Data Processing Addendum

This Data Processing Addendum (“Addendum”) forms part of the Terms of Service between you (the “Merchant”) and ReviewSpace. It applies whenever you use ReviewSpace to collect, store or contact your own customers. That covers sending review requests, collecting testimonials, and importing reviews that carry a reviewer’s name.

It is governed by the New Zealand Privacy Act 2020. The Act treats both of us as “agencies”, so this Addendum sets out contractually which of us decides what happens to your customers’ information and which of us simply acts on instructions. Where the language of another regime is useful, you are the controller and we are the processor.

1. Roles and responsibilities

You decide. You choose which of your customers to contact, what to say to them, and what to keep. You are responsible for having a lawful basis for that contact, for the accuracy of the contact details you upload or connect, and for honouring opt-outs and the messaging laws that apply where your customers are.

We act on your instructions. We process the personal information you put into ReviewSpace only to provide the Services to you, to keep them secure, and to meet our own legal obligations. We do not sell it, we do not share it with advertising networks or data brokers, and we do not use your customers’ contact details to market to them on our own behalf.

2. What we process, and for how long

2.1 Categories of people

• Your customers, past and present, whom you contact or who leave you a review or testimonial
• Your own staff who hold a seat on your ReviewSpace account

2.2 Categories of information

• Contact details: name, email address, phone number
• Review and testimonial content, including any photo or video a customer chooses to submit
• Interaction records: what was sent, when, whether it was delivered and opened, and whether it led to a review
• Technical records tied to a submission, such as IP address and timestamp, kept to detect abuse

We do not ask for, and you should not upload, health information, financial account details, government identifiers, or any other sensitive category of personal information.

2.3 Retention

End-customer contact details are retained while your account is active, because the purpose we collected them for continues for as long as you are trading with us. That purpose is letting you follow up with your own customer, or ask them again later. Erasure is driven by events rather than by a fixed clock:

• You close your account, and all of your data is deleted
• You disconnect a connector, and the contacts that came from it are erased
• You or your customer asks us to redact a record, and we redact it

Two automatic sweeps run on top of that. Contact details captured through an in-store QR or walk-in prompt are wiped 30 days after capture, and the personalisation details attached to a send are wiped after 12 months.

3. Sub-processors

We use the services below to run ReviewSpace. Each is bound by its own data-processing terms, and each sees only what it needs to do its job.

These providers operate global infrastructure and process data outside New Zealand, mostly in the United States. Before we add a sub-processor or change one, we update this page and email account owners at least 30 days ahead. If a specific hosting region matters to you, ask us before you subscribe and we will confirm the current region for each service in writing.

SMS is not yet a live channel, so no SMS provider appears above. One will be added here before the first text message is sent.

4. Security

Data is encrypted in transit and at rest. Access to production data is restricted to the people who need it, protected by multi-factor authentication, and logged. Every tenant’s data is isolated at the database level by row-level security rather than by application code alone. Third-party access tokens, such as your Google connection, are encrypted with a separate key before they are stored.

5. Requests from your customers

If one of your customers asks us directly for access, correction or deletion, we will refer them to you unless the law requires otherwise, and tell you that they asked. If you need our help answering a request, contact us and we will do it. That covers an export, a correction, or a deletion that spans several records. We do not charge for this.

6. Privacy breaches

If we become aware of a privacy breach affecting information you have entrusted to us, we will tell you without undue delay and give you what you need to meet your own obligations. Where the breach is notifiable under Part 6 of the Privacy Act 2020, we will notify the Office of the Privacy Commissioner and, where required, the people affected.

7. Return and deletion

You can export your data at any time from your account. When your account is closed, your data is deleted, including from our sub-processors. The exception is records we are required to keep, such as billing records, which we retain for the period tax law requires.

8. Audits and information

On reasonable request, and no more than once a year unless a breach has occurred, we will provide the information you reasonably need to confirm we are meeting this Addendum. We are a small team, so we will answer questions and share documentation rather than host an on-site audit.

9. Precedence

Where this Addendum conflicts with the Terms of Service, this Addendum governs on questions of personal information. Our Privacy Policy explains how we handle your own information as our customer, which is a separate question from the customer information you store with us.

10. Contact

Questions about this Addendum, or a request for a signed copy: