In short
- Your visitors’ conversations are yours: you are the controller, IoAlly processes them on your behalf.
- We use them only to run your assistant.
- If there is a security incident we tell you within 48 hours.
- When you close your account we delete them within 30 days.
The summary helps you find your way; the full text below is what applies.
Introduction
This agreement under art. 28 of Regulation (EU) 2016/679 (GDPR) is part of the Terms of service and is accepted when signing up.
3.1 Parties and roles
The customer using IoAlly is the controller of the data of the visitors who write to their assistant. Valerio Tocci, sole proprietorship, Italian VAT number 18201181007, Via Camillo Serafini 15, 00164 Rome, Italy, provider of IoAlly, is the processor and processes that data only on the customer’s behalf.
3.2 Subject matter of the processing
| Item | Content |
|---|---|
| Data subjects | Visitors to the customer’s website and people using their link or QR code |
| Data | Conversation messages, language, channel (website, link, QR), name, phone, email and any other information the visitor chooses to write |
| Purposes | Answering visitors’ questions, collecting requests and contact details, forwarding them to the customer, showing them statistics |
| Duration | For the whole term of the contract; each conversation is deleted automatically 12 months after its last message, and each unanswered question 12 months after it was last asked |
The assistant is not designed for special categories of data (health, beliefs, criminal records): the customer undertakes not to ask for them through the assistant.
3.3 Processor’s obligations
IoAlly undertakes to:
- process the data only on the customer’s instructions, which are those given by configuring the assistant and by this agreement
- ensure that anyone accessing the data is bound by confidentiality
- take appropriate security measures: encrypted connections, restricted and protected database access, one-time sign-in codes, encrypted backups, no storage of card data
- not use the data for its own purposes or to train artificial intelligence models, and use AI providers with zero retention of the texts
- help the customer answer requests from visitors exercising their rights
- notify the customer without undue delay, and in any case within 48 hours of becoming aware of it, of a personal data breach
- at the end of the contract, delete the data within 30 days (it leaves the encrypted backups automatically within 30 more days), unless the law requires otherwise
- make available the information needed to demonstrate compliance with this agreement
3.4 Sub-processors
The customer authorises IoAlly to use the providers listed in section 2.3 of the privacy notice, bound by equivalent data protection obligations. IoAlly will notify customers by email at least 30 days before adding or replacing a provider that processes visitors’ data; the customer may object by cancelling before the change.
3.5 Transfers outside the EU
Transfers to providers in the United States rely on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.
3.6 Customer’s obligations
The customer informs their visitors of the processing, including by naming IoAlly as a provider in their own privacy notice, and makes sure they have a legal basis for collecting their contact details.
3.7 Access to the customer’s website for installation
If the customer invites IoAlly as a collaborator to install the assistant, the website’s admin panel may contain personal data (for example users, orders or messages). IoAlly accesses only the parts needed to install the assistant, does not copy or change that data, processes it as processor on the customer’s behalf, and stops accessing the website once the installation is complete.
A question about this document?
A real person answers, within two working days.