This agreement forms part of the SimplyAsks terms of service between Simplyxity Ltd (company number 16938823, "processor") and the business using SimplyAsks ("controller"). It is written to meet Article 28 of the UK GDPR.
What is processed
| Subject matter | Answering the controller's customers' questions on its website, passing unanswered ones to the controller, and delivering the controller's replies. |
| Duration | While the controller uses SimplyAsks, then until deletion under "Retention and deletion" below. |
| Nature and purpose | Storing chats; sending each question, recent turns and the controller's knowledge to an AI model to draft an answer; storing contact details a customer gives for a reply; emailing the controller an alert and the customer the controller's reply. |
| Data subjects | People who use the chat on the controller's website. |
| Personal data | What customers type in the chat; name, email address and phone number when they ask for a reply; the page they were on (its address without query string); the time of each message. Card numbers and passwords that SimplyAsks recognises are removed before anything is stored or sent to the AI model. |
| Special category data | Not intended. The controller must not ask for it (terms, "Acceptable use"). |
Not processed: customers' IP addresses are not stored with their chats. To limit abuse, SimplyAsks counts chats opened per visitor address under a keyed one-way hash of it; the count expires after 10 minutes and is deleted by the nightly clean-up.
The processor's obligations
The processor will:
- process the personal data only on the controller's documented instructions, which are these terms, the controller's settings and its use of SimplyAsks, unless the law requires otherwise (and then tell the controller first, unless the law forbids it);
- ensure that anyone authorised to process it is bound to confidentiality;
- keep it secure (below);
- use subprocessors only as set out below;
- help the controller respond to data subjects exercising their rights;
- help the controller with security, breach notification, impact assessments and prior consultation, taking into account the nature of the processing;
- delete or return the data at the end;
- make available what is needed to show compliance with this agreement, and allow for reasonable audits.
The controller's obligations
The controller is responsible for having a lawful basis for the processing, for telling its customers about it (its privacy notice), and for the lawfulness of its instructions and its knowledge.
Security
Measures in place at the time of writing:
- Data is encrypted in transit (TLS, including between the service and its database, which is verified against the provider's certificate authority) and at rest (by the hosting and database providers).
- Each business's data is reached only with that business's credentials; a customer's chat only with the token their browser was given for it; every query is scoped to one business.
- The service accepts requests only through its edge network, which rate-limits them. Opening a chat requires a bot check.
- Database tables are closed to direct access from the database provider's public API.
- Logs record counts and identifiers, not chat content or contact details.
- Production access is limited to named Simplyxity staff; changes go through reviewed and recorded releases.
Subprocessors
The controller gives general authorisation for the subprocessors listed at /legal/subprocessors. The processor will give at least 30 days' notice by email of a new or replacement subprocessor, during which the controller may object; if the objection cannot be resolved, the controller may end the service. Each subprocessor is bound by data protection terms no less protective than these.
Data subjects' rights
The controller can see each chat and contact detail in its inbox, and can delete a business's data entirely. The processor will help with any request the controller cannot handle itself, within 10 working days, at privacy@simplyasks.dev.
Personal data breaches
The processor will tell the controller without undue delay, and in any case within 48 hours of becoming aware of a breach affecting its data, with what is known and what is being done.
Retention and deletion
- Chats, and the contact details in them, are deleted 365 days after their last activity (or the period agreed). Chats that were opened but never used are deleted after a day.
- When the controller deletes its business, its knowledge, settings, chats and contact details are deleted at once. The database provider keeps daily backups for 7 days, so deleted data is gone from those too within 7 days.
Audits
The processor will answer reasonable written questions about its compliance, and provide this agreement's security description and the subprocessor list. An on-site audit, at the controller's cost and on reasonable notice, is available where those are not enough.
International transfers
Data is stored in the United Kingdom. Where a subprocessor processes it outside the UK, the transfer is covered by UK adequacy regulations or by the International Data Transfer Addendum to the EU standard contractual clauses, as listed for each subprocessor.
Contact
privacy@simplyasks.dev; our data protection contact is dpo@simplyasks.dev.