GDPR Chatbot Data Transfers Outside the EEA: Map Your Shop’s Chat Data

To check whether customer chat data from your EU-facing shop is accessed or processed outside the EEA, follow a conversation through the services that touch it. Then match each connection to current documentation. An EU hosting statement is useful, but it does not, on its own, establish where AI processing, backups or remote support access take place.

Start with the conversation you need to trace

Choose a delivery question that turns into an order-status lookup and then an agent handover. It exposes routes a simple FAQ answer would miss. Use a test conversation where possible, and inspect the data actually displayed or returned rather than assuming every available field is used.

1. Delivery question: Note what the customer enters before any prompt. “Where is my parcel? My email is…” already contains a customer identifier.
2. Order lookup: Note the identifiers requested, the fields sent to the shop and the fields returned. For a Shopify or WooCommerce shop, distinguish a lookup using an email address from one using an order number and email address. Record whether the response includes status, payment or shipping details, a carrier, tracking link or order items.
3. Handover: Inspect what the agent sees: transcript, email address, order context and notes. Check whether an email notification contains the conversation and where that email goes.

AI disclosure is a different question. The EU AI Act chatbot disclosure for online stores covers telling customers when they interact with AI. That notice neither identifies processing locations nor acts as a data-transfer safeguard.

Draw the chat data flow before reading location claims

Open your shop’s actual settings. Mark a route as enabled, disabled or unknown: a feature offered by a provider is not necessarily active in your shop. Draw separate arrows for the customer’s message, an AI request, an order lookup and its response, and an agent notification. For each arrow, identify the sending service, recipient, data fields, processing and storage locations, and locations from which people may access the data. Write “not documented” where you lack evidence.

As a worked trace, suppose a customer enters an email address and asks about delivery. Your configured lookup sends that email address to your shop; the shop returns shipping status and a tracking link; an agent then receives the transcript. Your evidence question is not simply “Where is chat hosted?” It is also whether the AI service received the email, whether the lookup response was retained in chat, and whether a notification reproduced the transcript. These are example fields to verify, not claims about every shop’s configuration.

For askVela, order and customer context in chat illustrates why the transcript alone may be incomplete. Its Shopify order lookup uses the Shopify Admin API; its WooCommerce lookup uses a WordPress plugin. Depending on the shop’s settings, lookup uses an email address or an order number and email address. The answer may include order, payment and shipping details where the shop supplies them. Record what your shop actually returns.

Find location and access evidence in provider documents

Collect the data processing agreement (DPA), subprocessor list, hosting description, AI-specific terms and support-access terms. Save the title, version or date, section and exact passage supporting each entry. If a statement covers the platform generally but not the AI feature you enabled, mark that limit. A data-centre location and a person’s remote-access location answer different questions.

Route	What to establish	Evidence to request if unclear
Chat hosting	Where transcripts and linked customer records are processed and stored	Product-specific hosting statement and relevant DPA section
AI processing	Which service receives prompts, context and outputs; where it processes and stores them	AI terms, applicable subprocessor entry and field-level description
Subprocessors	Which listed services actually touch your enabled routes, their roles and countries	Current list and clarification of “global” or conditional entries
Support access	Whether provider or subprocessor staff can view records remotely, and from where	Access arrangements specifying roles, permitted locations and circumstances
Backups and recovery	Where copies are held and who can access them	Location and access statement covering chat and AI-related records
Email notifications	Which conversation fields enter email, if notifications are enabled	Notification-content description; your own email-service configuration

A subprocessor on a general list does not prove it handles your shop’s conversations. Ask which enabled feature invokes it. Equally, an EEA data centre does not rule out access by authorised personnel elsewhere. The chatbot data processing agreement checklist can help organise your contract review; keep the feature-level flow map beside it.

Classify each step without guessing

Apply one provisional evidence label to each arrow, not to the provider as a whole:

• EEA-only documented: Current, relevant passages support EEA processing, storage and access locations for every recipient involved in this step. Cite them; a missing access location prevents this label.
• Potential third-country access: Documentation describes possible access or processing outside the EEA, but does not establish whether your configuration uses that route. State the condition you need clarified.
• Confirmed transfer: Documentation or a provider reply establishes that personal data on this route is made available or processed outside the EEA. Record the recipient, country, fields and circumstances; this label is not a legal verdict.
• Unresolved: The documents do not clearly identify a recipient, location or access arrangement. Write the unanswered question beside the arrow.

These labels describe evidence, not compliance. Do not assume that processing outside the EEA is unlawful, that every international connection is a restricted transfer, or that an adequacy decision or standard contractual clauses automatically settle a particular route.

Ask the provider for the missing transfer details

Send the provider your enabled features and confirmed fields. “Are you GDPR compliant?” cannot resolve whether a particular AI request or support-access route applies to your shop. Ask for route-specific answers instead.

Apply the same request to askVela. It describes its service as EU-hosted, and askVela’s security and privacy controls provide a starting point. Neither statement alone documents every AI-processing, backup, subprocessor or remote-access route. Request those details rather than assuming a particular AI region or the absence of transfers.

Give your privacy adviser a reviewable handoff

Send a bounded question: which identified routes need transfer assessment, and what evidence is still missing? Separate confirmed document passages from provider answers and your own observations.

When a provider reply resolves a gap, update that arrow and its evidence label before sending the map for review. The aim is a traceable account of which customer and order details reach each service, where they can be accessed, and which questions remain for your adviser—not a blanket “EU-only” verdict.