Chatbot Data Protection — What Businesses Need to Know

Chatbots collect personal data: names, email addresses, phone numbers, inquiries, IP addresses. As soon as such data is collected, processed, or shared, the General Data Protection Regulation (GDPR) applies.

This also applies to live chat tools and automated chat widgets on websites. Regardless of whether a human or an AI responds, the data processing is subject to the same requirements: legal basis, transparency, purpose limitation, data minimization, and technical safeguards.

Anyone operating a chatbot on their website should ensure that the provider hosts data in an EU-compliant manner, that a data processing agreement can be concluded, and that the consent request is technically feasible.

Zentor App is designed for EU-compliant data processing. The key data protection aspects at a glance:

• EU hosting: Conversation data is processed on servers within the European Union.
• Configurable consent: The chat widget can be set up so that users give consent to data processing before the chat starts.
• DPA available: A data processing agreement can be concluded on request.
• Conversation data in your own account: All conversations remain in your Zentor App account and are only visible to authorized team members.
• Role-based access rights: You determine which users have access to conversation data.

Please ask about technical details on hosting location, deletion periods, and DPA terms during your initial consultation.

Data protection starts with understanding which data actually flows where during a chat. In a website chatbot, a message typically passes through four stations — each with its own data protection significance:

1. 1. User's Browser: The chat widget loads on your website. Even at this stage, the configuration determines whether consent is requested before first contact and which technical data (e.g., IP address) is transmitted.
2. 2. Transmission to the Server: Messages are transmitted encrypted to the processing server. The hosting location determines whether processing stays within the EU or results in a third-country transfer.
3. 3. AI Processing: The response is generated by an AI model — either via a local AI model on your own infrastructure or via an external AI provider. With local execution, the conversation content never leaves your own environment; with external processing, the data processing must be contractually secured.
4. 4. Storage & Inbox: The conversation is stored in the account and is visible via the inbox to authorized team members. Access rights, retention periods, and the deletion policy apply here.

The GDPR requires that personal data not be stored longer than necessary for the purpose (storage limitation). For chatbot conversations, this means a tiered deletion policy in practice, rather than unlimited retention:

• Define purpose: What are conversations retained for — support follow-up, lead processing, quality assurance? The purpose determines the period.
• Define a retention period: A specific period (e.g., after the matter is resolved) should be technically implemented, not just organizationally defined.
• Automated deletion: Routines that regularly remove expired conversations reduce the risk of data being left "lying around" uncontrolled.
• Data subject rights: Requests for access and deletion must be actionable — individual conversations must be specifically findable and deletable.
• Documentation: The deletion policy belongs in the record of processing activities and should be coordinated with the data protection officer.

Please clarify specific deadlines and the technical implementation of deletion routines during your initial consultation and with your data protection officer.