GDPR Compliant Helpdesk: What Buyers Should Actually Check
A GDPR compliant helpdesk is customer support software that lets you collect, store, and answer ticket and chat conversations containing personal data under GDPR rules, backed by a signed Data Processing Agreement (DPA), disclosed subprocessors, and operational controls for access, erasure, and security.
A compliance badge on a marketing page is not enough. Search results are full of vendor claims and "best tool" lists that skip the split that matters: where ticket data is stored versus where AI and email processors run. Privacy also ties to oversight. If an unsupervised system invents an answer or pushes personal data into an automated send, trust and compliance fail together. A safer pattern is simple: AI drafts; a human sends.
There There (there-there.app), the AI helpdesk, is a useful baseline for that honesty: customer data is hosted in the EU on UpCloud, while OpenAI in the United States handles draft generation under Standard Contractual Clauses (SCCs) and a DPA. This is a buyer guide, not a software roundup.
Key takeaways
- A GDPR compliant helpdesk is about contracts, configuration, and processor honesty, not a logo alone.
- Customer data hosting and third-party processing are separate: EU storage does not mean AI drafting runs in the EU.
- Before you buy, confirm a DPA, named subprocessors and transfer tools, and whether a human still sends replies.
What GDPR means for a helpdesk
Support tickets and chat threads hold names, emails, addresses, phone numbers, order history, and whatever else customers paste in without thinking.
In plain terms, your company is usually the controller. You decide why support data is collected and how it should be used. The helpdesk vendor is typically a processor that handles those records on your instructions.
That relationship shows up in everyday support work:
- Access: a customer can ask for the personal data you hold, including support history.
- Erasure: you need a clean way to delete or anonymize profiles and tickets when a valid request arrives.
- Portability: you need a reasonable export path for conversation context.
- Security: ticket contents should not leak to the wrong people, plugins, or unchecked integrations.
- Breach awareness: if support data is involved in an incident, the processor and controller need a clear reporting path.
You do not need a legal department to run a vendor check. You do need to know where marketing copy stops and operational reality begins. This is not legal advice; it is a practical buying filter.
Hosting vs processing (the split buyers miss)
The common trap is treating one location label as the whole story. An EU flag on a pricing page does not mean every byte stays in Europe forever.
Customer data hosting
Hosting is where the helpdesk keeps core records: profiles, open tickets, archives, and internal notes.
When a vendor says customer data is hosted in the EU, primary databases and main backups sit in Europe. There There hosts customer data on EU infrastructure via UpCloud.
AI and email processors
Draft assistance and outbound email often send message text to specialized providers.
AI drafting and summarization may run on US infrastructure. Transactional email may do the same. When a desk uses OpenAI for drafts or Postmark for delivery, that is an international transfer. It can still be lawful under GDPR when SCCs and DPAs are in place, but it is not "EU-only processing."
Why "EU hosted" is not the whole story
EU hosting answers where the customer table lives. It does not answer what happens when an agent generates an AI draft. Ask both questions: where the database lives, and which subprocessors touch the text when AI or email features run. No buyer should be told data never leaves the EU if external LLM APIs are called across borders.
Checklist: evaluating a GDPR compliant helpdesk
Look past badges. Check whether the product can support your obligations in daily use:
- A signed DPA that defines roles and technical measures
- A subprocessor list with regions (or an easy way to get one)
- SCCs (or equivalent) for non-EU processors
- Practical processes for access, export, and deletion of profiles and tickets
- Role-based access controls and encryption in transit and at rest
- Clear docs on what ticket context goes to the LLM, and the option to leave AI off
- Human review before send, not unsupervised bot replies
If you are mapping how AI fits a modern desk, read AI helpdesk. If you are still shopping broadly, shortlist tools first, but verify hosting and processors before you trust any comparison table.
What to ask vendors
Paperwork
- Will you sign a DPA that covers GDPR processing for support data?
- Where is the subprocessor list, and how are changes announced?
- Which transfer tools (such as SCCs) cover non-EU processors?
- When was the privacy documentation last updated for AI and email partners?
Product behavior
- Where are primary customer databases hosted?
- Which provider generates AI drafts, and where are those requests processed?
- Can we turn AI off without breaking ticketing?
- How do we delete or anonymize a thread after a valid erasure request?
Agent and automation risk
Automations help with routing and context, but they can over-share if alerts or rules push personal data into the wrong channel. Keep rules tight; see helpdesk automation.
Ask whether macros or bots can send to customers without review. Unsupervised send increases the chance of wrong answers and awkward disclosures. Privacy and quality both hold up better when the product sticks to: AI drafts; a human sends.
How There There approaches GDPR and hosting
There There (there-there.app), the AI helpdesk, is built by Spatie, a software company in Antwerp, Belgium. The product is explicit about hosting boundaries and who sends the reply.
How data handling works:
- Customer data hosting: ticket and customer records live in the EU on UpCloud.
- AI drafting: draft generation and thread summarization use OpenAI in the United States under a DPA and SCCs.
- Outbound email: transactional delivery uses Postmark under SCCs and a DPA.
- Compliance posture: There There is GDPR compliant and signs DPAs. It does not claim EU-only AI processing, because external language models involve cross-border transfers.
Email channels and an embeddable chat widget share one workspace. The knowledge layer uses documentation, authored articles, and ticket history to draft replies and summarize threads.
There There is AI-assisted and human-led. AI drafts; a human sends. Agents review and edit drafts before anything goes out. AI features are optional. Slack notifications can include live ticket context; they are not two-way Slack replies.
Frequently asked questions
What is a GDPR compliant helpdesk?
Software that can support GDPR obligations for support data when contracted and configured honestly: DPA, subprocessors, rights handling, and security safeguards. A badge alone is not the definition.
Does EU hosting mean all processing stays in the EU?
No. Primary storage can sit in Europe while AI drafting or email delivery runs on US infrastructure. Ask vendors to separate hosting from subprocessors.
Is There There GDPR compliant?
Yes. There There is GDPR compliant and signs DPAs. Customer data is hosted in the EU via UpCloud. AI processing uses OpenAI (US) and email uses Postmark, with SCCs for those US processors. There There does not claim EU-only AI processing.
Do I need a DPA with my helpdesk vendor?
Usually yes when the vendor processes personal data for your support operation. Treat a signed DPA as a standard buying requirement. This is practical guidance, not legal advice for your specific case.
What should I ask about AI features?
Which provider handles prompts, what ticket content is sent, where processing runs, whether AI can be turned off, and whether a human still sends.
Are "best GDPR helpdesk software" lists enough?
No. Use them as leads, then verify DPA, hosting, and processors yourself. Start with evidence, then verify each shortlisted vendor yourself.
Does a human-in-the-loop AI helpdesk reduce privacy risk?
It reduces the risk of unreviewed wrong or over-sharing replies. You still need vendor paperwork and clear processor terms. The operating rule remains: AI drafts; a human sends.
