Processing agreement
Is there a data processing agreement, and which sub-processors are used?
Guide
AI in customer service and GDPR.
People write things in a chat window they would never have put in an email. Names, order numbers, addresses and sometimes personal identity numbers. When an AI assistant receives them, the same rules apply as for any other processing of personal data, plus a few new ones. Here is what matters most, in the order it usually comes up.
This guide is general information and not legal advice. If you have specific requirements, talk to your lawyer or data protection officer.
01Responsibility
You are the controller, the provider is the processor
When the assistant answers on your website, you are the controller of the conversations. The provider that builds and runs the assistant processes the data on your behalf and is a processor.
GDPR then requires a data processing agreement between you (Article 28). Among other things, it should say what the data may be used for, how it is protected and what happens to it when the collaboration ends. Also ask which sub-processors the provider uses, such as the platform behind the assistant, and where the data is stored.
02Inform
Tell your visitors
Visitors must be told that their data is processed, why and for how long (Article 13). This is done in your privacy policy, ideally with a short line in the chat widget that links to it.
Since 2 August 2026 the EU AI Act also applies, requiring that anyone talking to an AI is told so at the latest at the first interaction (Article 50). An assistant that pretends to be a person is therefore not just dishonest, it breaks the rules. Our assistants always say that they are an AI.
03Minimise
Collect as little as possible
GDPR assumes you do not process more data than you need. For a chat this means the assistant should not ask for an identity number when an order number will do, and that sensitive data should ideally be removed before it is used further.
In our assistants, seven kinds of data are automatically replaced with asterisks before the message is used further: email addresses, phone numbers, personal identity numbers, card numbers, postcodes, IP addresses and links. Names and street addresses are not caught, because they look like any other words. How the masking works.
04Retention
Decide how long conversations are kept
Data must not be kept longer than it is needed. Decide on a retention period for the conversations before the assistant goes live, and make sure it can be followed in practice.
With us, you decide the retention period, and we agree on it before the assistant goes live. Statistics in the customer portal are kept for 13 months and AI summaries for 35 days, and everything is deleted when the contract ends.
05Rights
Your customers' rights
Anyone who has chatted with the assistant has the right to know what data you hold about them, to have it corrected and in many cases deleted. That requires the conversations to be findable and exportable.
Every conversation in our assistants is saved as text and can be exported, so you can respond to such a request.
06Checklist
Questions to ask the provider
Storage
Where are the conversations stored, and for how long?
Sensitive data
Which data is removed automatically, and which is not?
Training
Are your conversations used to train the provider's or anyone else's AI models?
Permissions
What may the assistant read and write in your systems, and who decides?
Ending the contract
What happens to the conversations and material when the contract ends?
Want our answers to those questions? Ask us and we will go through them before you decide.
07Get started
Go through your requirements with us
In a short demo we show how an AI assistant can answer your customers' questions, using your own material. It takes a quarter of an hour. From SEK 3,900 a month excl. VAT, with the exact price set after the demo.