Skip to main content

Last updated: 10 August 2026

Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Morv AI Ltd (“Processor”, “we”, “us”) and you (“Controller”, “you”), and governs the processing of personal data by Morv on your behalf when you use our chatbot and integration services.

This DPA is entered into pursuant to Article 28 of the UK General Data Protection Regulation (UK GDPR).

1. Definitions

  • “Personal Data” means any data relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller under this DPA.
  • “Processing” has the meaning given in UK GDPR Article 4(2).
  • “Sub-Processor” means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
  • “Data Protection Laws” means the UK GDPR, the Data Protection Act 2018, and any other applicable data protection legislation.
  • “Personal Data Breach” has the meaning given in UK GDPR Article 4(12).

2. Scope and Purpose of Processing

Subject Matter

The Processor processes Personal Data on behalf of the Controller to provide the Morv chatbot and integration services as described in the Terms of Service.

Duration

Processing continues for the duration of your use of the Service, plus any retention period required for deletion as described in our Privacy Policy.

Nature and Purpose of Processing

  • Receiving and storing chatbot conversation messages from website visitors
  • Transmitting messages to AI providers (Sub-Processors) to generate responses, together with the address and title of the page the visitor is on
  • Storing conversation history for the Controller’s review
  • Processing IP addresses for rate limiting and spam prevention
  • Storing session identifiers for conversation continuity
  • Retrieving and caching data from connected third-party integrations

Types of Personal Data

  • Visitor messages and conversation content, including the address and title of the page on the Controller’s website where each conversation started
  • IP addresses
  • Browser and device metadata (user agent, language)
  • Session identifiers
  • Any personal data contained within integration data (e.g. customer names, email hashes, order details)
  • Contact details a visitor voluntarily submits through the chatbot’s contact form, where the Controller has enabled it: name, email address, telephone number and any message the visitor writes in the contact form, together with the visitor’s consent to be contacted and the time it was given
  • Chatbot interaction events recorded in the visitor’s browser: the page on the Controller’s website the chat was opened from, links clicked inside the chat, session duration, and similar interaction metadata
  • Diagnostic records of each AI request, including the full prompt sent to the AI provider and the provider’s raw response

Special categories. The Service is not intended to process special categories of personal data (Article 9 UK GDPR) or criminal-offence data (Article 10). Because visitors may volunteer such data in free-text chatbot messages, the Controller must not configure chatbots to solicit special-category or criminal-offence data without an appropriate Article 9/10 condition and clear notice to visitors. The Processor handles any such data only as part of the ordinary message flow, applies the same security and retention measures, and does not use it for any separate purpose.

Categories of Data Subjects

  • Website visitors who interact with the Controller’s chatbot
  • Individuals whose data is present in connected third-party integrations

Data Storage Location

Primary data storage is located in the United Kingdom. Data is transmitted to Sub-Processors in the United States as described in Section 5 and on our Sub-Processors page.

Controller Obligations

The Controller warrants and undertakes that: (i) it has a lawful basis for the processing of Personal Data instructed under this DPA; (ii) its instructions (including its configuration of the Service) comply with Data Protection Laws; (iii) it provides website visitors with any legally required privacy information about the chatbot’s processing of their data; and (iv) it is responsible for the lawfulness of the content and knowledge sources it configures, including ensuring that crawled content and integration data may lawfully be processed under this DPA.

3. Processor Obligations

The Processor shall:

  • Process Personal Data only on documented instructions from the Controller (which are deemed given by your configuration of the Service), unless required to do so by applicable law, in which case the Processor will inform the Controller before processing unless legally prohibited from doing so
  • Immediately inform the Controller if, in the Processor’s opinion, an instruction from the Controller infringes Data Protection Laws. The Processor is not obligated to actively monitor the lawfulness of instructions but will raise concerns where they become apparent.
  • Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality
  • Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
    • Encryption of data in transit (TLS) and at rest (AES-256-CBC for credentials)
    • Password hashing using bcrypt
    • Access controls and authentication (including optional two-factor authentication)
    • CSRF protection, rate limiting, and session management
    • Input validation and output encoding to prevent injection attacks
    • Regular security testing and monitoring
  • Not engage another processor (Sub-Processor) without prior general written authorisation of the Controller (see Section 4)
  • Assist the Controller in responding to data subject requests, including requests for access, rectification, erasure, data portability, restriction, and objection
  • Assist the Controller in ensuring compliance with obligations under Articles 32–36 UK GDPR (security, breach notification, data protection impact assessments, and prior consultation)
  • At the Controller’s choice, delete or return all Personal Data after the end of the provision of services, and delete existing copies unless storage is required by applicable law
  • Make available to the Controller all information necessary to demonstrate compliance with Article 28 obligations, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller (at the Controller’s expense, with reasonable notice)

4. Sub-Processors

The Controller provides general written authorisation for the Processor to engage Sub-Processors. The current list of Sub-Processors is maintained at /sub-processors.

The Processor shall:

  • Inform the Controller of any intended changes to Sub-Processors (additions or replacements) by email at least 14 days before the change takes effect
  • Provide the Controller with an opportunity to object to such changes. If the Controller objects on reasonable data protection grounds within 14 days of notification, the parties will discuss in good faith. If no resolution is reached, the Controller may terminate the affected portion of the Service. A sub-processor change does not take effect for the Controller before this objection window has closed
  • Impose the same data protection obligations on each Sub-Processor by way of a contract, ensuring that the Sub-Processor provides sufficient guarantees to implement appropriate technical and organisational measures
  • Remain fully liable to the Controller for the performance of each Sub-Processor’s obligations

5. International Transfers

The Processor shall not transfer Personal Data outside the United Kingdom or European Economic Area unless:

  • The transfer is to a country with an adequacy decision; or
  • Appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, certification under the UK Extension to the EU–US Data Privacy Framework (the UK–US Data Bridge), or binding corporate rules

Current international transfers are to Sub-Processors located in the United States, protected by the safeguards described on our Sub-Processors page.

6. Data Breach Notification

The Processor shall notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting the Controller’s data, and will use all reasonable efforts to do so within 72 hours. The notification shall include:

  • A description of the nature of the breach, including the categories and approximate number of data subjects and records concerned
  • The name and contact details of the data protection contact
  • A description of the likely consequences of the breach
  • A description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects

The Controller’s own obligation under Article 33 UK GDPR (notification to the ICO within 72 hours) runs from when the Controller becomes aware of the breach, which will normally be upon receiving the Processor’s notification.

The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach.

7. Data Subject Requests

If the Processor receives a request from a data subject to exercise their rights under Data Protection Laws in relation to Personal Data processed on behalf of the Controller, the Processor shall:

  • Promptly notify the Controller of the request (within 5 business days)
  • Not respond to the data subject directly unless instructed by the Controller or required by law
  • Provide the Controller with reasonable assistance to fulfil the request, including providing relevant data extracts and technical support
  • The Processor may charge the Controller its reasonable costs for assistance with requests that are manifestly unfounded or excessive

8. Deletion and Return of Data

Upon termination of the Service:

  • Conversation data, knowledge base content, and integration data are deleted within 30 days of account deletion
  • The Controller may export their data in machine-readable format (JSON) via the account settings before deletion
  • Backup copies are purged within 90 days of deletion
  • Data required for legal compliance (e.g. payment records) is retained as described in our Privacy Policy

9. Audit Rights

The Processor shall make available to the Controller, on request, all information reasonably necessary to demonstrate compliance with this DPA. The Controller (or a mandated third-party auditor bound by confidentiality) may conduct an audit of the Processor’s data processing activities, subject to:

  • At least 30 days’ written notice
  • Scope limited to the Controller’s data and related processing activities
  • Audits conducted during normal business hours and in a manner that minimises disruption
  • Costs borne by the Controller
  • No more than one audit per 12-month period, unless required by a supervisory authority or following a data breach

Where possible, the Processor may satisfy audit requests by providing relevant certifications, audit reports, or summaries of security measures in lieu of on-site inspections.

10. Liability

Each party’s liability under this DPA is subject to the limitations set out in the Terms of Service, except that neither party’s liability for breaches of Data Protection Laws shall be limited to the extent that such limitation would be prohibited by applicable law.

As between the parties, each party is responsible under Article 82 UK GDPR for the damage caused by its own processing where it has not complied with its obligations under Data Protection Laws. Where one party pays compensation to a data subject for damage for which the other party is responsible, it is entitled to claim back from the other party the part of the compensation corresponding to the other party’s share of responsibility.

11. Governing Law

This DPA is governed by the laws of England and Wales. Any disputes arising from this DPA shall be subject to the jurisdiction provisions of the Terms of Service.

12. Precedence

In the event of a conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to the processing of Personal Data.

13. Term and Termination

This DPA takes effect when you accept the Terms of Service and remains in effect for the duration of the Processor’s processing of Personal Data on behalf of the Controller. It terminates automatically when all Personal Data has been deleted or returned in accordance with Section 8.

14. Contact

For questions about this DPA, contact us at privacy@morv.ai.