1. What this service is
We send a short message to your recent customers, thanking them for their business and asking them to leave a Google review, with a direct link to your Google Business Profile. The message comes from your business name. Replies to an email go to you.
These terms cover the rules we follow when sending those messages, and how we handle your customers' details while we do it. They apply from the first time you send us a customer list and continue for as long as we hold any of it.
2. What we need from you
- A list of customers you have completed work for, normally over the last 12 to 24 months for the first send, and then new customers from time to time.
- For each customer, their name and an email address, a mobile number, or both. Nothing else. Please do not send addresses, job details, amounts or notes.
- Your Google review link (we can get this for you if we manage your Business Profile).
3. The rules we follow, and why
UK law and Google's own rules decide how reviews can be asked for, and they apply to you and to us as the business sending the messages. Breaking them can mean fines under the Digital Markets, Competition and Consumers Act 2024, and Google can hide or remove your reviews. So:
- Send us every customer from the period, not a selection. Asking only the customers you think were happy is called "review gating", and it is unlawful. Please do not leave anyone off because of how the job went.
- No incentives. No discounts, prize draws, vouchers or favours in return for a review, from you or from us.
- We ask an open question, such as "what did we do for you, and how did it go?" We do not suggest a star rating or give customers wording to use.
- We send gradually, a few messages a day over several weeks, not all at once. A sudden burst of reviews is what Google's filters remove.
- Each customer is asked at most twice: an email first, then a text a few days later only if they have not already clicked the link. Anyone we have asked once is never asked again in a later list.
- Don't follow up on reviews to get them changed. You are welcome to reply to any review, including a critical one, but contacting a customer to ask them to change or remove a review is not allowed.
4. The messages themselves
- Every message is about the customer's experience of your business. It contains no offers or advertising.
- Every email carries an unsubscribe link, and every text a short opt-out link. Anyone who opts out is never contacted again, and an email address that bounces is never emailed again.
- You confirm that the customers on your list gave you their details in the course of buying from you, and that you have not been told by any of them not to contact them. If someone on your list has asked you not to contact them, leave them off.
5. Who decides what
You are the controller of your customers' details: they are your customers, and you decide that they should be asked for a review. We are your processor: we use the details only to send the messages in these terms and to report the results to you. We do not use them for our own purposes, add them to any mailing list, sell them, or combine them with any other client's data.
Your instructions are these terms and anything you ask of us in writing (email is fine). If we think an instruction would break data protection law, we will tell you and need not carry it out until we have discussed it. If the law requires us to do something else, we will tell you first unless the law forbids that.
6. How we look after the details
- Only our team members who run the service can see your list, and they are bound to keep it confidential.
- The list is stored in London (UK), with access limited to our team. We do not keep the file you send us once it has been loaded.
- Other providers we use are listed in the schedule below. By sending us a list you authorise us to use them. Each is bound by a contract with data protection obligations equivalent to ours, and we remain responsible to you for what they do. If we add or replace one, we will update the list and email you beforehand; if you have a concern, tell us and we will discuss it.
- Details leave the UK only to the providers in the schedule, and only where UK law permits it. The schedule says which safeguard applies to each.
- If a security breach affects your customers' details, we will tell you without undue delay, and aim to within 48 hours of confirming it, with what we know and what we have done. Deciding whether to report it to the Information Commission (the ICO) or to your customers is yours, as controller, and a report is due within 72 hours of becoming aware, so please read our notice promptly.
7. Helping you meet your obligations
If one of your customers asks you for a copy of their details, or for them to be deleted, we will find, export or delete what we hold. If such a request comes to us, we pass it to you within two working days and do not answer it ourselves unless you ask us to. We will also give you the information we hold if you need it after a breach or for the regulator. This work is charged at £70 per hour excluding VAT, and we will tell you before we start. It is not charged where the need arises from our own failure to meet these terms.
8. How long we keep the details
- A customer's name, email address and phone number are deleted 90 days after their last message (or straight away after they opt out, once the opt-out is recorded).
- After that we keep only a scrambled, one-way code for each email address and number, which cannot be turned back into the address or number. It exists only so that nobody on a later list is asked twice, and nobody who opted out is contacted again.
- We keep the totals (how many messages were sent, delivered and clicked) for your reports. They identify nobody.
- If you stop the service, tell us and we delete everything except those codes straight away. We delete the codes too if you ask, on the understanding that we can then no longer stop a repeat request.
9. Showing that we comply
We will give you the information you reasonably need to show that we meet these terms, on request. If that is not enough, you, or an auditor you appoint who is bound by confidentiality, may inspect how we handle your customers' details once a year on at least 30 days' notice, in a way that does not expose other clients' information. Time we spend on an inspection is charged at £70 per hour excluding VAT, except after a breach caused by our failure to meet these terms.
Schedule - Details of the processing
Subject matter and duration. Sending review requests to your customers on your behalf, from the first list you send us until the details are deleted under section 8.
Nature and purpose. Storing the list; sending emails and text messages; recording whether each was delivered and whether the review link was clicked; recording opt-outs; reporting totals to you.
Types of personal information. Customer names, email addresses and mobile numbers; whether and when each message was delivered and clicked; opt-outs.
Whose information it is. Your customers.
| Provider | What they do | Where the information is processed | Safeguard for transfers outside the UK |
|---|
| Supabase, Inc. | The database that holds the list | UK (London). Support staff may access it from outside the UK | UK Addendum to the EU standard contractual clauses |
| Vercel Inc. | Runs the system that sends the messages | UK (London) | UK Extension to the EU-US Data Privacy Framework; UK Addendum to the EU standard contractual clauses |
| Amazon Web Services EMEA SARL (Amazon SES) | Sends the emails | UK | Not needed |
| Twilio Inc. | Sends the text messages | United States | UK Extension to the EU-US Data Privacy Framework; UK Addendum to the EU standard contractual clauses |
Contact
Bulldogs Digital Ltd
Bank House Southwick Square, Southwick, Brighton, BN42 4FN
woof@bulldogsdigital.com
Version 1.0.