Data Processing Agreement

Draft for legal review — this framework is not an executed agreement. A retailer-specific agreement and completed processing schedule are required before live customer data is processed.

Parties and roles

The retailer is the data controller for its customer conversations and enquiries. WebLiveView Ltd, the provider of Mary AI, acts as processor when handling that data on the retailer’s documented instructions. WebLiveView Ltd is registered in Ireland; its registered office is 20 Harcourt Street, Dublin 2, D02 H367, Ireland.

Processing scope

The agreed service may receive and store AI chat messages, use catalogue information to recommend products, and capture quote, callback and showroom appointment requests. Data subjects are the retailer’s customers and prospective customers. Data may include names, email addresses, phone numbers, conversation text, product interests, budget, room requirements and preferred appointment times. Sensitive personal data is not intended to be collected.

Documented instructions and confidentiality

The final agreement must require processing only on documented lawful instructions, including instructions for integrations and any international transfers. Access must be limited to authorised people with confidentiality obligations. Customer information must not be disclosed to unrelated retailers or repurposed outside the agreed instructions.

Security measures

The processing schedule must document the actual measures protecting customer data, including tenant separation, access controls, secure transmission, incident handling and deletion procedures. Measures must be appropriate to the risks and must be verified rather than assumed from this draft.

Service providers and integrations

The final schedule must identify approved sub-processors, their locations and functions, and the agreed authorisation and change-notification procedure. Optional BookedJobs, calendar, messaging and payment integrations must be documented, including which data is shared and each provider’s role. No provider list or international transfer safeguard is represented as verified here.

Assistance and incidents

The final agreement must require assistance with data subject requests, security obligations, impact assessments and regulatory enquiries where applicable. It must require notification to the retailer without undue delay after becoming aware of a personal data breach, with available details and cooperation in response. The retailer remains responsible for decisions about customer or regulator notifications.

Retention, return and deletion

Processing lasts for the agreed service duration and any documented lawful retention period. The completed agreement must state how customer data is returned or deleted when the service ends, including backup handling and any legally required retention. No specific retention duration has yet been confirmed.

Accountability and audits

The final agreement must provide information needed to demonstrate compliance and agreed audit arrangements, and require the processor to flag instructions it considers contrary to applicable data protection law.

Schedule to complete before activation

• Retailer identity, authorised contacts and documented processing instructions.
• Service scope, duration, data categories and categories of data subjects.
• Verified security measures and approved service providers.
• Enabled integrations, processing locations and applicable transfer safeguards.
• Retention, deletion, incident contacts and assistance arrangements.
• Agreed authorisation, audit and signature arrangements.

Contact

To arrange a retailer-specific agreement, contact sales@bookedjobs.ie or +353 1 441 2618. See also our Privacy Policy and Terms & Conditions.