GDPR and live chat: what your team decides, and what GreetDock does.

On your website, you are the controller. MB Helmar, the company behind GreetDock, is your processor.

If you are an agency running the widget on a client's site, your client is usually the controller, you are its processor, and MB Helmar is a sub-processor.

One record is ours, not yours. When a visitor accepts a chat, a call or co-browsing, MB Helmar logs that accept event as its own controller record.

That log relies on legitimate interest and is kept for 3 years from each event. You see the consent status, not the log itself.

The DPA lists what your notice must say about GreetDock. The next items are the ones teams most often leave out.

From page load, GreetDock holds a short-lived server-side session for every visitor on a page with the widget: presence, current page and session metadata. It ends with the visit.

When a chat starts, its ticket holds session context, including an approximate location (city and country) from the IP address. The raw IP address is stored on the ticket too.

Your team can add profile details and internal notes to a visitor's ticket, and your notice must say how visitors can access them.

MB Helmar provides a model-wording annex: a privacy-notice paragraph, a consent-banner line and guidance on loading the widget conditionally. It is a template, not legal advice, and is available at onboarding or from [email protected].

The DPA is published at /legal/dpa and forms part of our agreement with you.

MB Helmar processes Customer Data only on your documented instructions.

We do not use your data for our own purposes, sell it, or use it to train any model.

You give a general authorisation for sub-processors. The current Subprocessor Register is available on request at [email protected] and is not published at a public URL.

We give at least 21 days' notice before adding or replacing a sub-processor, and you have 14 days to object. The exception is a replacement needed at once for security or service continuity: we notify you without undue delay, and you can still object to it.

Each sub-processor takes on, by contract, data protection obligations giving in substance the same level of protection as the DPA.

We notify you of a personal data breach without undue delay, aiming for 48 hours after we become aware.

Audits start with documents: the DPA, our security overview, the register, the hosting provider's attestations, and answers to a security questionnaire (at most once per 12 months).

Visitor tickets, conversations, recordings and workspace files are kept until you delete them or the workspace closes.

Call transcripts and AI summaries follow your retention and are deleted with the record they belong to.

The MCP request log is kept for 90 days. The AI provider may keep inputs for up to 30 days for abuse monitoring, and does not use them for training.

When the service ends, you choose return or deletion within 14 days, and it is completed no later than 30 days after the end.

The accept-event log, which MB Helmar controls, is kept for 3 years from each event, also after your workspace closes.

Recording is never automatic. A member of your team starts it, and the call screen always shows the state, with "Media is not recorded" when it is off.

The visitor sees a recording indicator and notice when recording starts.

The DPA says the indicator and notice "are notice, not consent". Where consent is required, you must get it before recording, or not record.

From 4 November 2026An "ask first" mode lets the widget ask the visitor before recording, offering "Agree" and "Don't record" with equal weight. Declining keeps the call going.

Transcripts and AI summaries are created only from calls your team records.

From 4 November 2026The AI drafts replies, and a person on your team reviews and sends every one. The AI never answers visitors on its own.