Skip to content
Frosvo

Data processing agreement

Last updated 10 October 2026

Draft. This text is being reviewed and will be finalised with the operating company’s registered details before Frosvo opens to customers.

This agreement applies when the company that operates Frosvo (“Processor”) processes personal data on behalf of a customer (“Controller”) through Frosvo. It forms part of the terms of service and is designed to meet Article 28 of the UK GDPR and EU GDPR.

1. Subject matter

Nature and purposeHosting and processing conversations and contact data to provide live chat, inbox, AI assistance, automation, campaigns and reporting.
Data subjectsThe Controller’s website visitors, customers and contacts; the Controller’s team members.
Categories of dataNames, email addresses, phone numbers, channel identifiers, messages and files, pages visited, approximate location from IP address, custom fields the Controller defines.
DurationFor the term of the agreement, then deletion as in section 7.

The Controller must not send special-category data (such as health data) or payment card numbers through Frosvo unless agreed in writing.

2. Instructions

The Processor processes personal data only on the Controller’s documented instructions — the terms, this agreement and the Controller’s configuration of the Service — unless the law requires otherwise.

3. Confidentiality and security

People authorised to process the data are bound by confidentiality. The Processor keeps appropriate technical and organisational measures, described on the security page, including workspace isolation, encryption of secrets, access controls, backups and logging.

4. Subprocessors

The Controller authorises the subprocessors listed on the subprocessors page. The Processor will give at least 30 days’ notice of a new subprocessor, during which the Controller may object; the Processor stays responsible for its subprocessors.

5. Helping the Controller

The Processor helps the Controller answer data subject requests (Frosvo includes export and erasure of one person’s data), with security, breach notification, impact assessments and consultations, taking into account the nature of the processing.

6. Personal data breaches

The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of a breach affecting the Controller’s data, with the information it has.

7. Deletion and return

The Controller can export and delete data at any time and set retention periods in the Service. When the agreement ends, the Processor deletes the Controller’s data within 30 days of closure (backups are overwritten in their normal cycle), unless the law requires it to be kept.

8. Audits

The Processor makes available the information needed to show compliance with this agreement and allows for reasonable audits, with notice, no more than once a year unless a breach or authority requires it.

9. International transfers

Where personal data is transferred outside the UK or EEA to a country without an adequacy decision, the standard contractual clauses (with the UK addendum where relevant) apply and are incorporated by reference.

Signed copies

If you need a countersigned copy, contact support@frosvo.com.