Data processing addendum

Scope and roles

This addendum applies whenever Review Integration, operated by Marketing Released B.V. in the Netherlands, processes personal data on your behalf, and it forms part of our terms of service. It is written to satisfy Article 28 of the GDPR and the equivalent UK provisions. No signature is needed: it is in force for every customer from the moment the account is created.

• You are the controller of the reviews, reviewer details, customer contacts, private feedback and activity history inside your workspaces. You decide which review sources are connected, which customers are asked for a review, which rules and agents run, and what happens to a review.
• We are the processor of that data, acting on your instructions.
• We are a controller in our own right for your account, billing and security data. That part is covered by our privacy policy, not by this addendum.
• If you are an agency, you are the processor for your clients and we are your sub-processor. This addendum flows down to them unchanged.

Subject matter, duration, nature and purpose

Processing on your instructions

We process personal data only on your documented instructions. Your instructions are: this addendum, the terms of service, the settings you configure in the app, and the requests you make through the API.

If a law we are subject to requires us to process data beyond your instructions, we will tell you before we do it unless that law forbids telling you. If we believe an instruction breaks data protection law, we will say so and may pause that instruction until it is resolved.

We will not sell your data, use it for our own marketing, or use it to train machine learning models. That holds for our sub-processors too.

Confidentiality

Everyone with access to your data is bound by a written confidentiality obligation that survives their engagement with us. Access is granted on a need-to-know basis, is reviewed quarterly, and is removed the day somebody leaves.

Security measures

We keep the following technical and organizational measures in place, and we do not weaken them during the term:

• Encryption. TLS 1.2 or better in transit, encryption at rest, and a second application-level encryption layer for review site access tokens.
• Access control. Two-factor authentication on every administrative account, role-based permissions in the product, and least privilege for production access.
• Tenant isolation. Every query is scoped to a workspace at the data layer, so one customer’s session cannot read another customer’s rows.
• Resilience. Managed, replicated storage with encrypted rolling backups and a tested restore procedure.
• Logging. Request and administrative action logs retained for 90 days, with alerting on anomalous access.
• Secure development. Code review on every change, dependency scanning, and separate environments for development and production.
• Vendor management. Every sub-processor is assessed before it is used and re-assessed annually.

Sub-processors

You give general authorization for the sub-processors below. The current list is always the one published here and in our privacy policy.

This list is the same list published in the privacy policy, and the two are kept in step. We update it whenever it changes, including the AI model subprocessors. We give you 30 days’ notice by email before a new sub-processor starts processing your data. If you object on reasonable data protection grounds within those 30 days, we work with you on an alternative. If there is none, you can terminate the affected part of the service and receive a refund of the unused prepaid period.

Each sub-processor is engaged under a written contract imposing obligations no weaker than these. We remain fully liable to you for their performance.

Helping you meet your own obligations

The product is built so you can answer most requests yourself: the reviews feed finds a reviewer’s reviews and exports them to a CSV file, and deleting a contact erases it with its consent records and its review requests.

Where a request cannot be handled in the app, we will help you within 5 working days at no extra charge. If a data subject contacts us directly about data we hold for you, we will not answer on your behalf. We will tell them to contact you and let you know it happened.

We will also give you the information you reasonably need for a data protection impact assessment or a prior consultation with a supervisory authority.

Personal data breaches

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any case within 48 hours. The notice will describe what happened, the categories and approximate number of records involved, the likely consequences and what we are doing about it, as far as we know at the time, with updates as we learn more. We will not make a public statement identifying you without your agreement, unless the law requires it.

Retention, return and deletion

• Reviews, replies and private feedback are deleted 12 months after the review arrived. The workspace owner can set a shorter or a longer window per location, of at least 30 days, from the location’s settings.
• Customer contacts, their consent records and their review requests are held until you delete the contact or the account closes. A one-way hash of each address that unsubscribed, bounced or complained is kept while the account exists, so that address is not asked again.
• Access tokens are held until you disconnect the source, the review site revokes them, or the account closes.
• Request and security logs are held for 90 days.
• Assistant conversations are deleted 30 days from the start, shorter when your review window is shorter.
• Support tickets, including attached images and any conversation you attach, are kept while your account exists and deleted with the account. Images you upload but never send on a ticket are deleted after 24 hours.
• Disconnecting a review source deletes its token immediately and the reviews collected from it 30 days later.
• When your account closes, we delete all personal data processed on your behalf within 30 days. Encrypted backups roll within 30 days.
• Before deletion you can export everything through the app or the API. Ask within the 30 day window and we will produce the export for you.
• We keep data beyond these periods only where a law requires it, and only for as long as it requires.

Audits and information

On request we will provide the information needed to demonstrate compliance with this addendum, including our security documentation and the reports of our infrastructure providers. That is once a year at most, unless a supervisory authority or a breach makes more necessary. Where that is not enough, you or an independent auditor bound by confidentiality may audit us, on 30 days’ notice, during business hours, without disrupting the service and without access to other customers’ data.

International transfers

Personal data processed on your behalf is hosted in western Europe. Where it is processed outside the EEA or the UK, by Cloudflare’s network in transit or by the AI sub-processors in the United States, the transfer runs on the European Commission’s Standard Contractual Clauses with the UK International Data Transfer Addendum where relevant, supported by a transfer risk assessment we keep on file. By agreeing to this addendum you appoint us to enter into those clauses with sub-processors on your behalf, as controller to processor or processor to processor as the case requires.

Platform data

Data obtained from Meta or any other review site you connect is additionally subject to the terms that site imposes on developers. We use it only to provide the features you enabled, keep it only as long as those features need it, delete it when you disconnect a source or the site instructs deletion, and pass it to no one outside the sub-processor list above. Where a site’s requirement is stricter than this addendum, the stricter requirement applies.

Order of precedence and how to accept

If this addendum conflicts with the terms of service, this addendum wins for anything about the processing of personal data. If it conflicts with the Standard Contractual Clauses, the clauses win.