Legal
Nossic Service and CRM data processing terms
Version 3 · 12 October 2026 · replaces the Nossic Chat data processing terms (version 2)
In short
- When you use Nossic Service (live chat, support email, tickets, the customer portal and help centre) or Nossic CRM (contacts and companies), you are the controller of your customers' data and Nossic processes it for you.
- We only use it to run those services for you, keep it in the UK, keep it secure, help you answer your customers' requests, and delete it when you ask or when your retention period ends.
- These terms are part of using Nossic Service and Nossic CRM. The workspace owner accepts them when creating a Service workspace or connecting a support mailbox; an organisation's CRM admin accepts them when first using the CRM.
These terms meet Article 28 of the UK GDPR and the EU GDPR. They apply between Nossic ("we") and the customer who owns a Nossic Service workspace or whose organisation uses Nossic CRM ("you"), and they apply alongside our privacy notice.
1. The processing
| Subject matter | Providing Nossic Service (formerly Nossic Chat): the chat bubble on your website, your support mailbox's email, tickets and response-time targets, the shared inbox, chat flows (including messages a flow starts by itself, forms, mailing-list sign-ups and departments), AI answers and routing, the customer portal, the public help centre, satisfaction ratings and reports; and Nossic CRM: contacts, companies, their timeline of conversations and documents, notes, tasks, segments, imports and exports. |
|---|---|
| Duration | While you use Nossic Service or Nossic CRM, then until the data is deleted under section 9. |
| Nature and purpose | Receiving, storing, showing, routing and answering chat messages and emails for you, and sending your replies from your mailbox; keeping each customer as one contact with a timeline built from your Nossic Service conversations and your Nossic eSign documents; generating AI suggestions, answers and summaries from your knowledge base on our own servers. |
| People | Visitors to your websites who use the chat; people who email your support address or use your customer portal; your contacts and the people at your companies in the CRM; your team members. |
| Personal data | Chat messages and emails, with their attachments, subjects, senders and recipients; names, email addresses, phone numbers, job titles, companies and answers people give (including in forms); notes, tasks, tags and fields your team adds; satisfaction ratings and comments; the page they were on; browser (user agent), browser language and how many times they've visited; cart totals your website shares with the chat; whether, when and to what wording they agreed to your mailing list; a random visitor identifier; timestamps; your team's names and emails; your support mailbox's sign-in details. |
| Special categories | Not intended. Don't ask visitors for health, religious, political, biometric or similar data through the chat. |
2. Your instructions
We process the data only on your documented instructions: these terms, your workspace and organisation settings, and what you and your team do in Nossic Service and Nossic CRM. If the law makes us do otherwise, we'll tell you first unless the law forbids it. We'll tell you if we think an instruction breaks data protection law.
We don't use your visitors' data for our own purposes, sell it, or use it to train AI models.
Your support mailbox stays with the email provider you choose; we read new mail from it and send your replies through it with the sign-in details you give us, which we store encrypted. That provider is yours to choose, not our sub-processor. Nossic CRM receives your conversations from Nossic Service and your documents from Nossic eSign only once your organisation has accepted these terms in the CRM.
Flows you build can send data outside Nossic Service on your instruction: emails to the addresses you choose, API calls and webhooks (such as Zapier) to the addresses you enter, your connected Shopify store, and Google Analytics events through your own website's tag. Those services are yours to choose, not our sub-processors: you need your own terms with them and a lawful basis for sending them the data.
3. Confidentiality
Everyone at Nossic who can access the data is bound to keep it confidential and accesses it only when needed to run, support or secure the service.
4. Security
We protect the data with appropriate technical and organisational measures (Article 32), including: encryption in transit (HTTPS and secure WebSockets); servers in a private network reachable from the internet only through our gateway; access limited to authorised staff with strong authentication; each workspace's and each organisation's data separated by access controls; visitor identifiers and sign-in links stored only as hashes; mailbox passwords encrypted; encrypted backups; and keeping software up to date.
5. Sub-processors
You authorise us to use these sub-processors:
| Sub-processor | What for | Where |
|---|---|---|
| DigitalOcean | The gateway server that carries encrypted traffic between the internet and our servers | London, UK |
| Thundercloud | The mail server that sends emails from your flows, team notifications, task reminders, portal sign-in links and, when you haven't connected a mailbox, ticket replies | UK |
Chats, emails, contacts, AI processing and storage all happen on Nossic's own servers in the UK (emails leave through your own mailbox or the mail server above). We'll give at least 30 days' notice on this page and by email to workspace owners before adding or replacing a sub-processor, so you can object. We hold each sub-processor to data protection terms as strict as these.
6. Where the data goes
We store and process the data in the UK. We won't transfer it outside the UK or the European Economic Area unless the law allows it and the required safeguards are in place.
7. Helping you
- People's rights: you can find, export and delete a visitor's conversations in the Nossic Service inbox, and export or erase a contact in Nossic CRM (optionally with their conversations in Nossic Service). We'll help with anything you can't do yourself, and pass on to you any request someone sends us.
- Breaches: we'll tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data, with the information you need to meet your own duties.
- Assessments: we'll give reasonable help with data protection impact assessments and consultations with regulators about Nossic Service and Nossic CRM.
8. Information and audits
We'll give you the information you reasonably need to show these terms are being met, and allow and contribute to audits by you or an auditor you choose, with reasonable notice, confidentiality and no more than once a year unless a regulator requires it or there's been a breach.
9. Retention and deletion
- Conversations, emails and their attachments are deleted automatically after the retention period you set for your Service workspace (12 months after the last message unless you change it).
- CRM contacts, companies, notes and tasks stay until you delete them; timeline entries for conversations stay as a short record (subject, status, times and rating) after the conversation itself is deleted.
- You can delete a visitor, a conversation or a contact at any time.
- When you delete your workspace, your organisation, or your account, we delete its data straight away, apart from encrypted backups, which are overwritten within 5 weeks.
10. Your part
- You need a lawful basis for the chat, your support email and your CRM, and must tell people about them in your own privacy notice. You can use the wording below.
- Only connect mailboxes you control, and only import contacts you're allowed to keep.
- Only put the chat on websites you control, and set them in your workspace's allowed websites.
- The chat bubble stores its identifier in the visitor's browser once they open the chat or write, or once one of your flows sends them a message. If your flows use visit-based or page triggers, it also keeps a visit count and which automatic messages have already been shown, in the browser only. Mention these in your cookie information, and only use automatic messages where your cookie rules allow it.
- Only add people to your mailing list through the “Subscribe for mailing” step with clear wording, and honour unsubscribes.
Suggested wording for your privacy notice
"Our website's live chat and support email are provided by Nossic Service, and our customer records by Nossic CRM (Nossic, nossic.uk), which process them for us on servers in the UK. When you chat with us or email our support address, we keep your messages, any name, email or answers you give us, the page you were on and your browser type, to answer your questions. The chat stores a random identifier in your browser once you use it (or once it sends you a message), so your conversation can continue on other pages. It may also keep a count of your visits and which automatic messages you've already seen, in your browser only. If you agree to our mailing list in the chat, we keep your email address, when you agreed and what you agreed to. We keep conversations for [12 months] after the last message, and a record of you as our customer for as long as we need it."
11. Other terms
These terms last as long as we process data for you. If they conflict with any other terms between us about personal data, these terms win. We may update them to reflect changes in the law or our service; we'll give workspace owners and CRM admins at least 30 days' notice of changes that materially affect them. Questions: privacy@nossic.uk.