Last updated: October 15, 2026
This Data Processing Agreement ("DPA") forms part of the Chatity Terms of Service between MINDUNITE SAS, SIREN 990 299 414, 7 Avenue de Fabron, 06200 Nice, France ("Processor", "Chatity") and the business that creates a Chatity account ("Controller", "Customer"). It is accepted when the Customer registers for Chatity or continues to use the service after this DPA is published.
It applies to all personal data of the Customer's end customers (clients) that Chatity processes on the Customer's behalf, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR").
Subject matter: operation of the Chatity platform — AI-assisted customer communications (website chat, WhatsApp, Instagram, telephone), online booking and calendar, client records (CRM), reminders and, where enabled by the Customer, marketing communications.
Duration: for as long as the Customer holds a Chatity account, plus the period needed to delete or return the data under section 10.
Data subjects: the Customer's clients and prospects; the Customer's staff members.
Personal data: name; phone number; email; messaging identifiers (WhatsApp / Instagram IDs); content of conversations and voice calls; appointment date, time, service, staff member, status and price; visit history; preferences and comments entered by the Customer; marketing preferences and consent evidence.
Special categories: the standard service is not intended for health or other special-category data (section 7).
Chatity processes personal data only on the documented instructions of the Customer, which consist of the Terms of Service, this DPA and the settings configured by the Customer in the dashboard (channels connected, AI knowledge base, retention period, marketing on/off). Chatity will inform the Customer if, in its opinion, an instruction infringes data-protection law.
The Customer is responsible for the lawfulness of the data it collects, for informing its clients (a privacy notice naming the Customer is displayed on Chatity mini-sites and widgets) and for the legal basis of any marketing communication.
Chatity ensures that persons authorised to process personal data are bound by confidentiality obligations. Access to production data is limited to personnel who need it for operating and supporting the service.
The Customer shall not instruct Chatity to collect health data (diagnoses, medications, pregnancy, allergies, contraindications, medical photos) through the standard chat and booking workflow. Chatity's AI is instructed not to request or record such data and to escalate medical questions to the Customer. A dedicated health-data workflow may be offered separately subject to additional safeguards.
Chatity implements appropriate technical and organisational measures, including: encryption in transit (TLS); hashed passwords; role-based access and authentication; brute-force protection; separation of tenant data by account identifier; logging of administrative actions; backups; secure development practices; prompt remediation of vulnerabilities.
The Customer gives general authorisation to Chatity to engage the subprocessors listed at https://chatity.io/subprocessors. Chatity will update that list at least 15 days before adding or replacing a subprocessor; the Customer may object on reasonable data-protection grounds by email, in which case the parties will seek a solution and the Customer may terminate the affected service. Chatity imposes data-protection obligations on its subprocessors by written contract and remains liable for their performance.
During the term, the Customer can export booking data and delete individual clients or its entire account from the dashboard. Upon termination of the account, Chatity deletes all personal data processed on behalf of the Customer, disconnects integrations and invalidates tokens, except where retention is required by law (e.g. invoices, which are anonymised). Automatic retention rules configured by the Customer are executed by Chatity.
Taking into account the nature of the processing, Chatity assists the Customer with appropriate technical measures (export, correction, deletion tools, marketing opt-out handling including the STOP keyword) to respond to requests from data subjects. Requests received directly by Chatity concerning the Customer's clients are forwarded to the Customer without undue delay.
Chatity notifies the Customer without undue delay after becoming aware of a personal-data breach affecting the Customer's data, providing the information reasonably available to help the Customer meet its own notification obligations.
Chatity makes available the information necessary to demonstrate compliance with this DPA and allows for audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, no more than once per year on 30 days' written notice, during business hours and without disrupting operations. Chatity may first provide existing documentation and certifications to satisfy the request.
Personal data is hosted in the EU/EEA where available. Where a subprocessor processes data outside the EEA (see the Subprocessors page for region and mechanism), Chatity relies on an adequacy decision, the EU Standard Contractual Clauses or another valid transfer mechanism and implements supplementary measures where necessary.
Liability is governed by the Terms of Service. This DPA remains in force for as long as Chatity processes personal data on behalf of the Customer. In case of conflict, this DPA prevails over the Terms of Service with regard to the processing of personal data.
MINDUNITE SAS — privacy@chatity.io — 7 Avenue de Fabron, 06200 Nice, France.