javoPersonal data
A lead collected by your chat today can be kept until 25 September 2029
The CNIL’s guidance lets businesses keep prospect data for three years from collection or the prospect’s last contact. How to apply that to leads from a website chat.
Every contact your chat collects is personal data. The GDPR requires you to set a retention period, and the CNIL gives a clear benchmark for prospects.
The CNIL’s benchmark
In its guidance on managing commercial activities, the CNIL says prospect data can be kept for three years from collection or from the last contact coming from the prospect. It gives a click on a link in an email as an example of such contact. Its sanction decisions add that simply opening an email does not count.
What that means for a lead from your chat
| Situation | Keep until |
|---|---|
| Lead collected on 25 September 2026, no further contact | 25 September 2029 |
| The same lead replies to you on 10 March 2027 | 10 March 2030 |
| The lead becomes a client | Client-data rules apply |
Four good habits
- Date every lead when it arrives, and record the prospect’s last contact.
- Review once a year and delete leads older than three years without any contact from them.
- Keep the conversation only as long as needed: the chat transcript does not need to outlive the lead.
- Say it up front: tell visitors how long you keep their details, in the chat and in your privacy policy.
Sources
Javo answers your visitors, even out of hours.
Installed on your site with one line of code, from €600 per product.