Sojkachat

Data Processing Agreement

Effective from 25 October 2026. This agreement is part of the contract for the Sojka service and is concluded together with it.

This is a translation for your information. The Czech version is legally binding.

1. Parties and subject

1.1. The controller is the Customer who runs the Sojka chat on its website. The processor is MYPIXEL s.r.o., company ID 17617421, registered office Příčná 1892/4, Nové Město, 110 00 Praha 1, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 373971 (the “Processor”).

1.2. The Processor processes, on behalf of the controller, personal data of visitors to its website who use the chat, only to the extent necessary to provide the service under the terms of service.

2. Scope of processing

Nature and purposeReceiving visitors’ questions, generating answers from the controller’s website content, storing conversations for the controller’s overviews, forwarding a conversation to the controller’s e-mail at the visitor’s request, abuse protection.
Data subjectsVisitors to the controller’s website who write in the chat.
Categories of dataContent of messages (may include a name, contact or other data the visitor provides), browser language, page address, random browser identifier, answer ratings, e-mail when forwarding a conversation, IP address for a short time.
DurationFor the term of the contract. Conversations are deleted 12 months after the last message, or sooner on the controller’s instruction.

3. Processor’s obligations

The Processor:

  • processes data only on documented instructions of the controller, given by the contract and the service settings in the admin, and informs the controller if, in its opinion, an instruction infringes the law;
  • ensures that persons authorised to process the data are bound by confidentiality;
  • takes technical and organisational measures under Article 32 GDPR, in particular encrypted transmission, access control, logging of its staff’s access to the controller’s account and separation of each customer’s data;
  • assists the controller in handling visitors’ requests to exercise their rights; the controller can view, delete and export conversations in the admin;
  • assists the controller with obligations under Articles 32 to 36 GDPR, taking into account the nature of processing;
  • provides the controller with the information needed to demonstrate compliance and allows an audit by prior arrangement, at most once a year unless investigating an incident;
  • does not use the data for its own purposes, does not sell it and does not use it for advertising.

4. Subprocessors

4.1. The controller gives general authorisation to engage further processors. The current list is at /en/subprocessors.

4.2. The Processor informs the controller by e-mail of any intended change (addition or replacement) at least 14 days in advance. The controller may object within that period; if the parties do not agree, the controller may terminate the contract without penalty.

4.3. The Processor imposes the same data protection obligations on subprocessors and remains liable for their performance.

5. Transfers outside the EU

Data is stored in the EU. Some subprocessors are based in the USA; transfers are based on an adequacy decision (EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses.

6. Personal data breach

The Processor notifies the controller of a personal data breach without undue delay, at the latest within 48 hours of becoming aware of it, and provides the information the controller needs to notify the supervisory authority and the data subjects.

7. Controller’s obligations

7.1. The controller is responsible for having a legal basis for the processing and informs visitors to its website about the processing of data in the chat, for example by adding a text to its privacy policy (a sample is in the help).

7.2. The controller will not configure the assistant to request special categories of personal data from visitors.

8. Termination

After the contract ends, the Processor deletes all visitors’ personal data within 30 days unless the law requires it to be kept. The controller may download it in the admin beforehand (Conversations → Download).

9. Final provisions

The parties’ liability is governed by the terms of service. Matters not covered here are governed by the terms of service and the GDPR. If the controller needs a separately signed agreement, write to us.