GDPR & Data Processing

When you process personal data of your customers through Xyra Chat, you are the data controller and Mll Nexus Group SL acts as your data processor. Our DPA sets out the scope, purpose, and safeguards of that processing, incorporates Standard Contractual Clauses for any non-EU transfers, and forms part of our Terms.

Request our DPA (PDF) and we'll send the current version straight over.

The subprocessors that may process personal data, and where they operate:

Customer data is stored in the EU; non-EU transfers are covered by SCCs.

To make an access, rectification, erasure, portability, restriction, or objection request, email privacy@xyrachat.com with:

• the email address associated with the account;
• the type of request; and
• any details that help us locate the relevant data.

We respond within one month, as required by the GDPR. If we act as a processor on behalf of one of our customers, we will route your request to the relevant controller.

In the event of a personal-data breach, we will notify the competent supervisory authority within 72 hours of becoming aware of it where required, and we will inform affected customers without undue delay, along with the steps we are taking to mitigate it.

For data-protection matters, contact privacy@xyrachat.com. See also our Privacy Policy and Security page.