If you use live chat, you handle personal data: names, email addresses, IP addresses and whatever people type. This guide gives you a practical starting point. It is general information rather than legal advice, so get advice if you have specific concerns.
Know your role
For chats with your visitors, you are generally the controller, as you decide why the data is used. Orbis Digital Ltd acts as your processor, under our Data Processing Agreement. Read the Data Processing Agreement.
Tell your visitors
Your privacy notice should explain that you use live chat, what you collect, why, and how long you keep it. Name your chat provider among your suppliers.
Check your cookie and storage notice
The widget stores information in the visitor's browser so that a chat can continue between pages and visits. Consider how this fits your own cookie information, under PECR. See our Cookie Policy.
Collect only what you need
- Only ask for an email in the pre-chat form if you will use it.
- Discourage people from sharing sensitive details in chat.
- Train your team not to ask for things such as full card numbers.
Decide how long to keep it
Do not keep chats forever by default. Decide what is reasonable for your business, then use the data retention settings to match.
Be ready for requests
People can ask for a copy of their data, or ask you to delete it. The GDPR export and delete tools make this easier. You normally have one month to respond.
Limit access
- Give people the lowest role they need: owner, admin or agent.
- Turn on two-factor login (TOTP).
- Remove access when someone leaves.
- Use the audit log to look back when needed.
Think about AI features
If you use AI features, content is sent to an AI provider to generate a result. Include this in your privacy information, and avoid using AI for decisions that significantly affect people. Read about security and GDPR at Orbis Chat.
Frequently asked questions
Where is Orbis Chat hosted?
On a server in Europe, with nightly encrypted backups.
Do I need consent to use live chat?
It depends on what you do and how the data is used. Consider your lawful basis and your cookie obligations, and get advice if you are unsure.
