Data processing agreement

This agreement is part of the terms of service between the customer (the shop using helq, the "controller") and helq (the "processor"). It sets out how we process personal data on the customer's behalf under the Swiss FADP (art. 9) and, where applicable, the GDPR (art. 28).

1. Subject, duration, nature and purpose

We process personal data of the customer's website visitors and team members to provide the chat, inbox, ticket and team features of helq, for the duration of the customer's subscription and the 30-day period after it ends.

2. Data and data subjects

• Website visitors of the customer: name and email address if given, chat messages, ticket emails, page visited, language, time, ratings, an anonymous visitor token.
• Team members of the customer: name, email, role, presence, the messages and notes they write.
• Mailbox credentials the customer provides for tickets (stored encrypted).

3. Instructions

We process the data only to provide the service as configured by the customer in the app, and on the customer's documented instructions. We tell the customer if we believe an instruction breaks the law. We do not use the data for our own purposes and do not sell it.

4. Confidentiality

People who have access to the data are bound to confidentiality and have access only to the extent their work requires.

5. Security measures

• Encryption in transit (TLS) for the website, the app, the widget and connections to the customer's mailbox.
• Passwords stored as salted hashes; mailbox credentials encrypted at rest with a key held outside the database.
• Logical separation of each customer's data (tenant isolation enforced in the application).
• Role-based access within the customer's team; two-factor authentication and least privilege for our own operators.
• Daily encrypted backups with tested restores; security updates applied promptly; rate limits and bot protection on public endpoints.

6. Sub-processors

The customer authorises the sub-processors listed in section 6 of the privacy policy (hosting, payments, email delivery, error reporting). We inform customers by email at least 30 days before adding or replacing a sub-processor; a customer who objects on reasonable data protection grounds may terminate the contract before the change takes effect.

7. Assistance

We help the customer answer requests from data subjects (access, correction, deletion, export) with the tools in the app and, where needed, directly. We inform the customer without undue delay, and at the latest within 48 hours, of a personal data breach affecting its data, with the information needed to meet its own notification duties.

8. Deletion and return

During the contract the customer can export and delete its visitors' data in the app. After the contract ends the customer has 30 days to export; we then delete the data, except where the law requires us to keep it.

9. Audits

On request, at most once a year unless a breach occurred, we provide the information needed to demonstrate compliance with this agreement and allow audits by the customer or an independent auditor bound to confidentiality, at the customer's expense and with reasonable notice.

10. International transfers

Data may be processed by sub-processors outside Switzerland and the EU/EEA. We rely on an adequacy decision, the Data Privacy Framework where the provider is certified, or standard contractual clauses recognised by the FDPIC and the European Commission.

11. Liability and term

Liability follows section 9 of the terms of service. This agreement applies as long as we process data on the customer's behalf.

helq, [email protected].