Data Processing Addendum

This Data Processing Addendum is part of the agreement between you, the client, and Reyse under our Terms of Service (clause 8). It applies whenever we process personal data on your behalf to provide the Service. For that personal data, you are the controller and we are your processor, as those terms are defined in UK GDPR. If this addendum and the Terms disagree about personal data we process for you, this addendum wins.

Reyse is being registered as a limited company. Until registration completes, Reyse is operated by Morgan King, contactable at hello@reyse.co.uk. The company's legal name, company number and registered office will appear here as soon as registration completes.

• Subject matter and duration: providing the Service to you, for as long as our agreement lasts and the short time afterwards described in clause 10.
• Nature and purpose: asking your customers for reviews and following up; drafting replies to reviews for you to approve; counting and attributing your enquiries through your tracked phone number and website forms; preparing your reports; and keeping your listings and website details accurate.
• Types of personal data: names, email addresses and phone numbers of your customers whom you ask us to contact for reviews, with whether it was a sale or a let; reviewers' names and what they wrote; callers' phone numbers, call times and durations through your tracked number (and recordings only if you ask for them in writing); details people send through your tracked website forms; and your team's names, roles and work contact details.
• Data subjects: your customers and prospective customers (sellers, buyers, landlords and tenants), people who review you, call you or enquire through your website, and your staff.
• Special category data: we don't need it. Please don't send us health, financial-hardship or other special category data about your customers; if any reaches us by accident, we delete it.

We take technical and organisational measures appropriate to the risk, as Article 32 of UK GDPR requires. They include:

• access to your systems by invitation only, at the least level that does the job, and never by sharing your passwords;
• two-step sign-in on the accounts we use to hold or reach Client Personal Data;
• encryption in transit (HTTPS) and, through our hosting providers, at rest;
• access to Client Personal Data limited to the people who need it to provide the Service;
• keeping only what the Service needs, and deleting it on the schedule in clause 10.

We review these measures as the Service and the risks change.

You give us general permission to use sub-processors. These are the ones we use now, for the parts of the Service you have:

• Supabase Inc.: hosts the database that holds Client Personal Data.
• Cloudflare, Inc.: runs the service that processes it (reviews, enquiries and reports).
• Vercel Inc.: hosts reyse.co.uk, including your private report and approval pages.
• Google LLC (Google Workspace): our email, for messages with you and, where you ask us to, with your customers.
• Resend, Inc.: sends the review request emails to your customers in your name.
• OpenAI, L.L.C.: helps draft review replies, which a person checks before anything is posted.
• Anthropic PBC: helps prepare your monthly work and reports.
• Our call tracking provider, when we set up your tracked number, and our text message provider, before we first send review requests by text: we name each one here before first use, with the notice below.

We tell you in writing at least 14 days before we add or replace a sub-processor. You can object on reasonable data protection grounds within that time. If we can't resolve your objection, you can end the affected part of the Service without any penalty. We put the same data protection obligations on each sub-processor by contract, and we remain responsible to you for what they do.

• Data subject requests: if someone asks us directly to see, correct or delete their data, or objects, we pass it to you within 3 working days and don't answer it ourselves unless you ask us to. We help you answer requests, so far as our part of the processing allows.
• Personal data breaches: we tell you without undue delay, and within 48 hours of becoming aware of a breach affecting Client Personal Data, with what we know about its nature, the data and people involved, the likely consequences and what we're doing about it, adding detail as we learn it. We help you decide whether to report it to the ICO and tell the people affected.
• Assessments: we give you reasonable help with data protection impact assessments and any prior consultation with the ICO, for the processing we do for you.