EPAV DESK · PRIVACY NOTICE TEMPLATE FOR CUSTOMERS

Version 1.0 · Effective from 9 October 2026

This is Annex 4 of the EPAV Desk Data Processing Agreement. It gives text that a company using EPAV Desk can adapt and add to its own privacy notice, so that the people who contact it know how their data is processed.

How to use it. Replace everything in [square brackets], delete what does not apply to your setup, and check the result against how you actually use EPAV Desk: which channels you connect, whether the AI assistant answers, which AI provider it uses, and how long you keep conversations. Link your privacy notice from your website footer and, if you can, from the chat's greeting or pre-chat form. This template is provided for convenience and is not legal advice; you remain responsible for your privacy notice.

Customer support and chat

When you contact us through the chat on our website [or in our app], by email [, Telegram or WhatsApp], we use EPAV Desk, a customer support service provided by NeriusCognitaren OÜ (registry code 17503018, Sepapaja tn 6, 15551 Tallinn, Estonia). EPAV processes your data only on our behalf and on our instructions, under a data processing agreement. We remain responsible for your data.

What we process

• what you write and send to us: messages, files, images and voice messages, and their transcripts;
• the contact details you give us, such as your name, email address or phone number [and the details our pre-chat form asks for];
• [if visitors sign in through your website or app: your user ID and the details of your account with us that our website passes to the chat];
• technical data: your IP address, browser type and language, recorded when a chat conversation starts, and the last pages of our website you visited, kept for 24 hours so that our staff can understand your question.

Why, and on what basis. We use this data to answer your questions and provide our support, on the basis of our legitimate interest in helping the people who contact us (Article 6(1)(f) GDPR), or to perform or prepare a contract with you (Article 6(1)(b)). [If you use proactive messages: and to show you messages on our website, on the basis of [your consent / our legitimate interest].]

AI assistant. [Keep this paragraph if the AI assistant answers.] Our chat is answered first by an AI assistant. It tells you so in its first message [delete on the AI chat plan: , and you can ask for a human at any time]. [If the assistant answers email: replies to your emails may also be written by the AI assistant.] It answers from our own knowledge base. To produce an answer, your messages and the relevant parts of our knowledge base are processed by AI models: [if you use the cloud AI of your EPAV Desk plan: through EPAV's AI gateway by OpenRouter and the model hosts it uses, and by Voyage AI; images you send are described by a model of Alibaba Cloud] [if you use your own AI provider: by [provider name]] [during a trial or as a backup: by EPAV's own model]. Your messages are not used to train these models [check this for your own AI provider]. The AI assistant does not make decisions about you with legal or similarly significant effects.

Who receives your data. Our support staff; EPAV and its sub-processors, which host the service and process AI requests and email for it, listed at https://epavdesk.com/legal/subprocessors; [Telegram / Meta (WhatsApp), when you write to us there, under their own terms]; and authorities where the law requires.

Transfers outside the EEA. The service runs in the EU (Amsterdam, the Netherlands), on infrastructure of a US company. Some of EPAV's sub-processors, in particular for AI processing, are in the United States and other countries outside the European Economic Area. Transfers rely on adequacy decisions of the European Commission, including the EU-U.S. Data Privacy Framework, or on the Commission's Standard Contractual Clauses, as listed by EPAV.

How long we keep it. We keep conversations and contact details for [period, for example 24 months after the last message], unless the law requires us to keep them longer. [Describe how you delete them, for example: we review and delete older contacts and their conversations regularly.]

Cookies. The chat stores cookies and local storage in your browser so that your conversation continues across pages and visits, and to decide when to show our messages. They are listed in [our cookie policy / EPAV's Cookie Policy at https://epavdesk.com/legal/cookies].

Please do not send payment card numbers, passwords or health information in the chat.

Your rights. You can ask us for access to your data, its correction or deletion, restriction of processing, a portable copy, and you can object to processing based on our legitimate interest. Write to [your privacy contact]. If EPAV receives such a request, it passes it on to us. You can also complain to a supervisory authority: [our supervisory authority, for example in Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon)], or the authority in the EU country where you live or work.