TL;DR

GDPR compliance is the practice of collecting, storing, and using EU visitors' personal data lawfully and transparently, with a clear legal basis, minimal data, and respect for their rights.

Key Points

✓

GDPR applies to any organization that processes the personal data of people in the EU/EEA, regardless of where the company itself is based [1].

✓

Almost everything a [[live-chat-widget]] captures is personal data: a visitor's name, email from a [[pre-chat-form]], plus the IP address and [[ip-geolocation]] gathered during [[visitor-tracking]] [4].

✓

You need a lawful basis to process that data, and consent (where used) must be freely given, specific, informed, and unambiguous, with no pre-ticked boxes [1].

✓

Article 5 sets seven principles: lawfulness/fairness/transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability [2].

✓

Data subjects can request access to, correction of, or erasure of their data, so a [[chat-transcript]] and [[contact]] record must be findable and deletable on request [1].

✓

When a [[live-chat]] vendor processes data on your behalf they act as a processor while you remain the controller, which makes vendor security and hosting choices part of your compliance [4].

What counts as personal data in chat

GDPR defines personal data broadly as any information relating to an identified or identifiable person ^[3]. In a Conversation that pulls in far more than people expect: the message text itself, a name and email from an optional Pre-Chat Form, and the context a widget captures on the first Chat Message such as page URL, user agent, device, IP address, and IP Geolocation. Marketing context like UTM Parameters attached to a Website Visitor record also qualifies. Because online identifiers and location data are explicitly named in the regulation ^[3], the data minimization principle matters: collect only what you actually need to answer the visitor, and avoid storing fields you will never use.

Lawful basis, consent, and transparency

Every processing activity needs a lawful basis. Many support tools rely on legitimate interest when a visitor starts the chat themselves, but reusing transcripts for marketing, profiling, or analytics usually demands explicit consent ^[1]. Where consent is the basis, it must be freely given, specific, informed, and unambiguous, and visitors must be able to withdraw it as easily as they gave it ^[1]. Practically, that means a privacy policy linked from the Chat Launcher or Welcome Message explaining what you collect and why, honest Lead Capture forms, and no pre-checked boxes. The transparency principle in Article 5 reinforces this: people should understand how their data is handled before they type anything ^[2].

Storage, security, and vendor responsibility

GDPR's storage limitation principle says you keep identifiable data no longer than necessary, and the integrity and confidentiality principle requires appropriate security such as encryption ^[2]. For chat that means a retention policy for old conversations and a reliable way to delete a Contact on request. When you embed a third-party tool the vendor becomes a processor acting on your behalf, while you stay the controller responsible for demonstrating compliance ^[4]. Vet where your provider hosts data, whether transfers leave the EU, and what its Telegram Integration or other downstream channels do with message content, since forwarding a transcript to an external inbox is itself processing you must account for.

Sources & References

What is GDPR, the EU's new data protection law? - GDPR.eu ↗

Art. 5 GDPR - Principles relating to processing of personal data ↗

Art. 4 GDPR - Definitions ↗

GDPR compliance: a live chat checklist - WhosOn ↗

Last updated: June 25, 2026

Related Terms

Pre-Chat Form

A pre-chat form is a short form shown before a live chat starts that asks the visitor for a small amount of identifying information, typically their name and email. In Eloqra it is the optional collectVisitorInfo step that gates the chat input until the visitor submits their details.

Visitor Tracking

Visitor tracking is the practice of collecting context about the people browsing a website, such as the pages they view, their device and browser, where they came from, and an approximate location. In Eloqra this context is captured on a visitor's first chat message and shown to the operator answering in Telegram.

IP Geolocation

IP geolocation is the practice of estimating a device's approximate physical location (country, region, city) by looking up its public IP address in a database that maps IP ranges to places. In Eloqra it runs server-side on the first visitor message to attach location context to a conversation.

Chat Transcript

A chat transcript is the complete, timestamped written record of a live-chat conversation between a website visitor and a support operator or chatbot. It captures every message in sequence, usually alongside metadata about the session, and can be archived, exported, or emailed for later reference.

Contact

A contact is the stored record of an individual person a business has interacted with - typically holding identity details like name and email plus the history of conversations and activity tied to them. In live chat and support tools, a contact is created or enriched the moment a visitor starts talking, turning an anonymous browser into a known, addressable person.

Live Chat Widget

A live chat widget is the embeddable, in-browser chat interface a website loads from a small script so visitors can message a business in real time without leaving the page. In Eloqra it is a floating launcher and chat panel that boots from a single <script> tag and renders inside a Shadow DOM.

Collect testimonials that build trust

Eloqra gives you a lightweight live chat widget that routes every visitor message to your Telegram — free while in early access.

Get Started Free

GDPR Compliance