Data processing agreement

This agreement applies when a business ("the Customer") uses GoldStarred to send review invitations to its own customers. It forms part of the terms for businesses. The Customer is the controller and we are the processor, under the UK GDPR and the Data Protection Act 2018. The parties are the Customer and the company named at the foot of this page ("we" or "the Processor").

1. Subject matter

We process personal data on the Customer's behalf so that the Customer can invite its customers to leave reviews, receive the reviews, and manage them.

2. Duration

Processing lasts for as long as the Customer has an account, and then until the data is deleted or returned under section 10.

3. Nature and purpose

We store the Customer's invitation lists, send invitation and reminder emails, record whether the invitee clicked the link or answered, link a review to an order reference the Customer supplied, apply suppression so that repeat invitations are blocked, and delete data when asked. We process it only for these purposes.

4. Categories of data and data subjects

• Data subjects: the Customer's customers and contacts whom the Customer chooses to invite.
• Data: name, email address, order reference, product or service name, invitation status and dates, and any review the person writes. We do not expect special category data and the Customer must not upload it.

5. Instructions

We process the data only on the Customer's documented instructions, which are these terms and the Customer's use of the service. If we think an instruction breaks data protection law, we will tell the Customer. If the law requires us to process data otherwise, we will tell the Customer first unless the law forbids it.

6. Confidentiality

Everyone who works for us and can reach the data is bound by a duty of confidence and given access only where they need it.

7. Security

We take appropriate technical and organisational measures to protect the data, including encryption in transit, access controls on our database, separation of customers' data by row-level security, limited staff access, and logging of administrative actions. Email addresses are stored only as needed for sending and suppression, and hashed where only suppression is needed. We will review these measures from time to time.

8. Sub-processors

The Customer gives general authorisation for the sub-processors below. We have a written contract with each that imposes obligations equivalent to this agreement, and we remain responsible for them.

Sub-processor	What it does
Supabase	Database, storage and sign-in
Vercel	Hosting and delivery of the service
Resend	Sending invitation and service emails

We will tell the Customer about a new or replacement sub-processor before it starts, by email or by updating this page, and the Customer may object on reasonable data protection grounds. If we cannot resolve the objection, the Customer may close its account.

9. Assistance

We will help the Customer, taking into account the nature of the processing, to answer requests from people exercising their rights, to keep the data secure, to report personal data breaches, and to carry out data protection impact assessments where needed. We will tell the Customer without undue delay after we become aware of a personal data breach affecting its data. If someone contacts us directly with a request about the Customer's data, we will pass it on to the Customer.

10. Deletion and return

The Customer's owners can download their invitation data as a CSV file, and delete the names and email addresses in it, from the Invites page. We keep only the one-way hash of each address, so the 6-month repeat window and unsubscribes still hold. We clear an invitee's name and email 30 days after the invitation is answered or closes. When the account closes, which the Customer asks for by email, we remove its members' access and delete its invitation data and its own suppression records, unless the law requires us to keep a copy. Reviews that people have chosen to publish are treated under our privacy policy and the terms for reviewers, and are not deleted simply because the Customer leaves, unless the reviewer asks.

11. Audit

We will give the Customer the information it reasonably needs to show that we comply with this agreement. The Customer, or an auditor it appoints, may audit us on reasonable notice, not more than once a year unless there has been a breach, during business hours and under confidentiality.

12. International transfers

Where a sub-processor processes data outside the UK, we will make sure a lawful transfer mechanism is in place, such as UK adequacy regulations or the UK addendum to standard contractual clauses.

13. Law and contact

This agreement is governed by the law of England and Wales. Questions go to hello@goldstarred.com. The Customer accepts this agreement by using the invitation feature.

GoldStarred is operated by Harber Glaves Trading Ltd, company number 16605946, registered in England and Wales.

Registered office: Unit A, 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.

Contact: hello@goldstarred.com