Chatwize – Privacy Policy Services

Welcome to Chatwize! We are pleased that you are using our AI Chatbot Services (“Services”). Data protection and data security when using our Services are very important to us. We would therefore like to inform you which of your personal data we collect and for what purposes it is used.

BACKGROUND

This Privacy Policy describes our privacy practices in plain language, keeping legal and technical jargon to a minimum, to make sure you understand the information provided. However, to achieve this objective we would like to explain to you the following concepts.

a) What is Personal Data?
Personal Data includes any information relating to an individual who can be identified or who is identifiable, either directly from the information in question or indirectly when combined with other data.

b) What is Processing?
"Processing" means and covers virtually any handling of data.

WHAT LAW APPLIES?

We will only use your Personal Data in accordance with the applicable data protection laws, in particular the Dutch GDPR Implementation Act (Uitvoeringswet Algemene Verordening gegevensbescherming, “UAVG”) and the EU's General Data Protection Regulation (“GDPR”).

WHO IS RESPONSIBLE?

The person responsible is Chatwize (KVK: 90238257) of 's-Hertogenbosch, Netherlands (“Chatwize”, “we”, “us”, or “our”). Please direct any questions you may have to hello@chatwize.ai or use our Contact Form.

DATA COLLECTION

All Personal Data that we obtain from you will only be processed for the purposes described in more detail below. In particular, we collect Personal Data only if:
● you have given your consent;
● the data is necessary for the fulfillment of a contract or pre-contractual measures;
● the data is necessary for the fulfillment of a legal obligation; or
● the data is necessary to protect the legitimate interests of our company and business.

DATA RETENTION

We process and store your Personal Data only for the period of time required to achieve the respective processing purpose or for as long as a legal retention period exists (for example, commercial and tax laws require retention for up to 8 years). Once the purpose has been achieved or the retention period has expired, the corresponding data is routinely deleted.

DATA WE COLLECT

a) Contacting Us
We offer you the opportunity to contact us using various methods. We collect the data you submit—such as your name, email address, telephone number, and your message—in order to process your enquiry and respond to you. The legal basis is both your consent and the contractual necessity.

b) Contracting with Us
The protection of your data is particularly important to us in the performance of our contractual services. We therefore process only as much Personal Data (e.g. your name, address, email address, or telephone number) as is absolutely necessary. Nevertheless, we rely on the processing of certain Personal Data to fulfill our contractual obligations to you or to carry out pre-contractual measures.

a) Our AI Chatbot Services
As mentioned above, we process the Personal Data involved in your use of our AI Chatbot Services (“Service Data”) to provide our services. We recognize that you own your Service Data and provide you with complete control over it by enabling you to:
 (i) access your Service Data;
 (ii) share your Service Data through supported third-party integrations; and
 (iii) request export or deletion of your Service Data.
Where we process Service Data as a Data Processor—that is, on your behalf—we do so in accordance with your instructions and only for the purposes agreed between you and us. We ensure that access by our employees to your data is limited to those on a need-to-know basis, that such access is restricted to specific individuals, and that all access is logged and audited. We communicate our privacy and security guidelines to our employees and strictly enforce protective measures. For the purpose of providing our Services, all Service Data processed by us will be handled using GPT-trainer (Paladin Max, Inc) and OpenAI OpCo, LLC. We take appropriate legal precautions and implement corresponding technical and organizational measures to ensure the protection of your Service Data. For further information, please also refer to our Data Processing Addendum.

b) Our Web Scraping Tool
Similarly, when you use our web scraping tool, we process the Personal Data involved (“Service Data”) to provide our services. We recognize that you own your Service Data and give you complete control over it by enabling you to:
 (i) access your Service Data;
 (ii) share your Service Data through supported third-party integrations; and
 (iii) request export or deletion of your Service Data.
When processing Service Data on your behalf as a Data Processor, we follow your instructions and use the data only for the purposes agreed between you and us. Employee access to your data is restricted on a need-to-know basis, logged, and audited, with strict enforcement of privacy and protection safeguards. Further details are available in our Data Processing Addendum.

c) Your End Users
When you design, integrate, and configure your use of our Services (see a) and b) above), we may also process Personal Data of your end users. The data processed by us depends on how you use our Services and the requests you or your end users submit. You have full control over how our Services are used, for example by configuring options and settings. The Personal Data provided by your end users will depend on your configuration and may require integration via an inline frame element (iframe) and the processing of your end users’ IP addresses and other Personal Data. This data is processed to respond to your end users' requests using the Services. Furthermore, if you provide us with Personal Data relating to a third party, you confirm that you have obtained all necessary consents and that such third party has read this Privacy Policy. You agree to indemnify us for any liabilities, penalties, fines, awards, or costs arising from your non-compliance with these requirements. The legal basis for this processing is the provision of a contractual service. In accordance with the UAVG and GDPR, we act as the Data Processor. Some jurisdictions may require you to disclose your use of our Services and Chatwize as your processor in your privacy policy and/or data processing agreement.

c) Support Ticket
If you create a support ticket, we will request Personal Data and, where applicable, non-Personal Data in accordance with your request; this may include your name, email address, and other order-related data you voluntarily provide. The data provided is not shared with third parties and is not accessed by anyone else. We process this data solely for handling your support ticket. Our employees, who assist with technical support or data import into our Services, will have access to the data you provide under strict privacy and security guidelines. The legal basis for this processing is our contractual obligation and our legitimate interest in processing your support ticket.

d) Administration
We process data in the context of administrative tasks, business organization, and compliance with legal obligations (such as archiving). In this regard, we process the same data as we do when providing our contractual services. The processing is based on our legal obligations and our legitimate interest.

e) Artificial Intelligence Act Compliance
In accordance with the upcoming Artificial Intelligence Act ("EU AI Act"), we have taken the following steps:
 (i) assessed the risks associated with our AI Chatbot (classified as limited risk);
 (ii) raised awareness by clearly describing this policy and our use of AI Tools on our website;
 (iii) designed our AI Chatbot based on ethical principles;
 (iv) assigned responsibility for the Chatwize AI Chatbot to our CEO;
 (v) committed to continuous development and updates of the Chatwize AI Chatbot; and
 (vi) established formal governance.

DATA SHARING

In certain cases, it is necessary to transmit the processed Personal Data during data processing. Different recipient bodies and categories of recipients apply:

a) Internal
If necessary, we transfer your Personal Data within Chatwize. We comply with the UAVG and GDPR and ensure that your data is processed properly. Access to your Personal Data is granted only to authorized employees who require access to perform their tasks (e.g., providing our Services or contacting you in case of queries). For further

‍