Data & Security

Data Processing Agreement

Last updated: March 2026 · Rated Reviews Pty Ltd · ABN 80 169 872 326

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Rated Reviews Pty Ltd (ABN 80 169 872 326) ("Rated Reviews", "we", "us") and you, the customer ("you", "Controller"), and governs the processing of personal data that you upload to or generate through our review management platform.

This DPA applies to the extent that Rated Reviews processes personal data on your behalf in connection with the services described in our Terms of Service. We are committed to processing your data securely, lawfully and in compliance with applicable Australian privacy legislation.

Plain English summary: You own your customers' data. We process it only to deliver the services you've asked for. We never sell it, share it for our own purposes, or use it for anything beyond operating your account.

2. Definitions

  • Personal Data — any information relating to an identified or identifiable individual, including your customers' names, email addresses and phone numbers
  • Controller — the party that determines the purposes and means of processing personal data (you, our customer)
  • Processor — the party that processes personal data on behalf of the Controller (Rated Reviews)
  • Processing — any operation performed on personal data, including collection, storage, use, disclosure or deletion
  • Sub-Processor — a third party engaged by Rated Reviews to process personal data in connection with the services
  • Australian Privacy Law — the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs)

3. Scope and Roles

When you upload customer contact lists, configure review request campaigns or generate reviews through our platform, you act as the Controller of that personal data. Rated Reviews acts as the Processor, processing data only on your documented instructions.

The personal data we process on your behalf includes:

  • Customer names, email addresses and phone numbers (uploaded by you for review requests)
  • Review request delivery status and customer responses
  • Private feedback submitted through the Review Capture Program
  • Review content pulled from connected platforms (Google, Facebook, etc.) that you authorise

4. Our Obligations as Processor

Rated Reviews agrees to:

  • Process personal data only on your documented instructions and for no other purpose
  • Ensure all personnel with access to personal data are bound by confidentiality obligations
  • Implement appropriate technical and organisational security measures
  • Assist you in responding to data subject access requests within required timeframes
  • Delete or return all personal data upon termination of your account, at your choice
  • Make available all information necessary to demonstrate compliance with this DPA
  • Notify you of any personal data breach within 72 hours of becoming aware of it
  • Not engage sub-processors without your prior written authorisation (general authorisation is granted by acceptance of these terms — see Section 6)

5. Your Obligations as Controller

As the Controller of your customers' personal data, you are responsible for:

  • Ensuring you have a lawful basis to collect and share your customers' personal data with us
  • Obtaining any required consents from your customers before sending review requests
  • Complying with the Australian Spam Act 2003 when sending SMS and email communications through our platform
  • Ensuring your use of the platform complies with applicable privacy laws in your jurisdiction
  • Notifying us promptly if you become aware of any potential breach related to your account
  • Ensuring customer data uploaded to the platform is accurate and up to date

6. Sub-Processors

By accepting our Terms of Service, you provide general written authorisation for Rated Reviews to engage the sub-processors listed below. We will notify you of any changes to our sub-processor list with reasonable notice.

Sub-Processor Location Purpose
Amazon Web Services (AWS) Australia / USA Cloud infrastructure and data storage
Stripe USA Payment processing
Twilio / SendGrid USA SMS and email delivery
Google Cloud Australia / USA AI processing and Google API integrations
Cloudflare USA Security, DDoS protection and CDN

Each sub-processor is contractually bound to process data only as instructed and to maintain appropriate security standards. We remain responsible for our sub-processors' compliance with this DPA.

7. Data Security

Rated Reviews implements the following technical and organisational security measures to protect personal data:

  • SSL/TLS encryption for all data in transit (minimum TLS 1.2)
  • Encryption of personal data at rest using AES-256
  • Role-based access controls limiting data access to authorised personnel only
  • Regular security assessments and penetration testing
  • Multi-factor authentication for internal systems
  • Audit logging of data access and processing activities
  • Regular staff training on data protection obligations

8. Data Retention and Deletion

We retain personal data for as long as your account is active or as required to provide the services. Upon cancellation or termination of your account:

  • Your account data is retained for 30 days to allow for reactivation
  • After 30 days, personal data is permanently deleted from our systems
  • Anonymised, aggregated statistical data may be retained indefinitely
  • You may request immediate deletion of your data by contacting us at get@ratedreviews.com.au
  • Data required to be retained for legal or regulatory purposes will be held for the minimum required period

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, Rated Reviews will:

  • Notify you within 72 hours of becoming aware of the breach
  • Provide details of the nature of the breach, data affected and likely consequences
  • Describe the measures taken or proposed to address the breach
  • Assist you in notifying affected individuals and relevant authorities as required under the Notifiable Data Breaches scheme

10. Your Data Subject Rights

Under Australian Privacy Law, your customers have the right to access, correct and in some circumstances request deletion of their personal data. If you receive a request from one of your customers relating to data processed through our platform, we will assist you in responding within statutory timeframes.

To exercise these rights or submit a request, contact us at get@ratedreviews.com.au. We will respond within 30 days.

11. International Data Transfers

Some of our sub-processors are located outside Australia (primarily in the United States). Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including contractual clauses requiring the recipient to maintain standards consistent with Australian privacy law.

By using our services, you consent to these international transfers as described in this DPA.

12. Governing Law

This DPA is governed by the laws of New South Wales, Australia, and is subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Any disputes arising under this DPA will be subject to the exclusive jurisdiction of the courts of New South Wales.

13. Contact Us

For any questions relating to this Data Processing Agreement or our data handling practices, please contact our Privacy Officer:

For related policies, see our Privacy Policy, Terms of Service and Cookie Policy.