Consent Notice (widget wording)

Version 2.0 - Effective 2026-07-08 - Change log Template document: review by a qualified data-protection lawyer or DPO before commercial reliance. Not legal advice.

This notice documents the consent wording the Whistle widget actually presents to visitors, in two tiers, and how each consent is recorded. The privacy policy linked in the widget is always the client's (the controller's) policy, configured per client.

Tier 1: early contact card (optional, skippable)

Shortly after the visitor's first message, a compact card may ask for a name and phone number "in case we get cut off". Submitting the form is the consent act: the visitor gives consent by the affirmative act of pressing "Share details", with this statement displayed directly above the button:

"By sharing these details you agree that [business] may store them and contact you about this enquiry, per the privacy policy. Stored securely in the EU."

The card is entirely skippable ("Skip for now"). If the visitor skips, no personal details are stored and the conversation simply continues. The structured fields post straight to the EU backend and do not pass through the AI.

Tier 2: contact and booking step (required checkbox)

Before contact details are stored at the booking or hand-off step, the visitor must tick a required checkbox:

"I agree that [business] may store these details and contact me about my enquiry, per the privacy policy." (required)

A separate, optional, unticked marketing checkbox appears alongside it:

"Optionally, keep me updated with helpful information."

Keeping marketing separate and opt-in means any future marketing rests on its own consent, as UK PECR and the EU ePrivacy Directive require. The form cannot be submitted without the required consent; it can be submitted without the marketing opt-in.

AI disclosure

The assistant delivers a configurable no-advice disclosure set per client (noAdviceDisclaimer), by default:

"I'm an AI assistant and can't give legal or professional advice, I just help get you booked in with the team."

This disclosure is currently instructed through the assistant's configuration, so the AI introduces itself as an AI in conversation. A persistent on-screen AI label is being added to the widget UI to satisfy EU AI Act Article 50 (transparency for AI systems interacting with people, applying from 2 August 2026), so the disclosure will not depend on the model's behaviour. This notice will be updated when that ships.

How consent is recorded

Each consent is recorded against the lead with a timestamp and the consentPolicyVersion in force at the time.
The consentPolicyVersion value in a client's configuration must reference the version of this document (currently 2.0), so every recorded consent maps to the exact wording shown.
Consent can be withdrawn at any time: see the Data Subject Requests procedure. Withdrawal does not affect the lawfulness of processing before withdrawal.

This document is a GDPR-aligned template and must be reviewed by a qualified data-protection lawyer or DPO before commercial reliance. It is not legal advice.