-in, with data separated per website;
- checks on where requests come from and per-visitor limits against abuse;
- visitors’ IP addresses are not stored, only a derived key, which is removed after two days;
- assistant conversations are not retained; unanswered questions are kept without contact details for at most 30 days; contact messages are emailed directly without the conversation and are not retained in our database;
- secrets and keys are managed outside the code;
- our team’s access to production data is limited to what is necessary.
We review these measures regularly and adapt them to the risk.
6. Personal data breaches
If we discover a personal data breach affecting your visitors, we’ll notify you without undue delay, with the information we have so that you can report to the Data Protection Authority and to data subjects where required.
7. Transfers outside the EEA
Personal data may be processed on Cloudflare’s global network. For transfers outside the European Economic Area we rely on appropriate safeguards, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
8. Audit and evidence
On reasonable request we’ll give you the information needed to demonstrate that we comply with this agreement. If you need an audit, we’ll agree it in advance together so that normal operation of the service isn’t affected and confidential information stays protected.
9. End of the processing
When the agreement ends, we delete, at your choice, all personal data we process for you or return it, and destroy existing copies, unless the law requires retention. You manage received emails in your own mailbox.
10. Your obligations as controller
You ensure a legal basis and inform your visitors about the use of the chat, for example in your own privacy policy. Our privacy policy describes what a visitor sees in the chat and you can use it as an example. You exclude pages containing personal data that was not meant for the public.
11. Contact and governing law
For questions about this agreement, email gijs@gir-it.be. Belgian law applies. For disputes, the rules in article 15 of the terms and conditions apply.