Data processing agreement
Article 28 GDPR · Last updated: 7 October 2026
This agreement is part of the terms and applies to every Parla customer, with no further formality. A signed copy can be requested from contact@askparla.com. It is a translation of the French version, which prevails if the two differ.
1. The parties
The controller is the customer: the merchant who installs Parla on their shop. The processor is Parla, published by Abdellah Hmache, sole trader (entrepreneur individuel, EI), 23 rue Olympe de Gouges, 92600 Asnières-sur-Seine, France (SIREN 105 820 757).
2. Subject, duration, nature and purpose
Parla processes personal data for one purpose only: answering, on the customer's behalf, the visitors to their shop, in writing or by voice, recommending products, filling the cart, tracking and changing orders within the limits the customer sets, handing a request over to their team, and telling a visitor who asked when a product is back. Processing lasts for the term of the contract.
3. Data and data subjects
The data subjects are the visitors and customers of the customer's shop. The data is:
- the text of written messages, and the audio during a voice call;
- a random conversation identifier, the page being viewed, the browser language;
- the order number and email entered to check an order, and that order's details;
- the delivery address, when the visitor asks to change it;
- for a handover: the request, the visitor's email and, where relevant, the order number;
- the email address left to be told when a product is back or an item arrives;
- if the customer turns them on, conversation transcripts.
This data is kept at most:
| Data | Period |
|---|---|
| Conversations (message text, page context) | 24 hours |
| Handovers to the merchant's team (request, email, order number) | 30 days |
| "Let me know" emails: back in stock, item not sold yet | until the message is sent, 120 days at most |
| Transcripts, only if the merchant turns them on | 14 days, last 50 conversations |
| Audio of a voice call | not stored: processed live, during the call |
Parla processes no special categories of data within the meaning of article 9 GDPR and asks the customer not to entrust it with any.
4. The customer's instructions
Parla processes the data only on the customer's documented instructions: these terms and the settings the customer chooses in their plugin, their Shopify app or their account, including for the transfers outside the EU described in article 7. Parla never uses the data for its own purposes or to train an AI model. If an instruction seems to infringe the GDPR, Parla tells the customer immediately.
5. Confidentiality and security
Only the people who need it to run the service access the data, and they are bound to confidentiality. The security measures applied, within the meaning of article 32 GDPR, include:
- encryption of all traffic (HTTPS);
- short retention periods, applied automatically (article 3);
- postal addresses masked before being sent to the AI model;
- IP addresses never stored in clear, only hashed with a server-specific salt;
- access to an order only after checking the end customer's order number and email;
- access tokens, conversations and visitors' email addresses encrypted at rest (AES-256-GCM), backups encrypted and kept away from the main server;
- password-protected administration, limited to those who need it.
6. Sub-processors
The customer authorises Parla to use the sub-processors listed in section 3 of the privacy policy, each bound by a contract imposing the same obligations as this one. Parla tells the customer by email at least 30 days before adding or replacing a sub-processor; a customer who objects may terminate free of charge before that date. Parla remains liable to the customer for its sub-processors' failures.
7. Transfers outside the European Union
Where data is processed outside the European Union, the transfer relies on the standard contractual clauses adopted by the European Commission. Each sub-processor's location is in the privacy policy.
8. Data subjects' rights
Parla helps the customer answer requests for access, rectification, erasure, restriction, objection and portability. A request received directly by Parla is passed to the customer without undue delay. For a Shopify shop, Parla also handles the data and erasure requests Shopify forwards on the customer's behalf.
9. Personal data breach
Parla notifies the customer of any breach affecting their data without undue delay after becoming aware of it, with the information available, so the customer can, where required, notify the supervisory authority within 72 hours and inform the people concerned.
10. Assistance and audit
Parla helps the customer, as far as it knows, with a data protection impact assessment or a prior consultation. It provides the information needed to show compliance with this agreement and answers a security questionnaire. An audit may be carried out once a year, with 30 days' notice, by the customer or an auditor bound to confidentiality, at the customer's expense.
11. End of the contract
When the contract ends, Parla deletes the data processed on the customer's behalf within 30 days, unless the law requires it to be kept. An export can be requested during that time.