The moment a visitor types "Hi, I'm Sarah, my flat is at 14 Mill Lane and the boiler's leaking", your website assistant is holding personal data. Name, address, a problem at their home. Under UK GDPR and EU GDPR, that transcript is now your responsibility in exactly the same way an enquiry email would be.
Most small businesses already handle this kind of data through contact forms and inboxes without much thought. A GDPR chatbot setup is not wildly different, but chat has a few quirks: people type more than a form asks for, conversations are stored by default, and there is a third-party service in the middle.
This checklist is practical guidance, not legal advice. Your obligations depend on where you operate, what you do and who your customers are, so confirm the details with the Information Commissioner's Office guidance or your own adviser.
Before you switch it on
Work through these before the assistant goes live. None take long, and doing them first is much easier than retrofitting.
- Map what it collects. List every piece of data the assistant might hold: transcript text, names, emails, phone numbers, addresses, ticket details, anything sent on by webhook.
- Decide what it asks for. Only configure lead capture to request what your follow-up needs. A callback needs a name and a number.
- Pick a lawful basis for each purpose. Handling the enquiry a visitor started and sending them marketing are separate purposes.
- Check where webhooks send data. If leads flow to a CRM, Slack or a spreadsheet through Zapier or Make, those tools are part of the data flow too.
- Set a retention window. Decide how long transcripts are kept before you have any.
- Update your privacy notice. Add the assistant, its purpose and the retention period.
- Record it. Add the assistant to your record of processing, however simple that record is.
Lawful basis in plain terms
For most enquiry handling, businesses tend to rely on legitimate interests (replying to someone who asked you a question) or steps taken at the person's request before a contract (preparing a quote they asked for). You are not usually asking for consent to answer a question someone chose to ask.
Marketing is different. If you want to add chat leads to a newsletter or a promotional sequence, you generally need a separate, clear opt-in. Do not bundle it into the lead capture message. "Can I take your email so the team can send your quote?" is fine. Quietly adding that email to a monthly promotional list is not.
Keep a short note of the basis you chose and why. If anyone ever asks, that note is the thing you will be glad exists.
Retention: pick a number and write it down
Transcripts are useful for training, quality checks and resolving disputes. They are not useful forever. Conversation retention windows are configurable, so choose one on purpose.
| Type of business | Example retention thinking | Possible window |
|---|---|---|
| Trades and home services | Enquiries become jobs within weeks; disputes rarely surface after a year | 6 to 12 months |
| Retail and ecommerce | Returns and warranty questions are the long tail | 12 months |
| Clinics and care | Chat should not hold clinical detail; enquiries move into proper records | Short, with clinical data kept out of chat |
| Professional services | Engagement records are kept elsewhere under their own rules | 3 to 6 months for chat itself |
These are illustrations, not recommendations. The point is to tie the window to a real reason. Once a lead or ticket has moved into your CRM or practice system, that system's retention rules apply to the copy there. Our guide to chat transcript retention goes into the trade-offs.
What to tell visitors
Your privacy notice should cover the assistant in plain words. At minimum:
- What it collects. The conversation, and any contact details the visitor chooses to give.
- Why. To answer questions, follow up on enquiries and handle support requests.
- Who processes it. That a third-party provider hosts the assistant, and any tools you pass leads on to.
- How long it is kept. The retention window you set.
- Their rights. How to ask for a copy, a correction or deletion.
A short line near the chat, such as "Chats are stored to help us reply. See our privacy notice.", with a link, sets expectations without a pop-up wall. Being upfront that visitors are talking to an assistant matters too; see telling customers the receptionist is AI.
Access and deletion requests
Sooner or later someone will ask what you hold about them. Work out the answer before it happens.
Know where to look: the conversations list, the leads list, the ticket inbox, and every downstream tool your webhooks feed. A request for deletion needs to reach all of them, not just the chat history. Write a short internal procedure naming who handles requests and where they check. The statutory deadline for responding is generally one month, so do not let requests sit in someone's inbox.
Questions for your vendor
Whichever assistant you use, ask these and keep the answers:
- Where is conversation data stored and processed? Including any AI model provider involved.
- Which subprocessors see conversation content?
- What security is in place? For SpideyChat, data is encrypted in transit, stored credentials are encrypted at rest, and each account's data is isolated. It does not hold SOC 2 or ISO 27001 certification, so do not list either in your records.
- Can retention be configured, and can individual records be deleted?
- What are the data processing terms?
Our post on security basics when embedding an assistant covers the technical side, and the docs describe the settings.
What to do this afternoon
Take the seven-item list at the top and give each line an owner and a date. Most businesses can finish it in an afternoon: map the data, choose the basis, set retention, add a paragraph to the privacy notice and write the access request procedure.
Then tell the assistant not to invite information it does not need. If people start typing card numbers or medical detail into chat, that is a separate problem with its own fix, covered in keeping sensitive information out of chat.