Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the agreement between you ("Customer") and ChatMakeee (the "Processor") for the use of the ChatMakeee service. It sets out how ChatMakeee processes personal data that its customers collect from their own website visitors and contacts through the ChatMakeee chatbots, shareable links, and related features ("Customer Data").

This DPA applies where and to the extent that the GDPR, UK GDPR, or other applicable data-protection law applies to the processing of Customer Data by ChatMakeee. Where it does not apply, this DPA still reflects our commitment to handle Customer Data responsibly.

• Controller. The Customer is the controller of Customer Data. You decide what personal data your chatbots collect, from whom, and how you use it.
• Processor. ChatMakeee is the processor. We process Customer Data only on your documented instructions (chiefly, to provide and support the service, store and display your leads and bookings, and handle the chat).
• Where you capture data from end users, you are responsible for lawfully collecting it, including providing any required privacy notice to those individuals.

• Categories of data: names, email addresses, phone numbers, and any other details your question flows collect, plus booking/appointment information.
• Categories of data subjects: your website visitors and contacts who interact with your chatbots or shareable links.
• Purpose: operating the service, storing and displaying your leads and bookings, sending you notifications, and providing support.
• Retention: we retain Customer Data for as long as your account is active or as needed to provide the service, and as described in our Privacy Policy. You may export or delete your data at any time.

• Compliance. We will process Customer Data in accordance with applicable data-protection law and only on your documented instructions.
• Confidentiality. We will ensure that any person authorised to process Customer Data is bound by confidentiality obligations.
• Security. We maintain appropriate technical and organisational measures to protect Customer Data, including encryption in transit, access controls, and restricted access to our infrastructure providers.
• Sub-processors. We use selected third parties to provide the service (for example, hosting, authentication, email delivery, and payment processing). We will keep an up-to-date list of these providers in our Privacy Policy and will update it as they change.

We will reasonably assist you — subject to our rights and the confidentiality and security of others' data — in responding to a data subject's request under applicable law, and in your compliance obligations regarding security, data breaches, and data-protection impact assessments, to the extent such assistance reasonably requires our cooperation.

If we receive a request from an individual relating to Customer Data (for example, to access, correct, or delete their personal data), we will direct them to you where appropriate and, where required by law, assist you in responding.

If we become aware of a personal-data breach affecting Customer Data, we will notify you without undue delay, provide reasonable information available to us at that time, and cooperate with you in investigating and remediating the breach as appropriate.

Some of our sub-processors may store or process data in regions outside your country or the EEA. Where such transfers are subject to applicable law, we rely on appropriate safeguards, including where applicable the European Commission's Standard Contractual Clauses, to ensure your Customer Data is protected.

On termination of your account or upon your request, we will delete or return Customer Data in accordance with our standard deletion procedures and our Privacy Policy, except where we are required by law to retain it.

If you have any questions about this DPA, please contact us at chatmakeee_contact@chatmakeee.com or visit our Contact page.