Data processing agreement

This data processing agreement ("DPA") applies when you use TalkMerlin to chat with visitors of your websites. It is part of our terms, and you enter into it by using the service.

Roles

You are the controller of your visitors' personal data. TalkMerlin, run by Ludovic Verbeeck, is your processor under Article 28 GDPR. We process that data only on your documented instructions: to run the chat on your sites, as set out in the terms and in your settings.

Subject matter and duration

We store and show your visitors' chats, visits and files so your team can answer them, and we send the emails the service sends. Processing lasts as long as your account exists.

Data subjects

People who visit your websites while the chat is installed, and people who chat with you. Your own team members are covered by our privacy policy.

Personal data processed

• Before a chat: a hash of the IP address, user agent and site with a random value that changes every day (the IP address itself is not stored), the country from Cloudflare's country header, the pages viewed (address, title and referrer), the number of visits, and when they happened.
• In a chat: messages, files up to 10 MB each, the name and email address if the visitor gives them, a rating and comment if the visitor leaves one, and a random ID in the visitor's local storage.
• By email: replies and copies of chats sent to visitors who gave their email address, and the replies they send back by email.

The service is not designed for special categories of data, such as health data. Do not ask visitors to send them in a chat.

Retention and deletion

• Visits without a chat are deleted 30 days after the last visit.
• Chats are deleted 30 days after the last message on Free, and 24 months after it on Pro. On Pro you can set any period from 1 to 120 months.
• Files are deleted with their chat. Files that were uploaded but never sent are deleted after a day.
• Emails sent by our background jobs are deleted after 7 days.

You can export or delete a visitor's data from the inbox at any time. When your account is closed, we delete its sites, chats, visitor data and files.

Sub-processors

You authorise the sub-processors listed on our sub-processors page. We tell you, by email or in the app, before we add or replace one, so you can object. If you object and we cannot find a solution, you can cancel.

Security measures

• All traffic to the app and the chat is encrypted (HTTPS).
• Data is stored in the EU, on Hetzner servers in Germany and private Hetzner storage in Finland.
• Files are kept in a private storage bucket and are only served through the app.
• There are no passwords to steal: sign-in uses one-time email links, and we store only a hash of each link.
• Each team member sees only the sites the account owner gives them.
• The chat checks which website a request comes from, and rate limits protect it from abuse.
• Our administrator can open an account for support. Every such session is logged.
• People with access to the data are bound by confidentiality.

Assistance

We help you answer requests from your visitors to access, copy, correct or delete their data. The inbox has an export and a delete action for each visitor. If a request reaches us directly, we forward it to you without delay.

Breach notification

We tell you without undue delay after we become aware of a personal data breach that affects your data.

Transfers

Your data is stored in the EU. Where a sub-processor processes data outside the EU, the transfer is covered by safeguards the GDPR accepts, such as standard contractual clauses.

Audits

We make available the information needed to show compliance with this DPA, and allow audits as Article 28(3)(h) GDPR requires.

Contact

Questions about this DPA: [email protected].