© 2026 BuzzAgent Ltd

The way we handle personal data, and our legal role, depends on which of these you are. Section 4 explains the difference.

This Policy does not cover personal data we process about our own employees and job applicants.

3. A note on how the service works

BuzzAgent is a channel and a toolkit. A BuzzPad is a QR and NFC scan point that sits on a Merchant's counter.

Today, scanning it sends the customer straight to that Merchant's review page on Google. There is no interstitial and no message.

WhatsApp review collection is being rolled out. Where it is live for a Merchant, the scan opens WhatsApp on the customer's own phone with a short message the customer chooses to send to that Merchant. The Merchant's reply, and any follow-up, comes from the Merchant's own WhatsApp number and in the Merchant's name.

The Merchant decides who to contact and what to say. BuzzAgent provides the automation, the review link and the analytics; the relationship is between the Merchant and their customer.

4. Our role: controller and processor

Under the UK GDPR there is a difference between a "controller" (who decides why and how personal data is used) and a "processor" (who acts on a controller's instructions).

We are a controller for:

• personal data of website visitors and Merchants;
• account, billing and support data;
• aggregated and operational data we use to secure, run and improve our services.

We are a processor acting on each Merchant's instructions for:

• the personal data of that Merchant's End Customers that we handle so the Merchant can collect reviews and message customers, including phone numbers, message content, opt-in records and interaction events;
• the reviews that Merchant's business has received on Google, which we collect so they can read and reply to them in one place.

For that data, the Merchant is the controller. The Merchant is responsible for having a lawful basis to contact its customers and for telling its customers how their data is used. Our handling of that data for Merchants is governed by our Data Processing Agreement (see Section 12).

5. Personal data we collect

5.1 Website visitors

• Technical data our hosting provider handles when you load a page, such as IP address, browser type and the pages you view.
• If you send us a message through our contact form: your email address, the subject you chose, your message, and the browser and referring page it arrived from.
• Cookies and similar storage (see Section 13).

5.2 Merchants

• Identity and contact data: name, business name, email address, phone number, business address.
• Account data: login credentials, settings, the WhatsApp Business account you connect, and the business location details we prefill from Google Places when you look up your business at onboarding - name, address and coordinates, category, opening hours, contact phone number, website, its public Google rating and review count, and the Google listing identifier and map links we use to send your customers to your review page.
• Billing data: payment records and transaction history. Card details are handled directly by our payment providers and are not stored by us.
• Usage data: how you use the dashboard, scans by location and time, conversion metrics, and support correspondence.

5.3 End Customers (handled on behalf of Merchants)

• Contact data: where WhatsApp review collection is live for the Merchant, the WhatsApp phone number and business-scoped identifier used to message them, and the WhatsApp profile name shown on that account.
• Message content: messages exchanged between the Customer and the Merchant through the service, and any media they send.
• Interaction data: scan events, whether a review link was opened, reminders sent, and opt-out signals.

5.4 People who have reviewed a Merchant on Google (handled on behalf of Merchants)

When a Merchant enrols a business location, we collect the reviews that business has received on Google so the Merchant can read them and reply in their own words. From each review we keep the reviewer's public display name, the review text and star rating, whether Google marks them a Local Guide, the language the review was written in, the date it was published, the link to the review, and any reply the business has already posted.

We do not keep the reviewer's Google profile link or profile photo, we do not use this data to contact anyone, we do not combine it with any other data about that person, and we never use one Merchant's data for another Merchant.

This data is already published by the reviewer on Google about that business. Because we collect it from Google rather than from the reviewer, this section is how we tell you about it. To ask us to remove a review we hold about you, see Section 15.

We do not seek to collect special category data (such as health, religion or political views), and we ask Merchants not to use the service to process it.

6. Where the data comes from

We receive personal data:

• directly from you, when you visit our site, create an account, buy a BuzzPad or contact us;
• from End Customers, when they message a Merchant through the service;
• from the WhatsApp Cloud API, where WhatsApp review collection is live for a Merchant and messages pass between that Merchant and their customer;
• from Google, when we collect the reviews a Merchant's business has received and when a Merchant looks up their business at onboarding;
• from service providers that help us run the platform, such as payment, hosting and analytics providers.

7. How and why we use personal data, and our legal bases

• Provide the website and respond to enquiries - visitor and contact data. Legal basis: legitimate interests.
• Create and manage Merchant accounts - Merchant identity and account data. Legal basis: contract.
• Deliver BuzzPads and provide the services - Merchant and usage data. Legal basis: contract.
• Process payments and prevent fraud - billing data. Legal basis: contract; legal obligation; legitimate interests.
• Enable review collection and customer messaging - End Customer data (as processor for the Merchant). Legal basis: the Merchant's lawful basis.
• Collect and show a Merchant the reviews their business has received on Google - reviewer display name, review text and rating (as processor for the Merchant). Legal basis: the Merchant's legitimate interest in managing the reputation of their own business.
• Provide analytics and reporting to Merchants - usage and interaction data. Legal basis: legitimate interests; contract.
• Secure, maintain and improve our services - most categories. Legal basis: legitimate interests.
• Send service and account communications - Merchant contact data. Legal basis: contract; legitimate interests.
• Send marketing about our own products to Merchants - Merchant contact data. Legal basis: consent or legitimate interests, with opt-out.
• Comply with law and handle disputes - data as needed. Legal basis: legal obligation; legitimate interests.

Where we rely on legitimate interests, we have weighed those interests against your rights, and you can ask us about that assessment at any time.

8. WhatsApp, Meta and Google

Where WhatsApp review collection is live for a Merchant, the service operates over the WhatsApp Cloud API. For a business in the United Kingdom, the WhatsApp Business Solution is provided by WhatsApp Ireland Limited; our own developer relationship with the wider Meta group is with Meta Platforms Ireland Limited. Messages sent or received through the service pass through Meta's systems and are also subject to Meta's and WhatsApp's own terms and privacy policies. We are not responsible for how Meta processes data under its own policies. You can read more in the WhatsApp Privacy Policy.

We use data obtained through the WhatsApp Cloud API only on the instructions of the Merchant it belongs to, only to provide the service to that Merchant, and never for our own purposes. We do not disclose it to anyone other than that Merchant and the service providers listed at buzzagent.co/legal/sub-processors. We do not sell personal data to anyone.

Review links send customers to the Merchant's profile on Google. Once a customer reaches Google, their use of Google's services is governed by Google's own terms and privacy policy. If you want data we hold from the WhatsApp Cloud API deleted, see Section 15.

9. Who we share personal data with

We share personal data only as needed to run the service:

• Service providers (sub-processors) that host, secure and operate the platform, process payments, and send notifications on our behalf. These act under contract and only on our instructions.
• Meta, to the extent necessary to send and receive messages through the WhatsApp Cloud API.
• Merchants, who receive the data of their own Customers.
• Professional advisers, auditors, and authorities, where required by law or to protect our rights.
• A buyer or successor, in connection with a merger, acquisition or reorganisation, subject to this Policy.

A current list of our sub-processors is published at buzzagent.co/legal/sub-processors and is also available on request at [email protected].

10. International transfers

Some of our service providers process personal data outside the United Kingdom, including in the United States. Where we transfer personal data outside the UK, we rely on UK adequacy regulations, or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, having assessed - as the Data (Use and Access) Act 2025 requires - that the protection for the data is not materially lower than it would be under UK law. You can ask us for details of the safeguards that apply.

11. How long we keep personal data

We keep personal data only for as long as we need it for the purposes in this Policy, and delete it when that purpose ends or when you ask us to and we have no legal reason to keep it.

• Merchant account, settings and usage data: while the account is open. We delete it when the account is closed.
• Billing and payment records: kept after an account closes, for as long as tax and accounting law requires.
• End Customer data and Google review data we handle for a Merchant: for as long as that Merchant instructs, and deleted when they instruct us to or when we stop providing the service to them.
• Messages you send us through the contact form: while we need them to deal with your enquiry and to keep a record of it.

We do not publish a fixed number of months for each category, because the right period depends on the account and on our legal obligations. To ask us to delete data about you, see Section 15.

12. Data Processing Agreement

Where we act as a processor for a Merchant, our processing is governed by a Data Processing Agreement that forms part of our Terms of Use, available at buzzagent.co/legal/data-processing-agreement. It sets out the subject matter, duration, nature and purpose of processing, the types of data and categories of data subjects, and the security measures and sub-processing terms that apply.

13. Cookies and similar technologies

We set no advertising or marketing cookies, we do not track you across other websites, and we do not sell or share this data for advertising. We show no cookie banner, because nothing we store on your device requires your consent under the Privacy and Electronic Communications Regulations.

What we store:

• Strictly necessary. The cookies that keep your sign-in session secure, carry an invitation link, and let pages load reliably. These are exempt from consent.
• Your display preferences. If you pick light or dark mode, your browser remembers that choice. Inside the signed-in dashboard we also remember whether the sidebar is open, and which organisation you chose as your default. These fall under the preference exception introduced by the Data (Use and Access) Act 2025. You can clear them in your browser settings at any time, free of charge, and everything keeps working.
• Measurement. We measure traffic and page performance with analytics that set no cookies and no browser storage. They report aggregate figures such as page views and load times, plus two named events: one recording that a visit arrived from an AI search tool, and one recording that an automated crawler fetched our robots file. We do not profile you, and this data is never combined with advertising.

One page is different. When a Merchant connects their WhatsApp Business Account, that page in the signed-in dashboard loads Meta's JavaScript SDK, which Meta requires for its sign-up flow. The SDK sets its own cookies and browser storage on our domain, governed by Meta's terms and privacy policy rather than by this Policy. We have turned off its automatic event logging. The SDK loads on that page only, never on our public website.

14. How we protect personal data

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, least-privilege access, logging, and vetting of our service providers. No system is completely secure, but we work to protect personal data and to notify the relevant people and the regulator where the law requires it.

15. Your rights

Subject to the conditions in the UK GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased in certain circumstances;
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time, without affecting earlier processing;
• object to a decision taken about you by automated means alone that produces legal or similarly significant effects, and to ask for a person to review it.

To exercise any of these, email [email protected] or use the form at buzzagent.co/contact. If the data was handled by a Merchant using our service - for example you received a message from a business, or you left that business a review on Google - the Merchant is the controller and we act on their instructions. We will pass your request to them and act on it ourselves where we are able to.

If you messaged a Merchant on WhatsApp and want the data we hold about you removed, email us at [email protected] or ask that Merchant directly, and we will action the request or pass it on. We handle these by hand; there is no self-service form.

Where a Merchant asks Meta to delete their account data, Meta sends us a deletion request for that Merchant's connected account. We then delete that Merchant's WhatsApp conversations, messages, consent records and any stored media, and return a confirmation code and a status page at buzzagent.co/legal/whatsapp-data-deletion where the outcome can be checked. That mechanism is Meta's and is available to the Merchant who connected the account, not to their customers.

16. Complaints

If you are unhappy with how we have handled your personal data, tell us first. Email [email protected] or use the form at buzzagent.co/contact, and say that you are making a data protection complaint. We will acknowledge it within 30 days of receiving it, look into it, keep you informed of progress, and tell you the outcome. This is your right to complain to us under section 164A of the Data Protection Act 2018.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113. You do not have to come to us first.

17. Children

Our services are intended for businesses and are not directed at children. We do not knowingly collect personal data from children under 16.

18. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here, and the date shown at the top of this page changes with it. Where changes are significant, we will take reasonable steps to notify Merchants.

19. Contact

BuzzAgent Ltd 86-90 Paul Street, London, EC2A 4NE, United Kingdom Email: [email protected]