GDPR at a glance
| Question | Answer |
|---|---|
| Who processes your data | Quality Unit, s.r.o., Vajnorská 100/A, 831 04 Bratislava, Slovakia (EU), the company that develops and runs LiveAgent. It is your processor; your company stays the controller. |
| Where your data is hosted | Amazon Web Services. Europe & Africa (EU): Germany (Frankfurt) and Ireland. Americas (US): Northern Virginia and Northern California. Asia & Pacific (SG): Singapore. |
| Data processing agreement | A template for each region. You sign, we countersign. How to sign it |
| Data breach notice | Within 36 hours of us or a subprocessor becoming aware of it |
| New subprocessors | Written notice in advance; you have 10 days to object |
| Deletion on request | Within 5 business days of your written request |
| Transfers outside the EEA | Under the EU Standard Contractual Clauses with each subprocessor outside the EEA (list); older data stored in the UK (London) is covered by the EU adequacy decision for the UK |
| Encryption | All data encrypted at rest; every connection over HTTPS |
| AI features | Off until your company connects its own AI provider |
| GDPR questions | Our Data Protection Officer: gdpr@qualityunit.com |
The 36 hours, the 10 days and the 5 business days are commitments in our DPA, not only promises on this page.
Sign the DPA
The GDPR (Article 28) requires a written agreement with every processor of your customers’ data, and LiveAgent is one. In Germany it is called an AVV (Auftragsverarbeitungsvertrag). Signing ours takes three steps:
- Download the template for the region your account is hosted in:
- DPA for Europe & Africa (EU) accounts (DOCX), hosted in Germany and Ireland
- DPA for Americas (US) accounts (DOCX), hosted in Northern Virginia and Northern California
- DPA for Asia & Pacific (SG) accounts (DOCX), hosted in Singapore
- Fill in your company’s name and address and sign it.
- Email it to gdpr@qualityunit.com. We countersign it and send it back.
If your company uses its own DPA template, send that instead and we will review it. For the current list of subprocessors, the DPA refers to our subprocessors page. The DPA describes what we process (names, email addresses, IP addresses, cookies, logs and whatever your team and customers write in tickets and chats), the security measures we keep and the subprocessors we use, and it is governed by Slovak law.
Where your data is stored
LiveAgent runs on Amazon Web Services (AWS). You choose your account’s region when you sign up, usually the one where your company is located, and its data stays in that region. Within a region, data can move between AWS data centers in that region to keep the service fast and available, so the data of EU accounts stays in Germany and Ireland.
| Your account | Where your data is stored |
|---|---|
| Europe & Africa (EU) | Germany (Frankfurt) and Ireland |
| Americas (US) | Northern Virginia and Northern California, USA |
| Asia & Pacific (SG) | Singapore |
Customers in the United Kingdom choose Europe & Africa (EU) or Americas (US). Older data of some UK customers’ accounts is still stored on AWS in London (UK); no new accounts are hosted there. The EU recognises the UK as protecting personal data adequately (its adequacy decision runs until December 2031), and the UK recognises the EU, so no extra transfer safeguard is needed. For the transfer terms that apply to UK customers’ data, email gdpr@qualityunit.com.
On the trial form, pick it in the Region field: Americas (US), Europe & Africa (EU) or Asia & Pacific (SG). It is preselected from your country. You can’t switch the region yourself later; moving an account to another region needs an agreement with us. The full list of companies that host or can access your data is on our subprocessors page.
Who can access your data
Our team opens your account only when you ask for help or approve it, for example when your admin asks our support team to check a setting. The people who can do so work for Quality Unit and its subcontractors listed on the subprocessors page, under contracts that bind them to confidentiality and to our security rules. Access is limited to those who need it, with a personal login and 2-step verification.
Before we add or replace a subprocessor, we tell you in writing. If you object on reasonable grounds within 10 days, we look for a way to provide the service without it; if there is none within 30 days, you can end the affected service.
GDPR and live chat: what you need to do
When a visitor chats with your team, your company is the controller of what they write, and LiveAgent processes it for you. To use live chat in line with the GDPR:
- Sign the DPA with us (above).
- Tell visitors in your privacy policy that you use LiveAgent to answer chats and emails, and link to it from the chat window.
- Ask for consent where you need it. Add a consent checkbox to the pre-chat form, for example for sending a chat transcript or for marketing.
- Collect only what you need. The pre-chat form fields are yours to choose; you don’t have to ask for a phone number or address.
- Keep card numbers out of your inbox. Set up Search & Replace rules and LiveAgent masks card numbers and other sensitive strings in incoming messages before they are stored.
What the chat widget stores in your visitors’ browsers. When a page with your LiveAgent chat button loads, the widget sets three first-party cookies on your domain:
| Cookie | What it does | How long it stays |
|---|---|---|
| LaVisitorId_… | A random visitor ID, so your agents see one visitor across pages | Until the browser closes |
| LaSID | Marks the current visit | Until the browser closes |
| LaVisitorNew | Marks a new visitor | 1 day |
5 more cookies, set only when the visitor does something
| Cookie | Set when | What it does | How long it stays |
|---|---|---|---|
| LaRunningChat_… | A chat starts | Keeps the running chat open across pages | Until the chat ends or the browser closes |
| V_la_sid | A chat starts | Keeps the chat session. LiveAgent sets it on your LiveAgent account’s domain (for example yourcompany.ladesk.com), not on your website’s domain | Until the browser closes |
| closedInvitations | The visitor closes a chat invitation | Doesn’t show that invitation again | Until the browser closes |
| closedBubbleButtons | The visitor closes a chat bubble | Doesn’t show that bubble again | 60 days |
| LaUserDetails | Your site passes the visitor’s name or email to the widget | Fills in the chat form | Until the browser closes |
The widget stores nothing in local storage on your site and loads nothing from Google or other companies, only from LiveAgent’s servers. LiveAgent has no built-in consent switch: if your cookie banner must cover these cookies, load the LiveAgent code only after the visitor agrees, for example through your consent tool or tag manager.
Handling your customers’ GDPR requests
When a customer asks what you know about them, or asks you to delete it, your agents can answer from LiveAgent:
| Request | How to handle it in LiveAgent |
|---|---|
| Access (“what data do you have about me?”) | Open the contact to see their details and every ticket, chat and call. Export their tickets as PDF, HTML or CSV. |
| Correction | Edit the contact’s details. |
| Erasure (“delete my data”) | Delete the contact and their tickets, then delete the tickets permanently. The contact’s identity, sessions and tokens are removed with it. |
| Customer portal users | Customers can delete their own customer portal profile. |
| Agents who leave | Admins delete the agent’s profile under Configuration > Agents. |
People who contacted your business through Facebook, Messenger, Instagram or WhatsApp can also ask us directly; our privacy policy says how we pass such requests on to you.
AI features and your data
LiveAgent’s AI features, such as AI Answer Assistant, use the AI provider your company connects with its own API key: OpenAI, Anthropic, Google (Gemini) or FlowHunt. So:
- Nothing goes to an AI provider by default. Ticket or chat text reaches a provider only after your admin connects it and turns a feature on.
- You choose the provider and its terms. It processes the text under your company’s agreement with it, including whether it keeps the text or uses it for training. That is why AI providers are not on our subprocessor list.
- You can switch it off at any time by disconnecting the provider.
- FlowHunt is made by Quality Unit too, but it is a separate service: your company signs up for it under its own terms, and it gets data only if you connect your FlowHunt account.
What the assistant sends and keeps is described on the AI Answer Assistant page.
How long we keep your data
We keep your data while you use LiveAgent, or until you ask us to delete it. Our DPA commits us to delete it, or return it if you prefer, within 5 business days of your written request. Accounts that stop being used are removed automatically:
| Step | When |
|---|---|
| Account suspended: nobody can log in or open its data | When a trial ends without an upgrade, or after 7 days of failed payment |
| Account terminated: its address stops working | 60 days after suspension, unless you ask us to reactivate it |
| Data deleted from the LiveAgent cloud | Within 30 days after termination |
| Last backup expires | 30 days after that |
In total, nothing from an unused account is left at most 120 days after it was suspended.
Retention periods for other data, such as data about visitors to our website, are in our Privacy Policy.
How we protect your data
- Encryption at rest: all data in your account is encrypted where it is stored, backups included.
- Encryption in transit: every account runs over HTTPS, chats and emails included.
- Logins: passwords are stored as salted hashes. Every agent can turn on 2-step verification.
- Restricted access: you can limit logins to your company’s IP addresses, and the API accepts only users with a valid API key.
- Testing: we run external and internal vulnerability scans, penetration tests by professional testers and security audits by specialised companies.
- Data centers: AWS facilities with round-the-clock security staff, CCTV, multi-factor access control and backup power.
- Certifications: the AWS data centers are certified to ISO 27001 and audited for SOC 1 and SOC 2; LiveAgent itself holds no SOC 2 or ISO 27001 certification yet. Quality Unit is undergoing a SOC 2 Type II audit that covers all its services, LiveAgent included. For its status, a security questionnaire or a summary of our latest penetration test, email gdpr@qualityunit.com.
More on our security page and in the help desk security overview.
Cookies and tracking on our website
How we collect and process data on liveagent.com through server-side tracking, cookies and advertising technology, including Google Consent Mode v2 and enhanced conversions, is described in our Terms & Conditions and Privacy Policy.
Documents
- Subprocessors and subcontractors
- Security policy
- Privacy policy
- Terms & Conditions
- DPA templates: Europe & Africa (EU), Americas (US), Asia & Pacific (SG) (DOCX)
Questions about the GDPR or your DPA: gdpr@qualityunit.com. To see how LiveAgent handles your customers’ data in practice, try it free for 30 days, no credit card needed.