Data Processing Agreement

1. Definitions

• Data protection law means the laws that apply to the processing of customer personal data under this DPA, including, where they apply, the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA") and other US state privacy laws.
• Customer personal data means the personal data described in Annex 1 that we process on your behalf when we provide the service.
• Controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the GDPR; business, service provider, sell and share have the meanings given in the CCPA.
• Security incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, customer personal data.
• Subprocessor means a third party we engage to process customer personal data.
• Other capitalized or defined terms have the meanings given in the Terms of Service.

2. Roles and scope

• For customer personal data, you are the controller (or, if you are an agency acting for your own clients, a processor acting for them) and we are your processor and service provider.
• This DPA covers the processing described in Annex 1: mainly contact details you upload for review requests, messages your customers send through your review page, the review-site accounts you connect, and the reviews, replies and notes in your account.
• It does not cover data for which we decide the purposes ourselves, such as your own account details, website visitors, the Grades.com directory and the public review data it is built from. Our Privacy Policy covers those.

3. Your instructions and your responsibilities

• We process customer personal data only on your documented instructions. The Terms, this DPA, the settings you choose and the actions you take in the service are your instructions. We may also process it where the law requires us to; in that case we tell you first unless the law forbids it.
• We tell you if we believe an instruction breaks data protection law, and we may refuse to follow it.
• You are responsible for the lawfulness of the customer personal data you give us and of your instructions, including having a legal basis and any consent required (for example for review requests by email or text message), and for giving the people concerned the notices the law requires.
• Do not upload protected health information, medical records or other special categories of personal data. The service is not designed for them.

4. Confidentiality

We keep customer personal data confidential. Only staff who need it for their work have access, and they are bound by confidentiality obligations.

5. Security

We maintain the technical and organizational measures in Annex 2, which are designed to protect customer personal data against security incidents and appropriate to the risk. We may update them as long as the overall level of protection does not decrease.

6. Subprocessors

• You give us general authorization to use the subprocessors listed in Annex 3.
• We tell you at least 30 days before we add or replace a subprocessor that processes customer personal data, by updating the list and by email to the account owner. You may object on reasonable data protection grounds within that period. If we cannot address your objection, you may cancel the affected service and we refund prepaid fees for the rest of the period, pro rata.
• We put data protection obligations in writing with each subprocessor that are no less protective than this DPA, and we remain responsible for their performance.

7. Requests from individuals

If a person asks us to exercise their rights over customer personal data (for example access, correction, deletion or objection), we pass the request to you and do not answer it ourselves unless you ask us to. Taking into account the nature of the processing, we help you answer such requests, mostly through the tools in the service (for example deleting a contact or a feedback message).

8. Security incidents

• We notify you without undue delay, and in any case within 72 hours, after we become aware of a security incident affecting customer personal data.
• The notice describes, as far as we know at the time, the nature of the incident, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. We send further information as it becomes available.
• We take reasonable steps to contain and fix the incident, and we cooperate with you on any notices you must give to authorities or individuals. Notifying you is not an admission of fault.

9. Other assistance

Taking into account the nature of the processing and the information available to us, we give you reasonable help with data protection impact assessments and prior consultations with supervisory authorities that relate to the service.

10. Return and deletion

While your account is open you can export or delete customer personal data in the service. After termination we delete customer personal data within 90 days, unless the law requires us to keep it. Copies in our routine database backups expire within 14 days after that, and any on-demand backup is deleted within 30 days of being taken.

11. Information and audits

On request, we give you a summary of our security measures and answer your reasonable security questionnaire, under confidentiality, to demonstrate compliance with this DPA. On-site audits are available only under a signed custom contract, at your cost.

12. International transfers

We process customer personal data in the United States. Where data protection law requires a transfer mechanism for customer personal data from the European Economic Area, the United Kingdom or Switzerland, the parties agree that the Standard Contractual Clauses in Implementing Decision (EU) 2021/914 apply (Module 2, controller to processor, or Module 3, processor to processor, as the case may be), with the information in the annexes of this DPA, Clause 7 (docking) included, the optional language in Clause 11 left out, the governing law and courts of Ireland under Clauses 17 and 18, and, for the UK, the UK International Data Transfer Addendum, and, for Switzerland, the necessary references to Swiss law. They are incorporated into this DPA by reference.

13. US state privacy laws

Where the CCPA or a similar US state law applies, we act as your service provider (or processor) and we:

• do not sell or share customer personal data;
• do not retain, use or disclose it for any purpose other than providing the service to you, including any commercial purpose other than that, or outside our direct business relationship with you;
• do not combine it with personal data we receive from others or collect ourselves, except as the law allows a service provider to;
• comply with the obligations that apply to us and give it the same level of privacy protection the law requires;
• tell you if we can no longer meet these obligations, and allow you to take reasonable steps to stop and fix unauthorized use.

14. Liability and precedence

• Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service (section 20), except where data protection law does not allow it.
• If this DPA conflicts with the Terms on the processing of customer personal data, this DPA prevails. If the Standard Contractual Clauses conflict with this DPA, the Clauses prevail.

15. Term

This DPA applies for as long as we process customer personal data, and ends when we have deleted it under section 10.

Annex 1: Description of the processing

Annex 2: Security measures

• Encryption: data is encrypted in transit (TLS), including connections to the database, and at rest in our cloud provider's storage. Signed-in sessions of connected accounts are additionally encrypted with keys held in a managed key service.
• Secrets and credentials: application secrets are kept in a managed secret store; passwords and API keys are stored only as hashes; we never store the passwords of connected review-site accounts.
• Access control: each request is checked against the user's membership of the business; customers see only their own data; staff access follows least privilege and is limited to what their work needs.
• Logging and audit: account actions (for example approvals, key changes and setting changes) are recorded in an audit log; service logs are kept for about 30 days.
• Network: the service runs on managed cloud infrastructure in the United States, inside a private network with controlled outbound access.
• Availability and backups: the database is backed up daily, with backups kept for up to 14 days; uptime is monitored and alerts go to the team.
• Development: code changes are reviewed and tested before release; dependencies are checked for known vulnerabilities; security fixes are released promptly.
• Incident response: a documented process to investigate, contain and notify, as described in section 8.
• People: staff with access are bound by confidentiality and trained on handling personal data.

Annex 3: Subprocessors

The current list of subprocessors, with what each does, is in section 7 of the Privacy Policy. Of these, the ones that process customer personal data are our hosting provider (Google Cloud), our email delivery provider (Mailgun), our AI model providers (for reply drafts) and, for review requests by text message when they are available, the SMS provider we add to that list. The same list, with the data each provider receives and where it works, is published on our Subprocessors page.

Contact

Questions about this DPA, notices and requests for a countersigned copy: