Data Processing Agreement
Last updated: 2026-08-26
This Data Processing Agreement (“DPA”) applies where Talk2UsNow (“we”, “us”, the processor) processes personal data on behalf of a business customer (“you”, the controller) in connection with the Service. It forms part of, and is governed by, our Terms of Service. Where this DPA conflicts with the Terms on the processing of personal data, this DPA prevails. Capitalised data-protection terms have the meaning given in applicable data protection law (including the GDPR and UK GDPR).
1. Roles
For customer feedback and related personal data submitted through your Talk2UsNow account, you are the controller and Talk2UsNow is the processor. For account, billing, security, and service-operation data, Talk2UsNow acts as a controller in its own right, as described in our Privacy Policy, and that processing is outside this DPA.
2. Subject matter, duration, nature & purpose
The subject matter is the processing of personal data needed to provide the Service. Processing lasts for the term of your account plus any limited post-termination period described below. The nature and purpose is to collect, store, route, display, alert on, and analyse customer feedback so you can respond to it and invite public reviews.
3. Types of data & categories of data subjects
- Data subjects: your customers who submit feedback, and your authorised users.
- Personal data: star ratings, optional name, phone number, feedback text, a device identifier used to prevent abuse, and related usage events. You must not submit special categories of personal data (such as health data) through the feedback form unless expressly agreed in writing and supported by appropriate safeguards.
4. Processing on your instructions
We process personal data only on your documented instructions, including those given through your use and configuration of the Service, unless required otherwise by law (in which case we will inform you where legally permitted). We will tell you if, in our opinion, an instruction infringes applicable data protection law.
5. Confidentiality
We ensure that personnel authorised to process personal data are bound by appropriate confidentiality obligations and access it only as needed to provide and support the Service.
6. Security
We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, tenant isolation, access controls, and other measures described on our Security page, taking into account the state of the art, the costs of implementation, and the risks of the processing.
7. Sub-processors
You authorise us to engage sub-processors to provide the Service. Our current sub-processors include Supabase (database and authentication), Vercel (hosting), Resend (email delivery), and Lemon Squeezy (billing). We impose data-protection obligations on our sub-processors that are appropriate to their role, remain responsible for their performance of those obligations, and will give notice of material changes to our sub-processors where required by applicable law.
8. Assistance with data-subject rights
As the controller, you are responsible for responding to requests from data subjects (such as access, correction, deletion, and portability). Taking into account the nature of the processing, we will provide reasonable assistance, including through the Service’s export and deletion features, to help you respond. If a data subject contacts us directly about feedback you control, we will refer them to you where appropriate.
9. Personal data breaches
If we become aware of a personal data breach affecting personal data we process on your behalf, we will notify you without undue delay and provide the information reasonably available to us to help you meet your own notification obligations.
10. Assistance with assessments
Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and any prior consultation with a supervisory authority that applicable law requires of you.
11. Deletion or return
You can export your data from the dashboard during your account and for 30 days after it ends. After that period, we will delete or anonymise personal data processed on your behalf, except where retention is required by law or reasonably necessary for security, fraud prevention, or dispute resolution.
12. Audits & information
We will make available information reasonably necessary to demonstrate compliance with this DPA and will contribute to audits or inspections reasonably required by you, subject to reasonable confidentiality, security, and scheduling protections and to protecting other customers’ data.
13. International transfers
Where personal data is transferred to a country without an adequacy decision, we and our sub-processors rely on appropriate safeguards required by applicable law, such as Standard Contractual Clauses or other legally recognised transfer mechanisms.
14. General
This DPA is subject to the limitation of liability and governing-law provisions of the Terms of Service. To request a signed copy of this DPA, or with any question, email hello@talk2usnow.com.