Data associated with a visitor and stored in the visitor’s browser
The data are not collected through cookies but are associated with the VUID.
Purpose: Processing these data help ensure that the targeting rules are working properly
-
Data attached to this VUID :
- Browser type (12 months)
- Terminal type (12 months)
- Page URL (12 months)
-
Session data (expires after 30 minutes of inactivity):
- Number of pages viewed by the Visitor (Page View)
- Date/time of new session (Connection Time)
- Browser language to contextualize chat language (Lang)
- Site browsing time (NavTime)
1.2 Data collected DURING the chats:
To collect personal data from Visitors, iAdvize recommends these 2 options:
1) Activate the iAdvize chat window's consent form to ask Visitors for their consent
(opt-in mode with clear and transparent information)
or
2) The customer relies on legitimate interest
User identification data :
Purpose: Collection of User data enabling the management and authentication of User roles.
- Last name, first name, pseudonym, username (duration of contract with iAdvize)
- Customer position (duration of contract with iAdvize)
- Connection data, logs: Access-token (platform connection identifier) refresh_token (platform connection identifier)
- Platform (platform concerned) (1 day)
Visitor data :
Purpose: Collection and storage of Visitors' conversations to enable Users to interact directly with these Visitors
- Conversations (content of conversation, number of conversations, duration, date, response to satisfaction questionnaire if applicable)
- Visitor's IP address
- If transmitted by the Visitor: identity, e-mail, telephone number
2. For what purpose(s) is the Data collected?
iAdvize User identification data:
Collection of Users' personal data for management and authentication purposes.
Visitor Login Data:
The VUID (cookie) is used to adapt engagement methods according to the Visitor's path, for the purposes of
user interface personalization.
It is also used to record the collection of Visitor consent via the Chatbox (RGPD), so that consent is only requested again after 12 months.
Visitor Conversations:
Collecting Visitor conversations to enable e-commerce site agents to interact directly with Visitors.
3. How long is the Data retained?
The length of time conversations and associated data (visitor profile etc...) are stored varies depending on the channel used:
-
Chat/Social media: 3 years (by default – unless the Customer specifies another duration) in active database
- Call/SMS: 12 months in active database
- Temporary archive: The retention of the temporary archive is 4 years. Stored personal data can no longer be processed by operational services. They are now stored only for litigation purposes and are subject to restricted access (3 AWS Administrators at iAdvize + VP Engineering).
NB: The video stream is not recorded.
4. Anonymization and deletion of Data :
At the end of the retention period of the conversations, only personal data is deleted and we save the anonymized data.
5. Who has access to the Data?
The persons having access to the Data are the following:
-
Users: There are three types of profiles: Advisor; Manager; Admin and, if applicable, ibbü Experts.
The Admin profile has access to the full iAdvize Solution:
-
Consult all the Data stored in the Solution (Performance, KPIs, Conversations)
- Create/delete/modify profiles: a new Admin, a Manager, an Advisor, a bot
- Modify your account settings, for example: activate/deactivate the GDPR consent request, modify the rules of engagement of your visitors, modify the UX of your chatbox and chat notification, ...
The Manager profile only has access to the reports and advisers that are part of his group :
-
Consult all the reports but with only the data of his group of respondents (KPI, conversation history,...)
- Create/delete/modify Advisor profiles that can only be associated with his group.
The Advisor / Expert profile only has access to the chat room.
- iAdvize support team
6. Is the Data shared with third parties?
No. Your personal data will not be passed on to third parties under any circumstances.
7. Where is the Data stored?
Chat conversations: the Data is hosted within the European Union (Frankfurt (Germany)) in accordance with the data processing contract signed with our service provider, AWS.
Calls: The Data is stored in the United States for the duration of the conversation. At the end of the call, the Data is deleted from the servers in the United States and then transferred to and hosted on AWS servers in the Frankfurt (Germany) area).
SMS: the Data is hosted in the United States, in accordance with the data processing contract signed with Twilio.
For Social Networks and Messaging Apps (Facebook, Messenger, WhatsApp, Apple Messages for Business): the Data is hosted within the European Union (Frankfurt (Germany)) in accordance with the data processing contract signed with our service provider, AWS.
For Third Parties (Facebook, Messenger) host them within the European Union (Ireland) and the USA (see special conditions relating to the protection of privacy defined by these third parties).
For videos: the metadata is hosted within the European Union (Frankfurt (Germany)) in accordance with the data processing contract signed with our service provider, AWS.
NB: The video stream is not recorded (peer-to-peer between agents and visitors).
Invalidation of the Privacy Shield on 16/07/2020 by the JCEU :
According to the decision of the JCEU, to ensure the compliance of a transfer from the EU to the USA, the exporter must ensure that the importer has put in place the best guarantees (appropriate technical and operational measures).
iAdvize has taken the following actions to ensure an adequate level of protection for data transfers:
- We have signed a Data Processing Agreement with our subcontractors which includes standard contractual clauses as validated by the JCEU.
- We have verified the numerous security measures implemented by our subcontractors, such as ISO 27001 certification or data encryption.
- We have also kept all of our subcontractors' technical white papers detailing these technical measures.
8. Privacy by Design
The iAdvize solution has been developed using a "Privacy By Design" approach, which ensures the compliance of Personal Data processing. This involves adapting appropriate organizational and technical measures to guarantee the protection of privacy and fundamental freedoms, right from the project design stage and by default.
By way of example, the iAdvize Solution includes advanced confidentiality functionalities that notably enable :
- hide form fields in the Advisor console that the customer considers sensitive (e.g. credit card number in a payment area of the customer's site) by adding the code "idz_hide" to the field in question
OR
- deactivate the mirroring function (allowing the Advisor to view the content of the page the Visitor is visiting)
activate the visitor's consent directly from the chat window.
It is up to the customer, as data controller, to decide whether or not to activate these security features. These features are described in the technical implementation documentation for the iAdvize Solution and in the iAdvize knowledge base to which the Customer has access.
9. Data Processing Agreement
iAdvize contracts include a Data Processing Agreement (DPA) as an appendix. When you work with suppliers who will process personal data (of customers, prospects, employees, etc.) in the course of providing services, it is mandatory to enter into a DPA.
In the context of the GDPR, the implications are as follows:
-
You, as a Customer, are responsible for the processing (the data controller) of these data. In particular, you decide which data is processed, what you do with it and why you use it. The GDPR provides this role with a series of obligations and responsibilities;
-
In this context, iAdvize is the subcontractor (data processor) of this data. iAdvize processes your data solely on your behalf.
The GDPR requires all data managers and data processors to sign a DPA.
In addition to the fact that the DPA is required by law, the signature of this agreement is important for both parties.
10. Functionality Request of consent
11. Chat preview - Mirroring - Co-browsing
This is the feature that allows an Agent to preview and thus anticipate the question of the Visitor on the Brand's website. This feature is only activated when the Visitor expressly agrees to chat with the Agent.
This is the feature that allows the Agent, when chatting with a Visitor, to view the page he is browsing in the background of his desktop.
The Visitor's consent to Mirroring is linked to the GDPR consent (when the consent feature is enabled): Thus, when the Visitor gives his consent to chat, he gives his consent to mirroring at the same time.
iAdvize collects proof of the Visitor's consent and can provide it upon request.
This is the feature that allows the Agent, when chatting with a Visitor, to take control of the Visitor's navigation to guide him through the site.
The Agent can ask the Visitor to take control of his navigation. This request is displayed in the discussion thread of the dialogue window on the Visitor's side and is the subject of a specific consent form. The Visitor can thus accept or refuse the request to take control of his navigation.