https://chatfuel.com/_next/static/chunks/pages/gdpr-1038a793e7dc0a8e.js

1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[6627],{39259:function(e,t,a){(window.__NEXT_P=window.__NEXT_P||[]).push(["/gdpr",function(){return a(85782)}])},12967:function(e,t,a){"use strict";a.d(t,{o:function(){return Spoiler}});var s=a(85893),o=a(67294),r=a(94184),n=a.n(r),i=a(32125);let Spoiler=e=>{let{title:t,content:a,isWhite:r,containerProps:l,contentProps:c,...d}=e,[h,u]=(0,o.useState)(!1);return(0,o.useEffect)(()=>{h&&d["data-action"]&&(0,i.q)({action:d["data-action"],category:d["data-category"]||"landing page",label:d["data-label"]})},[h]),(0,s.jsxs)("div",{className:n()("cursor-pointer py-6",{"mb-4 rounded-lg bg-white px-8 py-4":r}),onClick:()=>u(e=>!e),...l,children:[(0,s.jsxs)("div",{className:"flex cursor-pointer items-center justify-between",children:[t,(0,s.jsx)("div",{className:n()("flex items-center",{"rotate-180":h}),children:(0,s.jsx)("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",xmlns:"http://www.w3.org/2000/svg",children:(0,s.jsx)("path",{fillRule:"evenodd",clipRule:"evenodd",d:"M8.12668 10.0371L11.5486 14.7604C11.748 15.0357 12.1118 15.0803 12.3611 14.8601C12.3945 14.8306 12.4247 14.7972 12.4514 14.7604L15.8733 10.0371C16.0727 9.76183 16.0323 9.36012 15.783 9.13988C15.6805 9.04933 15.5532 9 15.4219 9L8.57809 9C8.25882 9 8 9.2858 8 9.63835C8 9.7833 8.04467 9.92393 8.12668 10.0371Z",fill:"black"})})})]}),(0,s.jsx)("div",{className:n()("overflow-hidden transition-all",{"h-0":!h,"mt-6 h-auto":h}),...c,children:a})]})}},85782:function(e,t,a){"use strict";a.r(t),a.d(t,{__N_SSP:function(){return n}});var s=a(85893),o=a(79164),r=a(12967),n=!0;t.default=()=>(0,s.jsx)(o.Z,{persistHeader:!0,title:"GDPR Compliance | Chatfuel",description:"The information contained on this page is a commentary on the GDPR, as Chatfuel interprets it, as of the date of publication.",locale:"en",isLocaleCanonical:!1,children:(0,s.jsxs)("div",{className:"mx-auto max-w-6xl p-10 pt-28 font-body text-lg leading-7 text-dark",children:[(0,s.jsx)("h1",{className:"mb-6 text-4xl font-bold md:text-7xl",children:"GDPR Compliance"}),(0,s.jsx)("p",{children:"The information contained on this page is a commentary on the GDPR, as Chatfuel interprets it, as of the date of publication. We’ve spent a lot of time with GDPR and like to think we’ve been thoughtful about its intent and meaning. But the application of GDPR 

1is highly fact-specific, and not all aspects and interpretations of GDPR are well-settled. As a result, this information is provided for informational purposes only and should not be relied upon as legal advice or to determine how GDPR might apply to you and your organization. We encourage you to work with a legally qualified professional to discuss GDPR, how it applies specifically to your organization, and how best to ensure compliance. CHATFUEL MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION ON THIS PAGE. This information is provided “as-is”. Information and views expressed here, including URL and other Internet website references, may change without notice. This document does not provide you with any legal rights to any intellectual property in any Chatfuel product. You may copy and use this information for your internal, reference purposes only."}),(0,s.jsx)("h2",{className:"mb-6 mt-10 text-2xl font-bold md:text-4xl",children:"What is GDPR?"}),(0,s.jsxs)("p",{children:["On 25 May 2018, the most significant piece of European data protection legislation to be introduced in 20 years went into force. The"," ",(0,s.jsx)("a",{className:"text-blue-normal underline",href:"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679",target:"_blank",rel:"noreferrer",children:"EU General Data Protection Regulation"})," ","(GDPR) replaces the"," ",(0,s.jsx)("a",{className:"text-blue-normal underline",href:"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=LEGISSUM:l14012",target:"_blank",rel:"noreferrer",children:"1995 EU Data Protection Directive"}),". The GDPR strengthens the rights that individuals have regarding personal data relating to them and seeks to unify data protection laws across Europe, regardless of where that data is processed.As a result of this change, many organizations that have access to and process the personal data of EU-based users are subject to the rules and regulations that come into effect along with GDPR. Since many of our bot creators are based in the EU, while many of those outside the EU have EU-based bot users, we need to address these rules and regulations accordingly."]}),(0,s.jsx)("h2",{className:"mb-6 mt-10 text-2xl font-bold md:text-4xl",children:"What has Chatfuel done to comply?"}),(0,s.jsx)("p",{children:"Chatfuel is a company headquartered in the U.S., but we have customers and bot users located in the EU. Despite the fact that we do not have any physical locations in the EU, we recognize the fact that many of our users are directly affected by the GDPR and expect us to comply in order to continue using our product and have the confidence that they can do it in accordance with the new legislation."}),(0,s.jsx)("p",{className:"mt-4",children:"Therefore, we’ve addressed the GDPR requirements that would apply to us as processors (and in some cases subprocessors) of personal data by implementing specific legal, technical and organizational measures aimed to address data privacy and security concerns:"}),(0,s.jsxs)("ul",{children:[(0,s.jsx)("li",{className:"ml-7 list-disc pl-2",children:(0,s.jsxs)("p",{className:"mt-4",children:["We’ve put in place the contractual measures in the form of a"," ",(0,s.jsx)("a",{className:"text-blue-normal underline",href:"https://chatfuel.com/files/TermsOfUse.pdf",children:"Data Processing Agreement"})," ","in accordance with the GDPR requirements that would come into effect the day GDPR comes into force and all platform users will be asked to accept the terms prior to that date."]})}),(0,s.jsx)("li",{className:"ml-7 list-disc pl-2",children:(0,s.jsx)("p",{className:"mt-4",children:"We’ve ensured that we have appropriate contractual measures in place with each of our data subprocessors such as cloud service and analytics providers."})}),(0,s.jsx)("li",{className:"ml-7 list-disc pl-2",children:(0,s.jsxs)("p",{className:"mt-4",children:["We’ve implemented and outlined specific technical and organizational measures (",(0,s.jsx)("a",{className:"text-blue-normal underline",href:"https://chatfuel.com/files/TermsOfUse.pdf",children:"Appendix 2 to the DPA"}),") to ensure data privacy and security and have put in place internal protocols and processes to ensure that we can address the GDPR requirements with regards to storage, processing, and control of personal data."]})}),(0,s.jsx)("li",{className:"ml-7 list-disc pl-2",children:(0,s.jsxs)("p",{className:"mt-4",children:["We’ve updated our"," ",(0,s.jsx)("a",{className:"text-blue-normal underline",href:"https://chatfuel.com/privacy-policy.html",children:"Privacy Policy"})," ","to add EU-specific clauses"]})})]}),(0,s.jsx)("h2",{className:"mb-6 mt-10 text-2xl font-bold md:text-4xl",children:"GDPR Compliance Webinar"}),(0,s.jsx)("p",{children:"Watch the recording of the GDPR compliance webinar we held on April 26, 2018 to go over the specifics of the legislation and how it applies to Chatfuel, our customers, and the bot users. We also discuss the measures we have taken towards compliance with the requirements."}),(0,s.jsxs)("p",{className:"mt-4",children:["Update: Facebook has released additional policy updates for Messenger related to new EU privacy laws. These changes are effective as of December 16, 2020. Visit our"," ",(0,s.jsx)("a",{className:"text-blue-normal underline",target:"_blank",href:"/blog/messenger-euprivacy-changes",rel:"noreferrer",children:"Messenger policy guide"})," ","to find out how they may impact your chatbot."]}),(0,s.jsx)("div",{className:"mt-4 w-full",children:(0,s.jsx)("iframe",{className:"h-[320px] w-full md:h-[520px]",src:"https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Fwww.youtube.com%2Fembed%2F68L4qaI0p2E%3Ffeature%3Doembed&display_name=YouTube&url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D68L4qaI0p2E&image=https%3A%2F%2Fi.ytimg.com%2Fvi%2F68L4qaI0p2E%2Fhqdefault.jpg&key=96f1f04c5f4143bcb0f2e68c87d65feb&type=text%2Fhtml&schema=youtube",scrolling:"no",title:"YouTube embed",frameBorder:"0",allow:"autoplay; fullscreen",allowFullScreen:!0})}),(0,s.jsx)("h2",{className:"mb-6 mt-10 text-2xl font-bold md:text-4xl",children:"Updated Terms of Use and Privacy Policy"}),(0,s.jsxs)("p",{children:["In accordance with the GDPR requirements, we have updated our"," ",(0,s.jsx)("a",{className:"text-blue-normal underline",href:"https://chatfuel.com/files/TermsOfUse.pdf",children:"Terms of Use"})," ","and"," ",(0,s.jsx)("a",{className:"text-blue-normal underline",href:"https://chatfuel.com/privacy-policy.html",children:"Privacy Policy"}),". We encourage you to read both documents in full and contact us if you have any questions."]}),(0,s.jsx)("p",{className:"mt-4",children:"These updates take effect on May 25, 2018. By continuing to use our services on or after that date, you acknowledge our updated Privacy Policy and agree to the updated Terms of Use."}),(0,s.jsxs)("div",{className:"mt-4",children:[(0,s.jsx)(r.o,{title:(0,s.jsx)("h3",{className:"text-2xl font-bold",children:"What is personal data?"}),content:(0,s.jsx)("p",{children:"Any information relating to an identified or identifiable natural person ('data subject'). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as - name, email address or location, and also online identifiers like IP address, types of website cookies and other device identifiers."})}),(0,s.jsx)(r.o,{title:(0,s.jsx)("h3",{className:"text-2xl font-bold",children:"Who are data controllers, processors, and sub-processors?"}),content:(0,s.jsxs)("p",{children:["A data controller is the entity/person that determines purposes and means of processing personal data of the EU resident. For eg. Chatfuel is a data processor and, depending on their function, Chatfuel’s customers (bot creators) are either controllers or primary processors in relation to personal data subject to GDPR.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"The GDPR applies to both data controllers and processors. Controllers collect data from the end-user who is, in most cases, the EU resident for purposes clearly stated and with appropriate consent. Data processors provide services to the controller in accordance with each controller's instructions.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"Another category called sub-processors or third-party businesses performing data processing for other companies are also accountable for protection of personal data, according to the GDPR"]})}),(0,s.jsx)(r.o,{title:(0,s.jsx)("h3",{className:"text-2xl font-bold",children:"Does the GDPR require EU data to stay (be hosted/stored) in the EU?"}),content:(0,s.jsxs)("div",{children:[(0,s.jsxs)("p",{children:["No, the GDPR does not require EU personal data to stay in the EU, nor does it materially change the landscape for data transfers outside the EU.",(0,s.jsx)("br",{}),"‍",(0,s.jsx)("br",{}),"Data transfers from the EU to outside can be legitimized in many ways including:",(0,s.jsx)("br",{})]}),(0,s.jsxs)("ul",{children:[(0,s.jsx)("li",{children:(0,s.jsxs)("p",{children:["EU-US Privacy Shield",(0,s.jsx)("br",{})]})}),(0,s.jsx)("li",{children:(0,s.jsxs)("p",{children:["Model or Contractual clauses",(0,s.jsx)("br",{})]})}),(0,s.jsx)("li",{children:(0,s.jsxs)("p",{children:["Binding Corporate Rules (BCR)",(0,s.jsx)("br",{})]})})]})]})}),(0,s.jsx)(r.o,{title:(0,s.jsx)("h3",{className:"text-2xl font-bold",children:"Does GDPR apply only to the EU residents’ personal data?"}),content:(0,s.jsx)("p",{children:"GDPR does not only cover EU resident’s data. For example, data of US residents would also fall under GDPR to the extent an EU-established entity processes such data in the EU."})}),(0,s.jsx)(r.o,{title:(0,s.jsx)("h3",{className:"text-2xl font-bold",children:"Does GDPR apply to territories outside the EU?"}),content:(0,s.jsx)("p",{children:"GDPR can apply any time personally identifiable information of any EU resident is stored and processed. It does not depend on the physical location / territory. Also, establishments in the EU are subject to GDPR regardless of where personal data comes from."})}),(0,s.jsx)(r.o,{title:(0,s.jsxs)("h3",{className:"text-2xl font-bold",children:["How to ensure compliance if I am using 3rd party integrations"," ",(0,s.jsx)("br",{}),"(Zapier, Integromat, etc)"]}),content:(0,s.jsx)("p",{children:"If you elect to integrate a 3rd party service to pass your bot users’ data to, you need to ensure that the service has taken all the necessary measures to be compliant with GDPR. Since bot admins have direct access to data and control how data gets to Chatfuel as well as where the data goes outside of Chatfuel, they would be bound by GDPR rules as either a controller or a processor of data. Talk to your legal counsel to evaluate your exposure to GDPR and any additional steps you need to take to be in compliance."})}),(0,s.jsx)(r.o,{title:(0,s.jsx)("h3",{className:"text-2xl font-bold",children:"How do I handle user data deletion requests?"}),content:(0,s.jsx)("p",{children:"If your users ask you to delete their personal data, you can simply delete those users from the ‘People’ tab in your bot’s dashboard. All of their data will be removed from our databases for that particular Facebook page. If you’ve passed any of your users’ data to any 3rd party services (Zapier, Integromat, a CRM service, etc), you are responsible for ensuring that the user data is deleted from those services as well."})}),(0,s.jsx)(r.o,{title:(0,s.jsxs)("h3",{className:"text-2xl font-bold",children:["Can I continue using Chatfuel after May 25, 2017 and be sure that"," ",(0,s.jsx)("br",{}),"I’m in compliance with GDPR requirements?"]}),content:(0,s.jsx)("p",{children:"We have taken all the necessary steps for Chatfuel to be in compliance with the requirements of GDPR. Accepting the DPA agreement from Chatfuel is an important step towards your compliance. Talk to your legal counsel to evaluate your individual organizational processes and understand what you may 

1need to do in addition to ensure full compliance."})}),(0,s.jsx)(r.o,{title:(0,s.jsxs)("h3",{className:"text-2xl font-bold",children:["How to best communicate the steps Chatfuel has taken ",(0,s.jsx)("br",{}),"to be GDPR-compliant"]}),content:(0,s.jsxs)("p",{children:["The way"," ",(0,s.jsx)("a",{className:"text-blue-normal underline",href:"https://www.facebook.com/business/m/messenger-and-the-gdpr",target:"_blank",rel:"noreferrer",children:"Messenger team answers this questions"})," ","is:",(0,s.jsx)("br",{}),"‍",(0,s.jsx)("br",{}),(0,s.jsx)("em",{children:"“The GDPR defines several "}),(0,s.jsx)("a",{className:"text-blue-normal underline",href:"https://www.facebook.com/business/gdpr#Key%20Legal%20Bases",target:"_blank",rel:"noreferrer",children:(0,s.jsx)("em",{children:"possible legal bases"})}),(0,s.jsxs)("em",{children:[" ","for processing information. Depending on your use-case, you may need to rely on users' explicit consent to process their data. The way you obtain consent may vary, for example you may want to ask for consent when a user is talking to your bot via message or a webview. We suggest you confer with legal counsel to determine the requirements for your business.”"]}),(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"When you collect any personal data from the bot users, you are responsible for establishing the proper ‘opt in’ mechanics as may be appropriate with regards to GDPR. If your users elect to opt-out, please reach out to us and we will remove their data individually."]})})]}),(0,s.jsx)("h2",{className:"mb-6 mt-10 text-2xl font-bold md:text-4xl",children:"Additional Resources"}),(0,s.jsxs)("p",{children:["Please refer to"," ",(0,s.jsx)("a",{className:"text-blue-normal underline",href:"https://www.facebook.com/business/gdpr",target:"_blank",rel:"noreferrer",children:"Facebook’s GDPR Portal"})," ","as well as"," ",(0,s.jsx)("a",{className:"text-blue-normal underline",href:"https://www.facebook.com/business/m/messenger-and-the-gdpr",target:"_blank",rel:"noreferrer",children:"GDPR guidance from the Messenger Platform"})," ","for additional resources and FAQs.If you have any additional questions or concerns, please let us know:"," ",(0,s.jsx)("a",{className:"text-blue-normal underline",href:"mailto:[email protected]",children:"[email protected]"})]})]})})}},function(e){e.O(0,[9877,233,9164,9774,2888,179],function(){return e(e.s=39259)}),_N_E=e.O()}]);