This Data Processing Agreement (“DPA”) forms part of the Revo Chat Terms of Service and applies to every business that uses the service, without a separate signature. If you need a signed copy, write to [email protected].
1. Parties and roles
The business using the service (the “Customer”) is the controller. ULUMEŞE TARIM FİDANCILIK PEYZAJ SANAYİ VE TİCARET LİMİTED ŞİRKETİ (“Revo Chat”) is the processor. Subject matter: live chat, a multichannel shared inbox and AI-assisted replies, as described in the Terms of Service. Subscriptions are sold and invoiced by Ludexa Group Limited (UK); Ludexa does not access the data covered by this agreement (conversations, visitor records) and processes only its own invoice and payment records.
2. Details of the processing
- Data subjects: the Customer’s website visitors and the people it talks to on its channels.
- Personal data: name, email address, message content, files and voice messages, IP address and the approximate city derived from it, browser, addresses of pages visited, and channel identifiers (WhatsApp phone number, email address, Messenger, Instagram and Telegram user IDs, sender name and profile photo).
- Nature and purpose: storing, displaying and transmitting conversations, generating AI replies, suggestions, summaries and transcriptions, and sending notifications — only to provide the service to the Customer.
- Duration: for the term of the Terms of Service and the periods in section 10.
3. Instructions
Revo Chat processes the data only on the Customer’s documented instructions (including the settings the Customer chooses in the dashboard) and only to provide the service. It never uses the data for its own purposes, such as advertising, profiling or training AI models. Revo Chat will tell the Customer if it believes an instruction infringes data protection law.
4. Confidentiality
Staff and contractors with access to the data are bound by confidentiality obligations.
5. Security
Revo Chat applies the technical and organisational measures in Annex 1.
6. Sub-processors
The Customer gives general authorisation for the sub-processors listed in Annex 2. Revo Chat will notify the Customer by email at least 30 days before adding a new sub-processor; if the Customer objects on reasonable grounds, it may terminate the service without penalty. Revo Chat imposes on each sub-processor data protection obligations consistent with this DPA and remains responsible for their performance.
7. International transfers
Servers are in Frankfurt, Germany. Revo Chat operates from Türkiye, and its AI and email providers are in the United States (Annex 2). The Customer can turn off automatic replies and voice transcription separately in the site settings, or use its own AI provider key. Transfers to Meta and Telegram happen because the Customer connects those channels, and transfers to Slack or Telegram notifications and webhook addresses the Customer sets up happen on the Customer’s instructions. Transfers from Türkiye to the sub-processors Vultr, Cloudflare, Anthropic, OpenAI and Resend are made under KVKK standard contracts signed with them under KVKK Article 9 and notified to the Turkish Personal Data Protection Board.
8. Assistance to the Customer
Revo Chat provides a tool in the dashboard to permanently delete a visitor’s data and gives reasonable help with requests from data subjects. Any request that reaches Revo Chat directly is forwarded to the Customer without delay. Taking into account the information available to it, Revo Chat also helps the Customer meet its obligations on security, breach notification, data protection impact assessments and prior consultation.
9. Personal data breaches
Revo Chat notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach. The notice describes the nature of the breach, the number of people and records affected (where known), the likely consequences and the measures taken. As controller, the Customer is responsible for notifying the supervisory authority within 72 hours where required.
10. End of the agreement
For 30 days after the agreement ends, the Customer can ask for an export of its data. When the Customer asks for deletion, the account and its data (including files) are deleted within 30 days; copies in database backups are deleted automatically through the 14-day backup cycle. Legal retention obligations remain unaffected. On request, Revo Chat confirms the deletion in writing.
11. Audits
On request, Revo Chat provides the information needed to demonstrate compliance with this DPA. On-site audits may take place once a year, with at least 30 days’ notice and at the Customer’s expense.
12. Customer obligations
- Inform its own visitors about the processing (including pointing the privacy link in the chat bubble to its own privacy notice).
- Obtain cookie and tracking consent where required.
- Follow the rules of the channels it connects (Meta, Telegram and others).
- Not collect special categories of personal data (such as health data) through the service, or, if it does, ensure it has a valid legal basis.
13. Liability and precedence
The liability provisions of the Terms of Service also apply to this DPA, subject to mandatory law. If this DPA and the Terms of Service conflict on the processing of personal data, this DPA prevails.
Annex 1 · Security measures
- All connections to the Revo Chat website, dashboard and chat bubble are encrypted (HTTPS/TLS). Using encrypted (https) addresses for webhooks it sets up is the Customer’s responsibility.
- Access keys and secrets are encrypted in the database with AES-256-GCM; passwords are stored only as bcrypt hashes.
- Each business’s data is kept separate from others; team and role permissions, with an option to restrict agents to their team.
- Two-step verification, sign-in rate limiting and dashboard audit logs.
- Masking of card numbers in visitor messages (on by default).
- Daily database backups (kept for 14 days).
- Automatic deletion of conversations, with their files, once the retention period ends.
Annex 2 · Sub-processors
- Vultr (US company; servers in Frankfurt, Germany) — hosting; all service data
- Cloudflare (US, global network) — network security and speed; website traffic; cookieless page measurement on the hosted chat page (Cloudflare Web Analytics)
- Anthropic (Claude), OpenAI (US) — AI replies, suggestions, summaries and voice transcription; conversation content and knowledge base
- Resend (US) — notification emails; email address and message content
- Web push services (Google, Apple, Mozilla, Microsoft; US) — instant notifications to agents
- Meta (US/Ireland) and Telegram — message delivery, only on channels the Customer connects
- Destinations set by the Customer (Slack, Telegram notifications, webhooks) — new conversation and message details, on the Customer’s instructions