Data Processing Agreement
Effective date: 28 October 2026. This DPA forms part of the Terms of Service between the customer ("Controller") and PM Digital, operator of SupportLime ("Processor"). It applies automatically; no signature is needed. A countersigned copy is available on request to hello@supportlime.com.
1. Scope and roles
The Controller embeds the SupportLime chat widget on its websites and uploads content for the assistant to answer from. In doing so the Processor processes personal data of the Controller's website visitors and team members on the Controller's behalf. The Controller is the controller of that data; the Processor is its processor. For the Controller's own account data, the Processor is an independent controller as described in the Privacy Policy.
2. Subject matter, duration, nature and purpose
- Data subjects: website visitors who use the widget; the Controller's team members; individuals mentioned in uploaded content.
- Categories: chat messages, email address and name when provided, page URL, referrer, browser language and user agent, IP address, a random visitor identifier; team member email and name; content the Controller uploads.
- Purpose: answering visitor questions, routing conversations to the Controller's team, creating tickets, sending notifications, analytics for the Controller.
- Duration: for the term of the service and until deletion under section 8.
3. Instructions
The Processor processes personal data only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's use of the dashboard and API. The Processor informs the Controller if it believes an instruction infringes data protection law.
4. Confidentiality
Persons authorised to process the data are bound by confidentiality. Staff access to Controller data is limited to what support requests require and is logged.
5. Security
The Processor implements the measures described on the Security page, including encryption in transit, encryption at rest by hosting providers, tenant isolation, hashed credentials, rate limiting and abuse protection, and spend limits on AI usage.
6. Sub-processors
The Controller authorises the sub-processors listed at /sub-processors. The Processor gives at least 14 days' notice of additions by updating that page and emailing account owners; the Controller may object on reasonable grounds and terminate if no resolution is found. Sub-processors are bound by data protection terms no less protective than this DPA.
7. Assistance
The Processor assists the Controller with data subject requests (visitor data can be exported and deleted from the dashboard and API), with security and breach obligations, and with data protection impact assessments where relevant to the service.
8. Deletion and return
The Controller can delete contacts, conversations, websites and knowledge at any time. On termination the Processor deletes all Controller data within 30 days, with backups expiring within a further 35 days, unless retention is required by law. Data can be exported through the API before termination.
9. Breach notification
The Processor notifies the Controller without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting Controller data, with the information available at that time.
10. Audits
The Processor makes available the information necessary to demonstrate compliance and allows audits by the Controller or an auditor mandated by it, at reasonable intervals and notice, at the Controller's cost, under confidentiality.
11. International transfers
Where data is transferred outside the EEA or UK (notably to AI model providers and Cloudflare in the United States), the transfer is covered by the EU Standard Contractual Clauses (module two) and the UK Addendum, incorporated by reference, together with the Data Privacy Framework where the recipient is certified.
12. Liability and precedence
Liability is governed by the Terms. Where this DPA conflicts with the Terms on data protection, this DPA prevails. The Standard Contractual Clauses prevail over both.