Data processing agreement
This agreement forms part of our terms of service. It covers personal information that you, the business, put into RankSpaniel about other people, mainly your customers. For that information you are the controller and [Company name] Ltd is your processor, under Article 28 of the GDPR and the UK GDPR. Accepting our terms accepts this agreement; there’s nothing extra to sign.
1. What we process
| Purpose | Providing RankSpaniel to you: asking customers for reviews, handling enquiries, showing and replying to reviews, and the other features you use. |
|---|---|
| People | Your customers and enquirers, people who review your business, and your staff who use RankSpaniel. |
| Information | Names, phone numbers, email addresses, enquiry details, review text, the reason you gave for contacting someone, and opt-outs. |
| How long | For as long as you use RankSpaniel, then deleted as set out in section 8. |
2. Your instructions
We only process this information to provide RankSpaniel to you, following your instructions as given through the app, these terms and in writing. If we think an instruction breaks data protection law, we’ll tell you. If the law requires us to process it in another way, we’ll tell you first unless the law stops us.
3. Your responsibilities
You’re responsible for having a lawful basis to collect your customers’ details and to contact them, for any notices you must give them, and for the accuracy of what you add. RankSpaniel records the basis you choose for each contact and honours opt-outs, but choosing the right basis is your call.
4. Confidentiality and security
Everyone at RankSpaniel who can access this information is bound to keep it confidential. We protect it with measures suited to the risk, including encryption in transit, encrypted storage of access keys, separation of each business’s data, access limited to those who need it, and regular backups.
5. Suppliers (sub-processors)
You agree that we may use the suppliers listed on our suppliers page. Each one is bound by data protection terms at least as protective as these. We’ll give you at least 30 days’ notice, by email or in the app, before adding or replacing a supplier that processes this information. If you object on reasonable data protection grounds and we can’t resolve it, you can end your subscription and we’ll refund any unused prepaid period.
6. Transfers outside the EU and UK
Where a supplier processes this information outside the EU or UK, the transfer is covered by an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses and, for the UK, the UK addendum.
7. Helping you
- We’ll help you answer requests from people exercising their data protection rights, mostly through the app itself.
- We’ll tell you without undue delay, and within 48 hours, after we become aware of a personal data breach affecting your data, with the details we have.
- We’ll give you reasonable help with data protection impact assessments and with questions from regulators.
8. When you leave
When your account closes we delete this information within 30 days, unless the law requires us to keep it. Backups are overwritten within 90 days. You can ask for a copy before you close your account.
9. Checking we comply
We’ll give you the information reasonably needed to show we meet these obligations. If that isn’t enough, you may arrange an audit at your own cost, with reasonable notice and no more than once a year, unless a regulator requires it.
10. Liability and order
The liability limits in our terms apply to this agreement. If this agreement and the terms conflict about personal information, this agreement wins.