Data Processing Agreement

Last updated: 25 October 2026.

This Data Processing Agreement (“DPA”) forms part of the agreement between RepBeacon (“we”, “us”, the “processor”) and the business that uses the RepBeacon service (“you”, the “client”, the “controller”), including our terms. It applies where we process personal data on your behalf when providing the service, and is intended to meet the requirements of Article 28 of the UK GDPR. If this DPA conflicts with other terms on the processing of personal data, this DPA takes priority.

1. Roles of the parties

You are the controller of the personal data of your customers that you upload to, or collect through, RepBeacon. We act as your processor for that data. We are a separate controller only for our own account, billing and website data, which is covered by our privacy policy.

2. Subject matter and duration

The subject matter is the processing of your customers’ personal data so that we can provide the RepBeacon review-marketing service. Processing lasts for as long as you use the service and until the data is deleted or returned in line with section 11.

3. Nature and purpose of processing

We store, organise and use the data to send review requests and reminders by SMS and email on your behalf, record delivery and responses, collect private feedback, display reviews and feedback in your dashboard, produce reports, and generate draft replies to reviews using AI tools for you to check before publishing. We process the data only for these purposes.

4. Categories of data subjects and personal data

Data subjects: your customers, clients or patients whom you choose to contact, and your staff users where named in the service.

Personal data: names, mobile phone numbers, email addresses, review and feedback content (including ratings and comments), message delivery and interaction data (for example sent, opened or clicked), and related job or visit references you provide.

You must not upload special category data (such as health information) or criminal offence data unless strictly necessary and agreed with us in writing.

5. Your responsibilities and PECR

You are responsible for the lawfulness of the processing you instruct, including having a lawful basis under the UK GDPR, giving your customers appropriate privacy information, and complying with the Privacy and Electronic Communications Regulations (PECR). In particular, you are responsible for making sure you have consent, or can rely on a valid exception such as the soft opt-in, before we send SMS or email messages to your customers on your behalf, and for honouring opt-outs. Your instructions must comply with data protection law and Google’s review policies.

6. Our obligations as processor

We will:

• process personal data only on your documented instructions, including those given through your use and configuration of the service, unless required otherwise by UK law (in which case we will tell you first unless the law forbids it);
• tell you promptly if we believe an instruction infringes data protection law;
• ensure that anyone authorised to process the data is bound by a duty of confidentiality;
• implement appropriate technical and organisational security measures under Article 32 UK GDPR, as described in section 7;
• only engage sub-processors in line with section 8;
• assist you, taking into account the nature of the processing, in responding to requests from data subjects exercising their rights;
• assist you with your obligations on security, breach notification, data protection impact assessments (DPIAs) and prior consultation with the ICO, taking into account the information available to us;
• delete or return personal data at the end of the service under section 11; and
• make available the information reasonably necessary to demonstrate compliance with Article 28 and allow for audits under section 12.

7. Security

Our measures include encryption of data in transit, access controls limited to people who need access, authentication for accounts, use of established hosting providers, logging, and regular review of our measures. More detail is on our security page. We may update our measures provided the overall level of protection is not reduced.

8. Sub-processors

You give us general written authorisation to engage sub-processors to help provide the service. Our sub-processors fall into these categories: the white-label review platform provider that powers the application; cloud hosting and infrastructure; SMS and email delivery (for example Amazon Web Services SES); AI providers used to generate reply drafts; and payment processing (Stripe), which mainly concerns our own billing data. A current list is available on request from silvano@repbeacon.co.uk.

We will give you notice of any intended addition or replacement of a sub-processor, giving you the opportunity to object on reasonable data protection grounds. If we cannot reasonably address your objection, you may stop using the affected service. We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible to you for their performance.

9. International transfers

Some sub-processors may process personal data outside the UK. Where personal data is transferred to a country without UK adequacy regulations, we will ensure an appropriate safeguard is in place, such as the UK International Data Transfer Agreement (IDTA) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with any supplementary measures needed.

10. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your data. We will provide the information reasonably available to us to help you meet your own obligations, including any notification to the ICO and to affected individuals, and will take reasonable steps to contain and remedy the breach.

11. Deletion or return of data

When the service ends, you can export your data while your account remains active. After the service ends, we will delete your personal data, or return it on request, within a reasonable period, unless UK law requires us to keep it. Data in backups is deleted in line with normal backup cycles.

12. Audits and information

On reasonable request, we will provide information needed to demonstrate our compliance with this DPA. Where that information is not sufficient, we will allow and contribute to audits, including inspections, by you or an independent auditor you appoint, on reasonable notice, during normal business hours, subject to confidentiality and no more than once a year unless required by a regulator or following a breach.

13. Liability

Each party’s liability under or in connection with this DPA is subject to the limitations and exclusions of liability in our terms, except where those limits cannot lawfully apply.

14. Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.

Contact

For questions about this DPA or to request the current sub-processor list, email silvano@repbeacon.co.uk.