Data Processing Agreement

1. Subject and duration

We process your customers' and staff's personal data to send review requests, run feedback surveys, create thank-you images and report results, for as long as your account is active.

2. Data and people involved

• People: your customers, your staff, and people who reply to your messages.
• Data: names, mobile numbers, email addresses, visit dates, staff names and photos, ratings, feedback, message delivery status.
• No special-category data should be uploaded.

3. Our obligations

• Process data only on your documented instructions (your settings and use of the service).
• Make sure everyone with access is bound by confidentiality.
• Keep appropriate security measures: encryption in transit, private storage, access controls, encrypted credentials.
• Help you respond to people exercising their rights, including erasing a customer on request.
• Tell you without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach.
• Delete or return data when the agreement ends, unless the law requires us to keep it.
• Make available the information needed to show compliance and allow reasonable audits.

4. Sub-processors

You authorise us to use sub-processors for hosting, database, SMS and WhatsApp delivery, email delivery, AI text and image generation, payments and Google integration. We impose equivalent data protection terms on them and will tell you before adding or replacing one, so you can object.

5. International transfers

Where a sub-processor is outside the EEA or UK, transfers rely on an adequacy decision or the Standard Contractual Clauses (and the UK Addendum).

6. Your obligations

You confirm you have a lawful basis to give us this data and to contact your customers, and that your instructions comply with data protection law.

7. Contact

Data protection queries: support@ranknua.com, +353 87 000 5480.