Data processing agreement

Who this applies to

This data processing agreement ("DPA") is part of the terms of service between your business ("you") and New Ways of Doing LLC, which operates ChatUno ("ChatUno", "we"). It applies whenever ChatUno processes personal data on your behalf: website visitors, chat contacts, Instagram users who write to your account, booking customers, email recipients and anyone else your workspace holds data about. It applies automatically when you accept the terms; no signature is needed. If this DPA and the terms disagree on data protection, this DPA wins.

ChatUno's own use of your account details (for sign-in, billing and support) is not covered here; our privacy policy describes it.

Roles

For the personal data your workspace handles, you are the controller and ChatUno is your processor. In GDPR terms that is Article 28; in Turkish law (KVKK, Law No. 6698) you are the veri sorumlusu and ChatUno is the veri işleyen (Article 3 and Article 12). If you are yourself a processor for someone else, ChatUno is your sub-processor and you are responsible for passing on that person's instructions.

Our instructions

We process personal data only on your documented instructions. Your instructions are the terms, this DPA and the settings you choose in your dashboard (for example switching Visitor Tracking on and choosing its consent mode). We do not use your visitors' or customers' data for our own purposes, do not sell it, and do not use it to train AI models. If the law requires us to process it in another way, we will tell you first unless the law forbids that. If we believe an instruction breaks data protection law, we will tell you; we may decline to follow it until it is resolved.

What we process

• Purpose and nature: hosting, storing and analysing data so that ChatUno can answer chats, run your inbox and automations, send the emails you set up, take bookings and show visitor analytics.
• People concerned: visitors to your website, people who chat with your assistant or write to your connected channels, your customers and booking contacts, and the recipients of your emails.
• Data: chat and direct messages, names, email addresses and phone numbers people choose to give, booking details, Instagram-scoped IDs and usernames, and the visitor tracking data described below.
• Duration: for as long as you use ChatUno, plus the deletion periods in Retention and deletion.

You must not send special category data (health, religion, biometric data and the like), payment card numbers or government ID numbers through ChatUno.

Website visitor tracking

Visitor Tracking is off until you switch it on. When it is on, the ChatUno widget on your website works as follows.

• It counts the pages a visitor views using a random ID stored in the visitor's browser on your own site (first-party storage). It records page addresses and titles, clicks, time active, shop steps reached (cart, checkout, purchase), whether the chat was opened, and a salted one-way hash of the IP address. Tracking does not collect names or email addresses. If the same visitor also leaves contact details in the chat, your dashboard shows that contact's visits together.
• You choose one of two consent modes. Ask visitors in the EU/EEA, the UK and Türkiye (recommended, the default) shows a consent banner to visitors there and records nothing for analytics until they accept. Always ask shows the banner to every visitor. There is no mode that tracks without asking anyone.
• To decide whether a visitor is in those regions, ChatUno uses the country Cloudflare reports when the request passes through Cloudflare, and otherwise the browser's time zone. Neither is certain: a visitor using a VPN, travelling, or with a changed time zone can be placed in the wrong region. If neither can place the visitor, the banner is shown. Choose Always ask if that matters for your visitors.
• Accept and Decline are equally easy. Declining deletes the stored IDs and the choice is remembered.
• Visitors who are not shown a banner see a one-time notice that the site counts visits. They can turn tracking off at any time in the widget's Privacy tab, which deletes the stored ID from their browser and stops further tracking.
• If the browser sends Do Not Track or Global Privacy Control, the widget does not track and does not ask, and our servers reject tracking events from such browsers.
• For every visit we store its consent basis: asked (the visitor saw the banner and accepted) or not_required (no banner was shown under the mode you chose). We also keep a record of changes to your workspace's tracking and consent settings, with who made each change and when. These records are available to you to show how consent was handled.

Your responsibilities

• You are responsible for having a lawful basis for visitor tracking on your site, and for choosing the consent mode that matches where your visitors are and the law that applies to you and to them. The consent tools are there to help you comply; choosing a mode is your decision as controller.
• Your website's privacy policy (and cookie notice, where you have one) must tell visitors about the tracking: what is collected, why, how long it is kept, how to turn it off, and that ChatUno processes it for you as your service provider. You may link to this page. In the dashboard you can record that your privacy policy covers ChatUno; we keep that note with the date and the person who set it. The note is your own statement: we do not check your website, and recording it does not make your policy complete or lawful.
• You must not change, hide or work around the banner, the notice or the Privacy tab, or load the widget in a way that tracks before a visitor has chosen where a choice is required.
• You must not try to identify visitors from tracking data, combine it with data from other sources to build profiles of named people, or use it to make decisions that significantly affect them.

The laws this is built around

• European Union and EEA: storing an ID on a visitor's device for analytics needs the visitor's prior consent under Article 5(3) of the ePrivacy Directive, as implemented in each country. The GDPR then applies to the data: you need a lawful basis (Article 6), must be able to show that consent was given (Article 7(1)), and must inform visitors (Article 13).
• United Kingdom: the same rule comes from regulation 6 of the Privacy and Electronic Communications Regulations (PECR), together with the UK GDPR.
• Türkiye: under the KVKK you must inform visitors before or when data is collected (the aydınlatma yükümlülüğü, Article 10), and the Personal Data Protection Authority's cookie guidance (Çerez Uygulamaları Hakkında Rehber, 2022) treats analytics cookies as needing the visitor's explicit consent (açık rıza, Article 5(1)). The informing and the consent request must be separate. This is why the default mode asks visitors in Türkiye.
• United States and elsewhere: several US state privacy laws require a notice at or before collection; the one-time notice and your privacy policy serve that purpose. Other countries have their own rules and the default mode does not cover them; use Always ask where in doubt.

Confidentiality and security

Only people who need access to provide or support the service can reach your data, and they are bound by confidentiality. Data travels over encrypted connections and is encrypted at rest by our database provider. Database rules keep each workspace's data separate. Staff admin tools are limited to named ChatUno accounts with two-factor sign-in, and every request is logged. Access tokens for connected accounts are kept in an encrypted secret store.

Sub-processors

You authorise ChatUno to use the sub-processors on our sub-processor list. Each one is bound by written data protection terms at least as protective as this DPA, and we remain responsible to you for their work. We will update the list and notify account owners by email at least 30 days before a new sub-processor starts receiving personal data. You may object on reasonable data protection grounds within that period; if we cannot resolve the objection, you may end the affected service and we will refund any prepaid fees for the unused period.

Transfers outside your country

ChatUno and its sub-processors process data in the United States.

Where the GDPR applies to your transfer of personal data to ChatUno, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, the "SCCs") are incorporated into this DPA by reference: Module Two when you are a controller and Module Three when you are a processor, with you as data exporter and ChatUno as data importer. For the SCCs: the docking clause (Clause 7) applies; under Clause 9 option 2, you give the general authorisation and 30 days' notice described under Sub-processors; the optional wording in Clause 11 does not apply; the supervisory authority under Clause 13 is the one competent for you; and under Clauses 17 and 18 the SCCs are governed by Irish law and disputes go to the courts of Ireland. Annex I is made up of the parties' details in the terms and this DPA and the "What we process" section; Annex II is the "Confidentiality and security" section; Annex III is the sub-processor list. For the UK GDPR, the UK Information Commissioner's International Data Transfer Addendum to the SCCs applies with the same details; for Swiss data, the SCCs apply with the Swiss Federal Data Protection and Information Commissioner as supervisory authority. If the SCCs and this DPA conflict, the SCCs win. Onward transfers to our sub-processors rely on the Standard Contractual Clauses in their data processing terms and, where a provider is certified, the EU-U.S. Data Privacy Framework.

For data covered by the KVKK, the transfer is a transfer abroad under Article 9 of Law No. 6698 as amended in 2024; we will sign the Personal Data Protection Board's standard contract with you on request, and you notify it to the Authority within five business days of signature, as the law requires.

Helping you with requests and obligations

If a visitor or customer asks to see, correct, export or delete their data, or objects to its use, we help you answer. You can export or delete a customer's records yourself in the dashboard, and visitors can stop tracking themselves in the widget's Privacy tab. For anything the dashboard cannot do, such as deleting the tracking records linked to a visitor ID or a chat contact, email info@chatuno.ai and we will act within 10 business days. If a request reaches us directly, we pass it to you and do not answer it ourselves unless you ask us to.

We also give you the information you reasonably need for a data protection impact assessment, a consultation with a supervisory authority, or to show you comply, including the consent-basis records described above.

Security incidents

If we become aware of a breach of security that affects personal data we process for you, we will tell you without undue delay, and within 72 hours of confirming that your data is affected, even if not all facts are known yet. We will tell you what happened, what data and how many people are involved, what we have done, and who to contact, and we will keep you updated. Notifying your supervisory authority and the people affected is your decision as controller; we help with the information you need.

Retention and deletion

• Visitor tracking: raw events, and visits and visitors not seen again, are deleted automatically after 180 days. The consent basis is kept with the visit it belongs to and deleted with it.
• Other workspace data: kept while your account is active, until you delete it or ask us to. The retention periods for each category are listed in our privacy policy.
• When your account ends, we delete the personal data we process for you within 30 days, unless you ask for an export first or the law requires us to keep it. Copies in our daily database backups expire within 7 days after that.

Audits

We make available the information needed to show that we meet this DPA. If that is not enough, you (or an independent auditor bound by confidentiality) may audit our compliance once a year, on 30 days' written notice, during business hours and at your own cost, or more often if a supervisory authority requires it.

Liability and indemnity

ChatUno's liability under this DPA and the terms of service together is subject to the single limit in the terms, except where the law (or the SCCs, where they apply) does not allow that limit. That limit does not apply to your indemnity below.

You are responsible for, and will indemnify ChatUno against claims, fines, penalties and reasonable costs arising from: your choice of consent mode and other tracking settings; the lawful basis you rely on; your privacy policy, cookie notice and other notices to visitors; any change you make to how the widget asks, informs or tracks; and instructions you give us that break the law. This does not apply to the extent the loss was caused by ChatUno breaking this DPA or the law that applies to us as processor. Nothing here limits the rights people have against either of us under data protection law.

Changes

• October 27, 2026: incorporated the EU Standard Contractual Clauses for transfers to ChatUno, made ChatUno's liability share the one limit in the terms, explained what happens when a visitor's region cannot be placed, and described the privacy-policy note.
• October 27, 2026: first version of this DPA, including the website visitor tracking section (two consent modes, one-time notice, Privacy tab, DNT/GPC, consent-basis records).

We may update this DPA when the product or the law changes. We will tell account owners before a change that reduces your protection takes effect.

Türkçe: web sitesi ziyaretçi takibi

Bu bölüm, yukarıdaki "Website visitor tracking" bölümünün Türkçe karşılığıdır.

• Ziyaretçi verileri bakımından işletmeniz veri sorumlusu, ChatUno ise veri işleyendir (KVKK m.3 ve m.12). ChatUno verileri yalnız sizin talimatlarınızla (şartlar, bu sözleşme ve panelde seçtiğiniz ayarlar) işler.
• Ziyaretçi takibi siz açana kadar kapalıdır. Açıldığında widget, ziyaretçinin tarayıcısında sitenizin kendi alanında saklanan rastgele bir kimlikle sayfa görüntülemelerini sayar; sayfa adresi ve başlığı, tıklamalar, aktif süre, sepet/ödeme/satın alma adımları, sohbetin açılıp açılmadığı ve IP adresinin tuzlanmış tek yönlü özeti kaydedilir. Takip ad veya e-posta toplamaz.
• İki rıza modu vardır: AB/AEA, Birleşik Krallık ve Türkiye'deki ziyaretçilere sor (önerilen, varsayılan) ve Her zaman sor. Kimseye sormadan takip eden bir mod yoktur. Bölge, varsa Cloudflare'in bildirdiği ülkeden, yoksa tarayıcının saat diliminden belirlenir ve yanılabilir; ikisiyle de belirlenemezse banner gösterilir.
• Kabul ve Reddet eşit kolaylıktadır; Reddet saklanan kimlikleri siler. Banner gösterilmeyen ziyaretçiler bir kez bilgilendirme görür ve widget'ın Gizlilik sekmesinden takibi istediği an kapatabilir; bu, saklanan kimliği siler. Do Not Track veya Global Privacy Control gönderen tarayıcılar takip edilmez.
• Her ziyaret için rıza dayanağı (asked: soruldu ve kabul edildi; not_required: seçtiğiniz modda banner gösterilmedi) ve ayar değişikliklerinin kaydı tutulur. Ham olaylar ve tekrar görülmeyen ziyaretler 180 gün sonra otomatik silinir.
• Hukuki sebep sizin sorumluluğunuzdadır. KVKK m.10 uyarınca ziyaretçileri aydınlatmanız; Kurum'un Çerez Uygulamaları Hakkında Rehberi (2022) uyarınca analitik çerezler için açık rıza (m.5/1) almanız gerekir; aydınlatma ile rıza talebi ayrı sunulmalıdır. Sitenizin gizlilik politikası veya aydınlatma metni bu takibi ve ChatUno'yu veri işleyen olarak belirtmelidir. Panelde gizlilik politikanızın ChatUno'yu kapsadığını not edebilirsiniz; bu not tarih ve notu düşen kişiyle saklanır. Not sizin beyanınızdır: sitenizi kontrol etmeyiz ve not, politikanızı eksiksiz veya hukuka uygun hale getirmez.
• Rıza modu ve diğer takip ayarlarınız, hukuki sebebiniz, ziyaretçilere yaptığınız bildirimler ve widget'ta yaptığınız değişikliklerden doğan talep, para cezası ve masraflardan siz sorumlusunuz ve ChatUno'yu bunlara karşı tazmin edersiniz; ChatUno'nun bu sözleşmeyi veya veri işleyen olarak kendisine uygulanan hukuku ihlal etmesinden doğan kısım hariç. ChatUno'nun sorumluluğu şartlardaki tek sınıra tabidir; bu sınır sizin tazmin yükümlülüğünüze uygulanmaz.
• ChatUno ve alt işleyenleri verileri Amerika Birleşik Devletleri'nde işler. KVKK kapsamındaki veriler için bu, 6698 sayılı Kanun'un 2024'te değişen 9. maddesi kapsamında yurt dışına aktarımdır; talebiniz üzerine Kişisel Verileri Koruma Kurulu'nun standart sözleşmesini sizinle imzalarız ve siz bunu imzadan itibaren beş iş günü içinde Kurum'a bildirirsiniz.
• Alt işleyenler alt işleyen listesinde yer alır. İlgili kişi başvurularında size yardımcı oluruz (info@chatuno.ai, 10 iş günü içinde).

Değişiklik: 27 Ekim 2026, ilk sürüm; aynı gün bölge belirlenemezse banner, gizlilik politikası notu, sorumluluk sınırı ve yurt dışı aktarım eklendi. İngilizce metin ile bu bölüm arasında fark olursa İngilizce metin esas alınır.

Contact

New Ways of Doing LLC, 165 Berwick St, Melrose, Massachusetts 02176-3830, United States of America. Questions about this DPA: info@chatuno.ai. Effective October 27, 2026.