Data Processing Agreement

Last updated: 1 September 2026. Version 2026-09-01.

1. Introduction

This Data Processing Agreement ("DPA") applies whenever you use Revaliew to contact your own customers — principally the review invitation service. It forms part of the Business Terms and takes precedence over them on any question about personal data.

If you do not use the review invitation service, this DPA does not apply to you. Reviews written by members of the public on their own initiative are not covered: for those, Revaliew is the controller and the Privacy Policy applies.

2. Definitions

"Applicable Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the EU GDPR, and the Privacy and Electronic Communications Regulations 2003 ("PECR"), as each applies to you.

"Recipient Data" means personal data you provide to Revaliew about your customers so that we can invite them to write a review — their name, email address and any reference you supply.

"Controller", "Processor", "Personal Data", "Processing" and "Data Subject" have the meanings given in Applicable Data Protection Law.

3. Roles of the parties

You are the Controller of Recipient Data. Revaliew is the Processor.

This is not a formality. You hold the customer relationship, you decide which customers are invited and when, and you are the party with a lawful basis to contact them. Revaliew has no relationship with your customers and no independent reason to email them; we send on your instruction and for no other purpose.

Where a customer subsequently writes a review, Revaliew becomes the Controller of that review and of the reviewer's account, because publishing it is our own decision and purpose. The split is therefore: you control the invitation, we control the publication.

4. Instructions

Revaliew processes Recipient Data only on your documented instructions. Those instructions are: to send the invitation you have requested, to send at most one reminder, to record whether it was delivered, opened or acted on, and to suppress the address if the recipient opts out.

Uploading a list through the invitation form, and confirming the attestation on that form, constitutes your documented instruction. We will tell you if we believe an instruction breaches Applicable Data Protection Law.

5. Your warranties

You warrant, each time you send, that:

• every address you provide belongs to a person who is your own customer, who has bought from you or negotiated to;
• you have a lawful basis to contact them about a review — ordinarily the PECR Regulation 22(3) soft opt-in, or their consent;
• you gave them a simple means of refusing marketing when you collected the address, and at every subsequent contact;
• the addresses were not bought, scraped, rented, appended or otherwise obtained from a third party;
• you have given them the privacy information required by Articles 13 and 14, including that a review platform may contact them on your behalf.

The attestation on the invitation form records that you have confirmed this, against the version of this wording shown to you at the time. That record is kept for as long as the invitation is.

6. Prohibited data

Do not upload special category data (Article 9), criminal offence data, financial account details, or data about children. The invitation service is not designed for it and we do not want it. If you send it anyway you remain the Controller of it and are responsible for the consequences.

7. Confidentiality

Revaliew staff with access to Recipient Data are bound by confidentiality obligations. Access is limited to those who need it to run the service.

8. Security

Revaliew applies technical and organisational measures appropriate to the risk. In practice, and specifically:

• all traffic is served over TLS, and the origin accepts connections only from our content delivery network;
• invitation links use a 256-bit random token; the link identifies one invitation, cannot be guessed, and is refused once spent or if presented for a different business;
• ownership documents are held on private object storage that is not publicly addressable and is served only through short-lived authenticated links;
• the database is not reachable from the public internet;
• administrative access requires key-based authentication; password login is disabled;
• a per-business sending allowance limits how many invitations may be sent per day, and a business whose list produces excessive bounces or opt-outs is suspended automatically.

9. Sub-processors

You authorise Revaliew to engage the following sub-processors. Each is bound by data protection obligations no less protective than those in this DPA, and Revaliew remains liable for their acts and omissions.

Anthropic does not receive Recipient Data. It receives ownership documents you upload to verify your own business, and the text of business listings. It is named here because that processing is real and you are entitled to know about it.

We will give notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds.

10. International transfers

Recipient Data is stored in the EEA. Where a sub-processor processes personal data outside the UK or EEA, the transfer is made under the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, together with any supplementary measures required.

11. Data subject rights

Every invitation carries a one-click unsubscribe and honours the List-Unsubscribe header, so a recipient can opt out without contacting anyone. An opt-out is recorded on a suppression list and applies to that business permanently.

If a recipient contacts Revaliew directly to exercise a right over Recipient Data, we will not answer on your behalf. We will tell them the request is for you and pass it to you without undue delay, and we will help you answer it.

12. Security incidents

Revaliew will notify you without undue delay after becoming aware of a personal data breach affecting Recipient Data, with the information you need to meet your own notification obligations.

13. Retention and deletion

Invitation records, including the recipient's name and address, are kept for twelve months from the date of sending and are then deleted.

Suppression records are kept indefinitely, and deliberately. An opt-out we have deleted is an opt-out we cannot honour, and re-contacting someone who has unsubscribed is a worse outcome than retaining an address for the sole purpose of never using it. A suppression record holds only what is needed to recognise the address.

On termination, Recipient Data is deleted within 30 days, except suppression records for the reason above. Published reviews are unaffected: they belong to the reviewer and to the public record.

14. Audit

On reasonable written notice, and not more than once a year unless required by a supervisory authority, Revaliew will provide the information necessary to demonstrate compliance with this DPA and submit to an audit by you or an independent auditor bound by confidentiality.

15. Annex: description of processing

• Subject matter: sending review invitations to your customers on your behalf.
• Duration: for as long as you use the service, plus the retention periods in section 13.
• Nature and purpose: storing an address, sending an invitation and at most one reminder, recording delivery and outcome, and honouring opt-outs.
• Categories of data subject: your customers.
• Types of personal data: name, email address, and any order or transaction reference you choose to supply.
• Special categories: none. See section 6.

16. Contact

Questions about this DPA, or requests under it, should go to [email protected].