repliso
A customer's name, social handle, phone number and order question can be personal data. Moving the conversation into a shared inbox or using AI to draft an answer does not make that data stop being personal.
For GDPR customer messages in Germany, begin with a clear map of what you collect, why you need it, where it goes and who can access it. Do not begin with a promise that a particular messaging platform makes every workflow compliant.
Decide the purpose and legal basis
The GDPR allows processing only on one of six legal grounds: consent, contract, legal obligation, public interest, vital interests or legitimate interests. For a small shop the usual ones are contract (answering a question before a purchase or carrying out an order), consent (for example for a newsletter) and legitimate interests (for example fraud prevention), each only where it really fits. Data that the contract does not need cannot be demanded as a condition of the contract.
Write down the purpose and the legal basis for each activity, including support, analytics and marketing. Consent must be freely given, specific and informed, withdrawing it must be as easy as giving it, and you must be able to prove it. Sensitive data (health, religion, political opinions and similar) has extra conditions, and you should not collect it when you do not need it: a clothing order does not need the customer's religion. If customers send sensitive information unprompted, keep it to what is needed to help them and do not pass it on. Source: European Commission, legal grounds for processing.
Tell people what happens to their information
Your privacy information must say who is responsible and how to contact you, why you process the data and on which legal basis, how long you keep it, who receives it, and what rights people have, including the right to complain to a data protection authority. It must be concise, transparent and written in plain language. It should match the inbox and AI providers you really use, including transfers outside the EU.
When you collect data directly from the person, for example because they write to you, the information is due at the time of collection, unless they already have it. When the data comes from another source, tell them within one month, at the first contact or when you first pass the data on. Make the information easy to reach from the customer journey, for example with a link in your profile and your website. Source: European Commission, obligations.
Collect less and retain it for a reason
Request only details needed to resolve the issue. An order reference may be sufficient where a passport scan would be excessive. Do not collect card numbers through routine social chats.
Set retention periods by purpose. Order records with legal retention duties and a casual size question may need different handling. “Keep every chat forever” is not a useful policy. Equally, do not promise immediate deletion of everything when a legal obligation requires some records to remain. Source: European Commission, GDPR principles.
Check providers and access
A provider that handles customer messages on your behalf, such as an inbox tool, a hosting company or an AI service, is usually a processor. You then need a written processing agreement (Art. 28 GDPR) that binds it to your instructions and to security measures. The German federal data protection commissioner publishes a model agreement you can compare with. Look at subprocessors and at what happens to the data when the service ends. A vendor's marketing statement is not the same as a signed processing agreement. Source: BfDI processing-agreement model.
Limit staff access to what their work requires. Use individual accounts where supported, review access when someone leaves, and plan how requests for access, correction or deletion reach a responsible person.
Look beyond the server location
An EU-hosting label does not by itself settle all transfer questions. Check access from outside the EEA, support providers and onward transfers. Data may be sent to a country outside the EEA only on a valid basis: an adequacy decision of the European Commission (and you must check that it is still in force), or standard contractual clauses together with a documented assessment of the destination country's laws and any extra safeguards. Exceptions such as explicit consent are meant as a last resort. Source: EDPB, international transfers.
Keep support separate from advertising
An incoming customer question is not blanket permission for promotional follow-ups. German competition law treats advertising by e-mail without the recipient's prior express consent as an unreasonable nuisance (§ 7(2) no. 2 UWG). There is one narrow exception for existing customers, and it needs all four conditions: you received the address in connection with a sale, you advertise only your own similar products, the customer has not objected, and you told the customer clearly, when you collected the address and with every use, that they can object at any time (§ 7(3) UWG). A safe working rule for every channel: ask for explicit permission before sending promotions. WhatsApp's own policy also requires that people opted in. Source: § 7 UWG.
If something goes wrong
If customer data is lost, leaked or accessed by the wrong person and this is likely to put people at risk, you must notify your data protection authority within 72 hours after you became aware of it, and tell the affected people if the risk is high. A processor must report every breach to you. Decide in advance who does this. Source: European Commission, obligations.
Check your own setup
Before you rely on any tool, go through this list: which customer data you collect and why, the legal basis for each use, the privacy information customers can see, who your providers are and whether you have a processing agreement with each, where the data goes outside the EU, how long you keep it, how a request for access or deletion reaches you, and what you do in a breach.
How repliso handles data is described in its privacy policy; businesses that use repliso can ask for a data processing agreement. Use human handoff rules for sensitive cases.
About this article
This is general information based on the official sources linked above, checked on 13 October 2026. It is not advice for your individual situation, and rules change: EU lawmakers were still negotiating changes to the GDPR (the “Digital Omnibus” package) in October 2026, so check the current text of the rules that matter to you. Good service and careful privacy practice both begin with a clear owner and a clear purpose.
