GDPR Compliance

Last updated: 17 August 2026

We are a growing company and are honest about where we are on this journey. This page reflects our current status, updated as we complete each step — it's not a claim of full compliance.

Our role

When you use Sarwora's chatbot on your website, we act as a data processor on your behalf — you (our client) remain the data controller for your visitors' data. We process it only on your instructions, under a signed Data Processing Agreement.

Where things stand

Item	Status
Data Processing Agreement (available on request)	Available
Sub-processor disclosure	Available
UK Article 27 representative	In progress
Formal solicitor review of documents	In progress

Our sub-processors

Sub-processor	Purpose	Location
OpenAI, L.L.C.	Generating AI chat responses	United States
Our hosting provider	Application hosting and data storage	India

Security measures in place

HTTPS encryption for all data in transit
Access to stored data restricted to the application and named administrators
Each client's data is logically separated by a tenant identifier

Data subject rights

If your website visitors want to access, correct, or delete data collected through our chatbot, please contact us at hello@sarwora.com and we'll assist within the timelines required by UK GDPR.

Want our DPA?

Email hello@sarwora.com and we'll send our standard Data Processing Agreement for review.