Who is who in the chain
When you build and run a chatbot on a client's website, at least three parties handle the visitors' conversations. The GDPR gives each a role by what it actually decides, not by what the contract calls it.
| Party | Role under the GDPR | Why | Paper it needs |
|---|---|---|---|
| Your client, whose site the chatbot is on | Controller (Art. 4(7)) | Decides why visitors' messages are processed, and the essential means: which data, how long, who sees them | A privacy notice for visitors (Art. 13) and an agreement with you (Art. 28(3)) |
| Your agency | Processor (Art. 4(8)) | Runs the chatbot for the client, only on its documented instructions (Art. 28(3)(a), Art. 29) | That agreement, a matching one with the platform (Art. 28(4)), and a record of the processing (Art. 30(2)) |
| The chatbot platform | Sub-processor, "another processor" in Art. 28(2) and (4) | Stores and processes the conversations for you, for your client | An agreement with you that carries the same obligations, and your client's authorisation |
| The platform's providers: hosting, database, language models, e-mail | Further sub-processors | Each does one step for the platform | The platform's own agreements, and a line on the list your client gets |
The European Data Protection Board (EDPB) puts the rule in one sentence: "The whole chain of processing activities needs to be regulated by written agreements" (Guidelines 07/2020, para. 160). Our GDPR page shows where ChatterLab sits in that chain.
When an agency stops being a processor. A party that pursues no purpose of its own "but is merely being paid for services rendered" is a processor, not a joint controller (para. 62). Add a purpose and Art. 28(10) makes you the controller of that processing; the EDPB's own example is a marketing agency that uses a client's customer database to grow its own business (para. 81). In chatbot work that means, for example, using visitors' leads for your own sales, or pooling clients' conversations to benchmark them or to improve another client's chatbot. Decide the purposes and the essential means together with the client and you may be joint controllers (Art. 26), with an arrangement whose essence visitors can see and rights they can exercise against either of you. The simpler course is to stay a processor and write each decision down as the client's instruction.
Which decisions are the client's. The EDPB calls them essential means: the type of data, how long it is kept, who has access and whose data it is (para. 40). For a chatbot that is what the contact form asks for, how long conversations are kept, who may read them, and whether visitors may send files. Record the client's choice on each rather than making it yourself.
Two agreements that have to match
You sign one agreement with your client (Art. 28(3)) and one with the platform (Art. 28(4)). The second must carry the same data protection obligations as the first, judged by substance rather than wording (EDPB para. 160). So write the client agreement around what the platform actually gives you: you cannot promise more than you receive. Our data processing agreement checklist covers the platform's side.
| Topic | Your promise to the client | What the platform must give you first |
|---|---|---|
| Sub-processors | Authorisation for a named list (Art. 28(2)); the Commission's Q&A on its standard clauses says names, not just categories | Its list, with each provider's task and location (EDPB para. 152) |
| Changes to the list | Written notice a set number of days ahead, and a right to object | A longer notice period, sent to you. A list that is updated "from time to time" is not notice (EDPB para. 128, footnote 54) |
| Transfers | Nothing outside the EEA without instructions and a basis under Chapter V (Art. 28(3)(a)) | Which steps leave the EEA, and on what basis (the questions to ask) |
| Breaches | Notice within a set number of hours, which the EDPB says it may be appropriate to fix in the contract (para. 136) | A shorter period than yours |
| Visitors' requests | Prompt forwarding, and no answer without the client (clause 8(a) of the standard clauses) | A way to find, export and delete one visitor's data |
| End of the service | Return or deletion at the client's choice, confirmed (Art. 28(3)(g); EDPB para. 141) | Full export and deletion for that client |
| Audits | Information to show compliance, and audits (Art. 28(3)(h)) | Its agreement, sub-processor list and security description, to pass on |
The timings, worked through. Say the platform promises breach notice within 24 hours and sub-processor notice 30 days ahead. You can then promise your client breach notice within 36 hours, which leaves you 12 hours to check and forward. Forward a sub-processor notice within five days with 14 days for your client to object, and you still have 11 days to object to the platform, or to plan a move, if your client says no. These numbers are an illustration, not legal limits: the GDPR only says a processor notifies "without undue delay" (Art. 33(2)), and the Commission's Q&A leaves the period to the parties. What matters is the order. Your client keeps its own deadline towards the supervisory authority: 72 hours from becoming aware, where feasible (Art. 33(1)).
Ten clauses for your client agreement
Put these in an annex to your service agreement, next to the scope and the fee (see how to price chatbot services). The wording is a starting point to adapt with your own adviser, not a finished contract. The Commission's standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915) are another base, and the EDPB adds that an individual contract is just as valid (para. 106).
| # | Clause | Why | Example to adapt |
|---|---|---|---|
| 1 | Scope | Required content of Art. 28(3) | "The Agency runs an AI chat assistant on www.example.com that answers visitors from content the Client approves, and reviews the conversations to improve the answers. Data: chat messages, the page each question was asked on, and the files and contact details visitors choose to send. Data subjects: website visitors." |
| 2 | Instructions | Art. 28(3)(a); e-mail counts (EDPB para. 118); an instruction that infringes data protection law is flagged (Art. 28(3)) | "The Agency acts only on the Client's documented instructions: this agreement, the settings in Annex 2 and later instructions by e-mail. It tells the Client at once if it considers an instruction unlawful." |
| 3 | No own use | Own purposes make you a controller (Art. 28(10)) | "The Agency does not use Client personal data for its own purposes or for other clients, including to improve other chatbots." |
| 4 | Access | Art. 28(3)(b); who has access is the client's call (EDPB para. 40) | "Only the staff named in Annex 3 can read conversations, and each of them is bound to confidentiality." |
| 5 | Security | Art. 28(3)(c) and Art. 32 | "The Agency applies the measures in Annex 4, its platform's included, and reviews them every year." |
| 6 | Sub-processors | Art. 28(2) and (4); transfers on instructions only | "The Client authorises the sub-processors in Annex 5, which gives each one's task, location and, outside the EEA, transfer safeguard. The Agency gives 21 days' written notice of any change. The Client may object within 14 days; failing agreement, either party may end the service for that chatbot." |
| 7 | Requests | Art. 28(3)(e); the client's month (Art. 12(3)) does not stretch while it waits (EDPB para. 132) | "The Agency forwards a visitor's request to the Client within two working days, does not answer it unless asked, and on instruction finds, exports or deletes the data within five working days." |
| 8 | Breaches | Art. 33(2) and Art. 28(3)(f) | "The Agency notifies the Client of a personal data breach affecting Client data without undue delay and within 36 hours of becoming aware of it, with the Article 33(3) information as far as it is available." |
| 9 | Retention and exit | Art. 28(3)(g) | "Conversations are deleted 12 months after their last message unless the Client instructs otherwise. At the end of the service, the Agency exports them if asked, deletes the chatbot and its data within 30 days and confirms the date in writing." |
| 10 | Information and audits | Art. 28(3)(h) | "The Agency provides the information needed to demonstrate compliance, including its platform's data processing terms and sub-processor list, and allows audits on 30 days' notice." |
White label hides the platform from visitors, not from the law
White label decides what a visitor sees: your brand or your client's, on your own domain. It changes nothing in the roles. Your client must still authorise the platform (Art. 28(2)), so its name belongs in your agreement. Processors count as recipients (Art. 4(9); EDPB para. 92), so your client's privacy notice names the recipients or at least their categories (Art. 13(1)(e)). And a visitor who asks where their data went is entitled to the names: in Österreichische Post (C-154/21, 12 January 2023) the Court of Justice held that the right of access means giving the actual identity of the recipients, unless they cannot be identified or the request is manifestly unfounded or excessive. Keep the sub-processor list ready to hand over, and take the notice wording from our chatbot privacy notice template.
Day to day: requests, breaches, access and exit
The agreements only work if somebody does what they say. Here is the routine, with the steps in ChatterLab where platforms differ.
A visitor asks for their data, or to be forgotten. If the request reaches you, forward it to the client the same day and do not answer it yourself. Once the client decides, find the conversation in Activity (the visitor can say roughly when) and read it there, or fetch that one conversation over the API. Export PDF takes every conversation in the chosen period, so do not hand that file to the visitor as it is. Delete erases the conversation with the lead left in it, and cannot be undone. A single file goes with Delete file; contact details and tickets have their own Delete on the Leads and Tickets pages. ChatterLab does not answer requests in your place (Data and privacy). The client has one month (Art. 12(3)), and waiting for you does not extend it.
A breach. Tell the client within the agreed hours, even before you know everything: the standard clauses allow a first notice with what is known (clause 9.2). One incident is particular to agencies: a Client link sent to the wrong person while that dashboard shows conversations. The link opens without a password, so press New link, which stops the old one working, and give the client the facts to decide whether to notify its authority.
Your team. On Agency, 5 people sign in to the workspace, you included, each with their own account. Every role (owner, admin and member) can read conversations, contact details and tickets; only the owner and admins can delete or export conversations. So access is decided by whom you invite: the people named in clause 4. The audit log records who made each change.
The client's view. Each client gets a private, read-only Client link without an account, showing their agent and nothing of your other clients or fees. Show the conversations decides per client whether it includes what visitors wrote; switched off, it shows figures and a chart only. Record the client's choice: where visitors may share personal matters that the client's team has no need to read, figures alone are the safer choice. One catch: an API key with read access tied to that agent reads the conversations whatever the switch says, so give a client a key that may only chat (Reports and the client's dashboard).
Collect less, and keep it for less. The widget asks for no name or e-mail address unless the contact form or tickets are switched on, and it stores no IP addresses. If visitors might share health or account details, say in the chat's Notice what not to share. When you turn a question into a source with Improve answer, leave the visitor's details out: a source is available to every visitor who asks the right question. ChatterLab deletes no conversation by itself, so a twelve-month clause means a deletion in your calendar or over the API. Leads go after 3 years, solved tickets after 2 years and visitors' files after 30 days.
A client leaves. Remove client only unlinks the agent; the agent, its sources and its conversations stay. Export the conversations as PDF and the leads as CSV if the client wants them, then delete the agent, which removes its conversations, uploaded files and leads, and confirm the date in writing.
The AI Act in two paragraphs
The AI Act requires chatbots to be designed so that people know they are talking to an AI (Art. 50(1)), from 2 August 2026 (Art. 113), and addresses that duty to the provider of the system. The Digital Omnibus on AI (Regulation (EU) 2026/1744) moved the high-risk rules to later dates but, as of 25 October 2026, left this duty and its date as they were. ChatterLab builds the notice in: every conversation opens with a line such as "You're chatting with an AI assistant" in the widget's language, no plan, add-on or setting removes it, it names no brand, answers are marked as AI-generated in the page's code, and the agent never claims to be human. White label leaves all of this in place; our AI Act page covers the rest of the rule.
Who the provider is in a white-label chain is less tidy. Art. 3(3) counts as a provider anyone who has an AI system developed and places it on the market or puts it into service under its own name or trademark, so an agency selling a chatbot under its own brand should check whether that describes it; the definition does not mention resellers. Our article on provider or deployer works through the cases. The three declared uses that ChatterLab treats as high-risk (recruitment, credit scoring and healthcare) are refused on every plan except Enterprise, where they are agreed one customer at a time.
What ChatterLab gives an agency, and what stays with you
| You need | What ChatterLab gives you | What stays with you |
|---|---|---|
| The chain in writing | Its documentation states it: your client is the controller, you are their processor, ChatterLab is yours. Its data processing agreement is sent on request: management@sri-group.eu | Your agreement with each client |
| A sub-processor list | Data and privacy names each provider that handles visitors' data, what it does and where, including the two steps in the United States: OpenAI turns text into search vectors and Resend sends e-mail | Putting it in Annex 5 and passing on changes |
| Separation between clients | One agent per client. Agents share nothing but your credits, an answer is written from that agent's sources alone, and no models are trained on your content or conversations | Not copying one client's material into another client's agent |
| Your team | On Agency, 5 people with their own accounts and roles; changes are logged with who made them and kept 2 years | Inviting only the people your agreement names |
| Client reporting | On Clients: usage per client, a monthly report in English, Dutch, French, German or Spanish, and a read-only dashboard with or without the conversations | Recording the client's choice and keeping the link private |
| Your brand | From Studio, the widget and API on your own domain; on Agency, the reports and dashboards too, and report e-mails from your own address once it is verified. The AI notice stays | Telling your client which platform runs underneath |
ChatterLab does not answer visitors' requests in your place, delete conversations on a schedule, or give your clients a login to your workspace: they get the link. Its documentation does not say how soon it reports a breach to you or how far ahead it announces a new sub-processor, so ask for both when you request its data processing agreement, and set your own periods towards your client after that. What each plan includes is on the white label page.
Questions agencies ask about GDPR roles
Do I need a data processing agreement with my client?
Yes. When you run the chatbot on the client's behalf, Article 28(3) GDPR requires a contract or other legal act that binds you to the client and sets out the subject, duration, nature and purpose of the processing, the types of data and the data subjects, and the obligations in points (a) to (h). It must be in writing, which includes electronic form (Art. 28(9)). You can base it on the Commission's standard clauses or write your own.
Can I use a chatbot platform without telling my client?
No. Article 28(2) GDPR bars a processor from engaging another processor without the controller's prior specific or general written authorisation, and under a general authorisation you must tell the client about every intended addition or replacement so it can object. The Commission's Q&A on its standard clauses adds that, under those clauses, the client gets names, not just categories. White label can keep the platform's name from visitors, not from your client.
Who is liable if the platform has a data breach?
Towards your client, you remain fully liable for the platform's performance of its data protection obligations (Art. 28(4) GDPR). Towards a visitor who suffers damage, the client as controller is liable for processing that infringes the GDPR, and a processor only where it broke duties aimed at processors or acted outside or against lawful instructions (Art. 82(2)). Where several are responsible, each can be held liable for the entire damage and then claim back the others' share (Art. 82(4) and (5)).
Can I use one client's conversations to improve other chatbots?
Not as that client's processor. Using its conversations for another client, for benchmarks or for your own marketing is a purpose of your own, and Article 28(10) GDPR then treats you as the controller of that processing, with its own legal basis and its own duty to inform visitors. The EDPB gives a marketing agency as its example (Guidelines 07/2020, para. 81). In ChatterLab, each agent answers only from its own sources.
Do I need to register anywhere as an agency?
Not under the GDPR, which abolished the general duty to notify processing to the authorities (recital 89). You keep a record of the processing you do for each client (Art. 30(2)); the exemption for organisations under 250 people does not cover processing that is not occasional (Art. 30(5)). If you must designate a data protection officer (Art. 37, and national rules such as Germany's § 38 BDSG), you publish their contact details and report them to your authority (Art. 37(7)).
What if my client is outside the EU?
Your agency stays bound by the GDPR's processor duties because it is established in the EU (Art. 3(1)). Your client is bound as controller if it offers goods or services to people in the EU or monitors them there (Art. 3(2)); according to the EDPB, it does not become bound merely because it uses a processor in the EU (Guidelines 3/2018). The transfer rules of Chapter V still apply to the data you send it.
Sources
- Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 3, 4, 12, 13, 15, 26, 28 to 30, 32, 33, 37 and 82 and recital 89, Publications Office of the European Union, read on 25 October 2026.
- Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.1, European Data Protection Board, read on 25 October 2026.
- Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors, clauses 7.7, 8 and 9, Publications Office of the European Union, read on 25 October 2026.
- Questions and Answers for the two sets of Standard Contractual Clauses, European Commission, read on 25 October 2026.
- Judgment of the Court of 12 January 2023, RW v Österreichische Post AG, C-154/21, Court of Justice of the European Union, read on 25 October 2026.
- Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), version 2.1, European Data Protection Board, read on 25 October 2026.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 3, 50 and 113, Publications Office of the European Union, read on 25 October 2026.
- Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), Article 1, Publications Office of the European Union, read on 25 October 2026.
- § 38 BDSG, Datenschutzbeauftragte nichtöffentlicher Stellen, Gesetze im Internet, German Federal Ministry of Justice and Consumer Protection, read on 25 October 2026.
How this was made: drafted with AI, then checked against how ChatterLab actually works and against the sources listed in the article. Spotted an error? Write to management@sri-group.eu.