Data processing addendum
This addendum covers how [RaveRobin legal entity] processes your customers’ personal data on your behalf. It forms part of the Terms of service.
1. Roles
You (the business) are the controller of your customers’ personal data. RaveRobin is your processor and acts only on your documented instructions, which are given through your use of the service.
2. Data and purpose
Categories: customer names, email addresses, phone numbers, visit details, ratings, review text and private feedback. Purpose: sending review requests and reminders, hosting the review page and widget, and reporting to you.
3. Confidentiality
People with access to personal data are bound by confidentiality and get only the access they need.
4. Security measures
Encryption in transit and at rest, hashed access tokens, least-privilege access, logging that excludes personal data, encrypted backups, and tested restores.
5. Subprocessors
You authorise the subprocessors listed on our Subprocessors page. We will notify account owners at least 30 days before adding a new one.
6. Helping you
We help you answer data-subject requests (you can delete a customer in Settings → Data & privacy), and we notify you without undue delay, within 72 hours, after becoming aware of a personal-data breach.
7. Return and deletion
You can export your data at any time. After your account closes we delete personal data within [N] days, except where the law requires us to keep it.
8. International transfers
[Transfer mechanism, to be provided by counsel.] Data is hosted in [region].
Questions? Write to [email protected] or [postal address].