Website reviews processor terms
Version 2026-10-22.1
These processor terms form the data processing agreement required by Article 28 of the UK GDPR between you (the controller) and Budd and Todd Ltd (company number 13766118), trading as RatingsPlus (the processor), for the review invitations we send on your behalf. They are part of the Website reviews terms.
1. Two roles, kept apart
- Invitations — we are your processor. The order details you give us (buyer name, email address, order reference, order date) are your customers' personal data. We use them only to invite and remind that buyer to review you, on your documented instructions, which are these terms and the settings you choose in your dashboard.
- Published reviews — we are a controller. Once a buyer writes a review, the review, the name they chose to show, and our decisions about it are ours to look after as an independent controller, under the RatingsPlus privacy policy. That is what lets us keep a review up when you would rather it came down, and act on the reviewer's own requests.
2. What we process for you
| Subject matter | Detail |
|---|---|
| Data subjects | Your customers who placed an order you tell us about. |
| Personal data | Name, email address, order reference, order and fulfilment dates, and which invitations and reminders were sent, opened or acted on. |
| Purpose | Sending review invitations and reminders for that order, and nothing else. |
| Duration | Each order record is deleted 180 days after fulfilment. A review already written keeps only its label (Invited or Verified order), not the order record. |
3. Order emails you copy to us (BCC)
When you copy us into an order email we read only what we need to identify the order: the recipient's address, the order reference and the date. We never store the body or the subject of the email. We accept a copied email only through the private BCC address assigned to your store and when the sender domain matches your store. Where the receiving provider's authenticated results are configured and can be verified, we require an aligned SPF or DKIM pass for that domain. We do not trust authentication headers supplied by the sender. We do not invite the same address for the same store twice within 14 days.
4. Our obligations as processor
- We process the data only on your documented instructions, unless the law requires otherwise, in which case we tell you first where we lawfully can.
- Everyone at RatingsPlus with access to it is bound by confidentiality.
- We keep it secure with measures appropriate to the risk (Article 32), including encryption in transit, access control, and hashing rather than storing IP addresses in the clear.
- We honour every opt-out. An address that has unsubscribed from review requests is never invited again, by you or any other store using RatingsPlus.
- We help you answer your customers' data protection requests and, where relevant, with security, breach notification and data protection impact assessments.
- We tell you without undue delay after becoming aware of a personal data breach affecting your customers' data.
- At the end of the service we delete the order data, subject to the retention period above, and do not keep copies unless the law requires us to.
- On reasonable written request no more than once each year, we make available the information needed to show we meet these obligations. If that information is not reasonably sufficient, we allow a reasonable audit or inspection during normal business hours, with at least 30 days' notice, subject to confidentiality, security and access controls. You meet your own audit costs unless the audit finds our material breach.
5. Sub-processors
You give general authorisation for the sub-processors listed below. We will tell you before adding or replacing one, so you can object. Each is bound by data protection terms no less protective than these.
- Postmark (ActiveCampaign) — receiving copied order emails and sending invitation emails.
- KCOM Group Limited, United Kingdom — network infrastructure supporting the hosted application.
6. International transfers
Where a sub-processor processes data outside the United Kingdom, we use an adequacy regulation or the UK International Data Transfer Agreement or Addendum, as applicable to that transfer. We will provide information about the relevant safeguard on reasonable written request, subject to confidentiality and security controls.
7. Electronic marketing
A review invitation is a service message about an order the buyer placed, not marketing; it carries no promotion and always offers a one-click opt-out, consistent with PECR. You will not ask us to add marketing content to it.