© 2026 BuzzAgent Ltd

3. Your instructions

We process End Customer data and Google review data only on your documented instructions, including on transfers, unless we are required to process it by law - in which case we will tell you before processing, unless the law prohibits it. Your instructions are set out in this DPA, the Terms of Use, and your use of the Services through their settings and features. You confirm that those instructions are lawful and that you have authority to give them. We will tell you if, in our opinion, an instruction infringes data protection law.

4. Confidentiality

We ensure that people authorised to process this data are bound by an appropriate duty of confidentiality and process it only as instructed.

5. Security

Taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to data subjects, we implement appropriate technical and organisational measures to protect the data, as described in Annex 2. We may update these measures over time provided the level of protection is not reduced.

6. Sub-processors

You give general authorisation for us to engage sub-processors to provide the Services. A current list is at Annex 3 and at buzzagent.co/legal/sub-processors. We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain liable for their acts and omissions.

We will give you at least 30 days' notice of any new sub-processor, by updating the list and, where you have asked, by email. If you reasonably object on data protection grounds within that period, we will work with you in good faith to address the concern; if we cannot, you may terminate the affected Services.

7. Assistance to you

Taking account of the nature of the processing, we will:

• assist you, by appropriate technical and organisational measures and so far as possible, to respond to requests from data subjects exercising their rights;
• assist you in ensuring compliance with your obligations on security, breach notification, data protection impact assessments, and prior consultation, taking account of the information available to us.

If we receive a request from a data subject to exercise their rights, we will not respond directly other than to direct them to you, or to action the request on your behalf where you have configured the Services to do so, and we will pass the request to you without undue delay.

8. Personal data breach

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide the information you reasonably need to meet your own breach obligations, including the nature of the breach, the likely consequences, and the measures taken or proposed.

9. Deletion or return

On termination of the Services, or on your written request, we will delete the End Customer data and the Google review data we hold for you, and delete existing copies, unless data protection law requires us to keep it. We act on request and on termination; we do not operate an automatic time-based deletion schedule. Where retention is required by law, we will keep the data only for as long and to the extent required, and continue to protect it under this DPA.

10. Audits and information

We make available to you the information necessary to demonstrate compliance with Article 28 of the UK GDPR, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. Audits take place on reasonable prior notice, no more than once a year unless a breach or a regulator requires otherwise, during business hours, without unduly disrupting our operations, and subject to confidentiality.

11. International transfers

We and our sub-processors may process your data outside the United Kingdom. Where we do, we put in place a transfer mechanism recognised under data protection law - such as processing in a country covered by UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses - together with any supplementary measures required.

12. Term, liability and conflict

This DPA takes effect when you accept the Terms of Use and continues for as long as we process this data for you. Liability under this DPA is subject to the limitations of liability in the Terms of Use. If there is a conflict between this DPA and the Terms of Use on the processing of this data, this DPA prevails.

Annex 1 - Details of the processing

• Subject matter: provision of the Services (review collection, review monitoring, and customer messaging) by BuzzAgent to the Merchant.
• Duration: for the term of the Services and until deletion or return under Section 9.
• Nature and purpose: receiving, storing, transmitting and displaying messages and related events so the Merchant can collect reviews from and message its own customers; sending templated and free-form messages on the Merchant's instruction; recording consent and opt-out; collecting the reviews the Merchant's business has received on Google and presenting them in the Merchant's dashboard; providing analytics to the Merchant.
• Types of personal data: End Customer WhatsApp phone number and/or business-scoped user identifier and WhatsApp profile name; message content exchanged between the End Customer and the Merchant, and any media they send; interaction events such as scans, review-link opens, reminders sent, and opt-in and opt-out signals; and, for reviews published on Google about the Merchant's business, the reviewer's public display name, the review text and star rating, the language of the review, the publication date, the link to the review, and any reply the business has posted.
• Categories of data subjects: the Merchant's customers and prospective customers who contact the Merchant through the Services, and people who have published a review of the Merchant's business on Google.
• Special category data: none is requested or required. The Merchant must not instruct the processing of special category data through the Services.

Annex 2 - Technical and organisational measures

• Encryption of personal data in transit, and of sensitive credentials at rest in a dedicated secret store.
• Access control on a least-privilege basis, with row-level security enforcing per-Merchant isolation so one Merchant cannot access another Merchant's data.
• Authentication for Merchant accounts via Google sign-in, magic link, or password where we have provisioned one; there are no End Customer accounts.
• Data minimisation on review collection: we keep the reviewer's display name, words and rating, and do not store their Google profile link or profile photo.
• Authentication on every inbound webhook, and rejection of any unauthenticated payload: a cryptographic signature over the payload where the provider supports one, and a constant-time comparison of a high-entropy shared secret where it does not.
• Logging and audit trails of review-collection events.
• Vetting of sub-processors and contractual data protection terms with each.
• Backups and recovery operated by our infrastructure providers.
• No use of one Merchant's data for another Merchant, and no use of it for AI training or cross-Merchant analytics.

Annex 3 - Sub-processors

The current list is published at buzzagent.co/legal/sub-processors. As at the date of this DPA it includes providers of cloud database, authentication and storage; application hosting, edge compute and background queues; payment processing; transactional email; the WhatsApp Cloud API; review, mapping and business-lookup services; and review collection from Google.

Contact

Questions about this DPA: [email protected]

BuzzAgent Ltd 86-90 Paul Street, London, EC2A 4NE, United Kingdom