GDPR Compliance.

The GDPR applies to Aiva Chat in two distinct scenarios:

• You're a customer in the EU/EEA — we act as a processor for the personal data you push through Aiva Chat.
• Your customers are in the EU/EEA, even if you're based elsewhere — we still process EU residents' data on your behalf and apply GDPR-grade controls.

In both cases, you remain the data controller. Aiva Chat is the processor. The relationship is governed by our Data Processing Addendum.

If you're a UK customer, the same controls apply — we honor the UK GDPR and offer the UK International Data Transfer Addendum (IDTA) on request.

The GDPR requires a lawful basis for every processing activity. Here's how Aiva Chat's processing maps:

We never rely on legitimate interest for AI training. Customer conversation data is never used to train or fine-tune models.

Under GDPR Articles 15–22, every EU resident has the following rights. We honor them within 30 days:

• Article 15 — Right of access: request a copy of all data we hold about you.
• Article 16 — Right to rectification: ask us to correct inaccurate data.
• Article 17 — Right to erasure: request that we delete your data (“right to be forgotten”).
• Article 18 — Right to restrict processing: ask us to stop processing certain data while a dispute is resolved.
• Article 20 — Right to portability: get your data in a machine-readable format (JSON or CSV).
• Article 21 — Right to object: object to processing based on legitimate interest.
• Article 22 — Rights re: automated decisions: not be subject to a decision based solely on automated processing — including Aiva Chat's responses, where they have legal or similar effects.

To exercise any of these rights, email support@aivachat.io. If you're an end customer of one of our customers (e.g., you called a business whose phone line is answered by Aiva Chat), please contact that company first — they're the data controller.

Aiva Chat stores all customer data on Amazon Web Services in the United States (US East, N. Virginia). We don't offer an EU region today. Specifically:

• Transcripts, recordings, assistant configurations and metadata are stored in AWS us-east-1.
• Calls and texts run through your own Twilio account, and AI processing through your own OpenAI account. Where those providers process data is set by your accounts with them.
• Our team in Rajkot, India may access data to provide support.

Because EU personal data is transferred outside the EU/EEA, those transfers rely on the Standard Contractual Clauses described in Section 5.

For any cross-border transfer of EU personal data, we use the Standard Contractual Clauses (SCCs) approved by the European Commission in 2021 (Module 2 — Controller to Processor).

The SCCs are incorporated into our DPA, which applies to all customers. They cover:

• Storage of EU personal data on AWS in the United States.
• Access by our team in India for support and operations.
• Any future transfer that may become necessary.

UK customers: we offer the UK International Data Transfer Addendum (IDTA) with identical terms. Email support@aivachat.io to receive it.

This is the section EU regulators ask about most. We're explicit about it:

Specifically:

• You control the OpenAI account, and can review its data controls and retention settings directly with OpenAI.
• We don't train or fine-tune any model on your data.
• We don't use customer data for benchmarking, A/B testing, or competitive analysis.

For full technical details, see our Security overview.

If your Aiva Chat deployment requires a Data Protection Impact Assessment (DPIA) under GDPR Article 35 — likely for healthcare, finance, or large-scale processing — we provide:

• A written description of Aiva Chat's processing: what data it handles, where it's stored, and which sub-processors are involved.
• A technical questionnaire covering encryption, access controls, sub-processor risks.
• Answers to follow-up questions from your privacy team.

Request the package at support@aivachat.io — usually returned within 5 business days.

Under GDPR Article 33, we notify you of any personal data breach within 72 hours of discovery.

Notifications include the nature of the breach, categories and approximate count of affected data subjects, likely consequences, and the measures we're taking.

For your end customers: if a breach affects EU residents whose data you control, we help you draft Article 34 notifications. You're the controller — but we know the technical details.

All data protection questions and requests, from the EU, UK or anywhere else, go to support@aivachat.io.

A real person reads every message. No tickets, no chatbots.

For any GDPR question, email support@aivachat.io — we reply within four hours during business hours, and within 30 days for formal data subject requests.

You also have the right to lodge a complaint with your local supervisory authority (Datenschutzkommission, CNIL, ICO, etc.). We'd appreciate the chance to address it first, but we won't stand in your way.