Data Processing Addendum
This addendum explains how Goodreviews Global Pty Ltd (ABN 72 647 638 926) ("Goodreviews", "we") handles personal information on behalf of a customer ("you") under the Terms of Service. If it conflicts with the Terms on a data protection matter, this addendum wins.
1. Roles
1.1You decide what personal information about your customers goes into the Service and why. Under laws that use these terms, you are the controller (or business) and we are your processor (or service provider).
1.2This addendum covers personal information we handle on your behalf ("Customer Personal Data"). It does not cover information we collect for our own purposes, such as your account and billing details. Our Privacy Policy covers that.
2. What we will do
2.1We will only process Customer Personal Data to provide the Service, as set out in the Terms and this addendum, and on your documented instructions. Your use of the Service and its settings counts as your instructions.
2.2We will not sell Customer Personal Data, use it for our own marketing, or combine it with other data for our own purposes. We may create aggregated statistics that do not identify any person.
2.3We will make sure our people who access Customer Personal Data are bound by confidentiality.
2.4We will tell you if we think an instruction breaks the law.
3. What you will do
3.1You will make sure you have a lawful basis to collect Customer Personal Data and share it with us, that you have given your customers the notices the law requires, and that you have the consent needed to message them.
3.2You will not upload sensitive information, such as health information, to the Service.
4. Security
4.1We will maintain reasonable technical and organisational measures to protect Customer Personal Data. Schedule 2 describes them. We may update them, but will not materially reduce the level of protection.
5. Sub-processors
5.1You authorise us to use the service providers listed in our Privacy Policy to process Customer Personal Data. We require each of them to protect it to a standard consistent with this addendum, and we remain responsible for what they do with it.
5.2We will update the list before adding a new provider that processes Customer Personal Data. If you ask us by email, we will notify you of new providers at least 14 days ahead. If you reasonably object on data protection grounds and we cannot resolve it, you may cancel and receive a refund of prepaid fees for the unused period.
6. Overseas processing
6.1Our main database is in Sydney, Australia. Some sub-processors process data overseas, mainly in the United States. We take reasonable steps to make sure they handle it consistently with the Australian Privacy Principles. Where another law requires a specific transfer mechanism, such as standard contractual clauses, we will enter into it with you on request.
7. Helping you with requests
7.1If one of your customers contacts us to access, correct or delete their information, we will refer them to you, unless the law requires us to respond directly. We will give you reasonable help to respond, including through tools in the Service.
7.2We will give you reasonable help with privacy assessments and regulator enquiries that relate to our processing.
8. Data breaches
8.1If we become aware of a breach of security affecting Customer Personal Data, we will tell you without undue delay, and within 72 hours of confirming it. We will tell you what happened, what data is affected and what we are doing about it, and update you as we learn more.
8.2We will work with you in good faith on who notifies affected people and regulators, so that they are not notified twice.
9. Deletion and return
9.1You can export Customer Personal Data while your subscription is active. After your account ends we keep it for 90 days, then delete or de-identify it. Backups are overwritten on a rolling cycle after that. You can ask us to delete it sooner.
9.2We may keep limited records where the law requires it, and a minimal opt-out record so that opt-outs continue to be honoured.
10. Checking our compliance
10.1On reasonable request, no more than once a year, we will give you information that shows how we meet this addendum. If the law gives you a right to audit beyond that, we will agree the scope, timing and cost with you first.
11. Liability
11.1The liability terms in the Terms of Service apply to this addendum.
Schedule 1. Details of processing
| Item | Detail |
|---|---|
| Purpose | Sending review requests, syncing and displaying reviews, drafting replies, reporting and support. |
| People | Your customers and clients. People who review your business on Google. |
| Data | Name, mobile number, email address, job or sale reference, message and delivery records, opt-outs, feedback responses, public review content. |
| Sensitive data | None intended. |
| Duration | The term of your subscription plus 90 days. |
Schedule 2. Security measures
- Hosting with Amazon Web Services in Sydney, Australia.
- Daily database backups, stored in Sydney.
- Encryption of connections between users' browsers and the Service.
- Passwords stored hashed.
- Access to production systems limited to staff who need it, protected by multi-factor authentication.
- Customer data separated by account at the application level.
- Software dependencies reviewed and updated regularly.
- Application and error logs kept for 90 days.