RECENSIO LIMITED — a private company limited by shares, incorporated in Ireland Company registration number (CRO): 820098 Registered office: Unit 2, 2 Bridge Street, Athlone, Co. Westmeath, N37 F1W4, Ireland Data protection contact: support@recensio.ai
This is the original English-language version of this Data Processing Agreement. Translations are provided for convenience. In the event of any conflict or inconsistency between the English version and a translation, the English version prevails.
1. Scope and purpose of this Agreement
This Data Processing Agreement (the "DPA") forms part of the Terms of Service (the "Terms") between RECENSIO LIMITED ("Recensio", "we", "us") and the business that registers for or uses the Recensio service (the "Customer", "you"). Capitalised terms not defined here have the meaning given in the Terms.
This DPA applies to the personal data that Recensio processes on your behalf and on your instructions in providing the Service — in particular the content of the Google reviews of the businesses you connect, the names of the people who wrote them, the attributes inferred from each review to adapt the reply, and the replies drafted and published (together, "Customer Data"). The details of that processing are set out in Annex I.
This DPA does not apply to personal data for which Recensio is itself the controller (your account, subscription and billing data, and data about visitors to our website). That processing is described in our Privacy Policy.
This DPA is intended to satisfy the requirements of Article 28(3) of Regulation (EU) 2016/679 (the "GDPR"). By accepting the Terms, you accept this DPA. In the event of conflict between this DPA and the Terms regarding the processing of Customer Data, this DPA prevails.
2. Definitions
"Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in Article 4 GDPR.
"Sub-processor" means any third party engaged by Recensio to process Customer Data on Recensio's behalf.
"Data Protection Law" means the GDPR, the Irish Data Protection Act 2018, and any other data protection law applicable to a party.
3. Roles of the parties
3.1 Customer as controller, Recensio as processor. For Customer Data, you are the controller and Recensio is your processor. You determine the purposes and means of the processing — you decide which businesses to connect, which reviews are managed, how replies are handled, and when data is deleted. Recensio processes Customer Data only to provide the Service to you.
3.2 Agency customers. If you use the Service to manage the Google Business Profiles of businesses that are not your own (for example under our Agency plan), you may yourself be acting as a processor on behalf of those businesses, which are then the controllers. In that case, Recensio acts as your sub-processor, and the obligations that this DPA places on Recensio apply to that processing. You warrant that you hold, from each such business, the authority and instructions necessary to engage Recensio under this DPA, that you have entered into a written agreement with that business that meets Article 28 GDPR, and that you will pass on to that business any information Recensio provides under this DPA that it needs to meet its own obligations.
3.3 Your responsibilities as controller. You are responsible for the lawfulness of the processing you instruct, including for having a valid legal basis to manage and respond to the reviews of the businesses you connect, for providing data subjects with the information required by Articles 13 and 14 GDPR (which, for reviewers, may be provided through our publicly available Privacy Policy as described in Annex I), and for the automation settings you choose.
4. Processing on documented instructions
4.1 Recensio will process Customer Data only on your documented instructions, including with regard to transfers of personal data to a third country, unless required to do so by Union or Member State law to which Recensio is subject; in that case Recensio will inform you of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.
4.2 Your documented instructions are: (a) the Terms and this DPA; (b) the configuration you set within the Service, in particular which businesses you connect, your business profile and custom instructions, and the automation mode you select and expressly confirm; (c) your use of the Service's functions, such as approving, editing or rejecting a reply, or deleting a business or your account; and (d) any further written instruction you give that is consistent with the Terms. Recensio may charge a reasonable fee for complying with instructions that go beyond the functionality of the Service.
4.3 Recensio will inform you without undue delay if, in its opinion, an instruction infringes Data Protection Law. Recensio is not obliged to carry out a legal review of your instructions.
5. Purpose limitation — a binding condition of the Service
Recensio will not process Customer Data for any purpose of its own. In particular, Recensio will not:
- analyse, aggregate or compare Customer Data across customers;
- use Customer Data, or any examples derived from your approved replies, to train, fine-tune or improve any artificial-intelligence or machine-learning model, whether its own or a third party's; the examples we store to keep replies consistent with your voice are used only to serve the business they belong to;
- sell, rent, license or otherwise make Customer Data available to any third party other than a Sub-processor acting on Recensio's behalf; or
- use Customer Data for advertising, marketing, or any purpose other than providing, securing and supporting the Service.
Recensio may process technical and aggregated information about the operation of the Service — such as volumes, error rates and the outcomes of its automated quality and safety checks — that does not identify any data subject, in order to operate, secure and improve the Service. This restriction also reflects our obligations under the Google API Services User Data Policy, including its Limited Use requirements.
6. Confidentiality
Recensio will ensure that every person it authorises to process Customer Data is bound by a contractual or statutory obligation of confidentiality and processes Customer Data only on Recensio's instructions. Access to Customer Data is restricted to what is necessary to provide, secure and support the Service.
7. Security
7.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risk for the rights and freedoms of natural persons, Recensio will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. The measures currently in place are described in Annex II.
7.2 Recensio may update the measures in Annex II from time to time, provided that the updates do not materially reduce the overall level of security of the Service.
7.3 You are responsible for the security of the credentials used to access your account, for the people you authorise to access it, and for the automation settings you enable.
8. Sub-processors
8.1 General authorisation. You give Recensio general authorisation to engage Sub-processors to process Customer Data. The Sub-processors engaged at the date of this DPA are listed in our Sub-processor List at https://recensio.ai/sub-processors, which forms part of this DPA (Annex III), together with the purpose of each engagement, the data each Sub-processor receives, its processing location and the transfer safeguard relied upon.
8.2 Notice of changes and right to object. Recensio will update the Sub-processor List before adding or replacing a Sub-processor and will take reasonable steps to inform you, including by notice within the Service or by email to the address on your account, at least 30 days before the new Sub-processor begins processing Customer Data. You may object to the change, on reasonable and documented data protection grounds, by writing to support@recensio.ai within that period. Recensio will work with you in good faith to address the objection. If no solution can be found within a reasonable time, either party may terminate the affected subscription, and Recensio will refund any fees prepaid for the period after termination. If you do not object within the period, the change is deemed accepted.
8.3 Flow-down. Recensio will impose on each Sub-processor, by way of a written contract, data protection obligations that are in substance no less protective than those set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures. Recensio remains fully liable to you for the performance of the Sub-processor's obligations.
9. International transfers
9.1 Recensio hosts Customer Data at rest in the European Union (Frankfurt). Some Sub-processors are established outside the European Economic Area, or may access Customer Data from outside it, in particular in the United States.
9.2 Recensio will not transfer Customer Data, or permit it to be transferred, to a country outside the European Economic Area unless the transfer is covered by an appropriate safeguard under Chapter V GDPR: an adequacy decision of the European Commission (including, for certified United States organisations, the EU-US Data Privacy Framework), the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), or another valid mechanism. The safeguard relied upon for each Sub-processor is stated in the Sub-processor List.
10. Assistance to the Customer
10.1 Data subject requests. Taking into account the nature of the processing, Recensio will assist you, by appropriate technical and organisational measures and insofar as this is possible, in fulfilling your obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR. If Recensio receives such a request directly from a data subject in relation to Customer Data, it will not respond on the merits but will, where the business concerned can be identified, forward the request to you without undue delay and direct the data subject to you. Within the Service you can view, edit and delete the data of the businesses you manage; where a request requires action that the Service does not provide, Recensio will assist you on written request.
10.2 Security, breach, impact assessment and prior consultation. Taking into account the nature of the processing and the information available to it, Recensio will assist you in ensuring compliance with your obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation with the supervisory authority), including by providing the information in Annex II and the Sub-processor List.
10.3 Recensio may charge a reasonable fee for assistance that goes beyond what the Service provides, except where the need for assistance results from Recensio's own breach of this DPA.
11. Personal data breach
11.1 Recensio will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notification will be sent to the email address on your account.
11.2 The notification will describe, to the extent known at the time, the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a point of contact. Where the information is not available at the time, Recensio will provide it in phases without undue further delay.
11.3 Recensio will cooperate with you and take reasonable steps to assist you in your investigation, mitigation and remediation of the breach. The notification of, or response to, a breach by Recensio is not an acknowledgement of fault or liability.
12. Deletion and return of Customer Data
12.1 During the Service. You can delete the data of any business you manage, or your whole account, at any time from within the Service. When you delete a business, Recensio revokes the Google authorisation for that business with Google and deletes the business's reviews, inferred attributes, replies and stored examples; when you delete your account, the same happens for every business on the account, together with your account data, as described in our Privacy Policy.
12.2 At the end of the Service. On termination or expiry of your subscription, and in any case on deletion of your account, Recensio will delete all Customer Data, unless Union or Member State law requires it to be retained. Before deletion, you may request a copy of the Customer Data of the businesses you manage in a commonly used, machine-readable format; Recensio will provide it within 30 days of the request.
12.3 Residual copies. Customer Data deleted from the live database may persist in backups until those backups expire. Backups are encrypted, kept in the EU and retained for no more than 7 days. Such copies are not accessible for any processing other than restoring the Service, and remain protected by the measures in Annex II until expiry.
13. Audit and information
13.1 Recensio will make available to you all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and this DPA. Recensio will respond to reasonable written requests for information about its processing of Customer Data within 30 days, and may satisfy such requests by providing this DPA, Annex II, the Sub-processor List, and any available certifications or audit reports of its Sub-processors.
13.2 Where the information provided under Section 13.1 is not reasonably sufficient for you to verify compliance, you may, not more than once in any 12-month period (or more often where required by a supervisory authority or following a personal data breach), carry out or mandate an independent auditor bound by confidentiality to carry out an audit of Recensio's processing of Customer Data. You will give at least 30 days' written notice, agree the scope, timing and duration with Recensio in advance, conduct the audit during normal business hours in a way that does not unreasonably disrupt Recensio's operations, and bear your own costs and Recensio's reasonable costs of the audit. Recensio will contribute to the audit. Audit findings are confidential, except where disclosure to a supervisory authority is required.
14. Liability
The liability of each party under this DPA is subject to the exclusions and limitations of liability set out in the Terms, except to the extent that Data Protection Law does not permit such exclusion or limitation. Nothing in this DPA affects the rights of data subjects under Article 82 GDPR.
15. Term, termination and survival
This DPA takes effect when you accept the Terms and remains in force for as long as Recensio processes Customer Data on your behalf. Sections 5, 6, 12, 13 and 14 survive termination for as long as Recensio retains any Customer Data.
16. Changes to this DPA
Recensio may update this DPA where required by a change in Data Protection Law, in guidance of a supervisory authority, or in the Service. Recensio will change the "last updated" date and, where the change materially reduces your rights or Recensio's obligations, give you at least 30 days' notice. Your continued use of the Service after the notice period constitutes acceptance of the updated DPA; if you do not accept it, you may terminate the affected subscription.
17. Governing law and jurisdiction
This DPA is governed by the laws of Ireland. The courts of Ireland have exclusive jurisdiction over any dispute arising out of or in connection with this DPA, without prejudice to the rights of data subjects and supervisory authorities under the GDPR.
Annex I — Details of the processing
Subject matter. The provision of the Recensio service: retrieving the Google reviews of the businesses the Customer connects, analysing them, drafting replies in the business's tone of voice and, according to the Customer's automation settings, publishing approved replies to the Google Business Profile on the Customer's behalf; and notifying the Customer of replies that require approval.
Duration. For as long as the Customer uses the Service for the business concerned, and until the Customer Data is deleted in accordance with Section 12.
Nature of the processing. Collection (reading from the Google Business Profile API with the Customer's authorisation), storage, analysis by an artificial-intelligence model, generation of text, transmission to the Customer (dashboard, WhatsApp and email notifications), publication to Google on the Customer's instruction, and deletion.
Purpose of the processing. To enable the Customer to manage and respond to the reviews of its business or of the businesses it manages. No other purpose (Section 5).
Categories of data subjects.
- Individuals who have written a Google review of a business connected to the Service ("reviewers").
- Staff members of the Customer's business where they are mentioned in a review or in the Customer's own instructions.
Categories of personal data.
- For each review: the review identifier, the reviewer's display name as shown on Google, the star rating, the review text, and any reply drafted or published through the Service.
- Attributes inferred from each review in order to adapt the reply: the register or tone of the review; whether a competitor or a staff member is mentioned; and behavioural indicators such as apparent customer type, visit frequency, likelihood of returning and group type. These attributes are used only to adapt the reply and have no legal or similarly significant effect on the reviewer.
- Examples derived from the Customer's approved replies and corrections, used only for the business they belong to.
- The reviewer's profile photo URL, the review's creation and update time, and any pre-existing reply are read to operate the Service but are not stored.
Special categories of data. The Service does not infer special categories of data. The free text of a review, written by the reviewer, may incidentally contain such data where the reviewer chooses to reveal it (for example in reviews of businesses in a healthcare context). Where it does, it is processed only to draft the reply, is not extracted into any structured field, and is subject to the measures in Annex II. The Customer is responsible for assessing whether its use of the Service for such a business is lawful.
Information to data subjects. Reviewers are not customers of Recensio and cannot normally be contacted directly. The information required by Article 14 GDPR is provided through Recensio's publicly available Privacy Policy, relying on Article 14(5)(b) GDPR. The Customer remains responsible for its own transparency obligations.
Retention. Customer Data is retained for the duration of the Service for the business concerned and deleted as set out in Section 12.
Annex II — Technical and organisational measures
The measures below are those in place at the date of this DPA. They are reviewed over time and may be updated in accordance with Section 7.2.
Hosting and data location. Application hosting and compute, the database, the rate-limiting layer and the error-monitoring ingest are located in the European Union (Frankfurt and Germany). Customer Data at rest is stored only in the EU database.
Encryption. All data is encrypted in transit using TLS. The Google authorisation credential (refresh token) is encrypted at rest with AES-256-GCM before storage; the encryption key is held in a dedicated environment variable, separate from the database, and encryption is versioned so that keys can be rotated without re-exposing data. Database storage is encrypted at rest by the hosting provider.
Access control. Access to Customer Data in the database is governed by row-level security: each user can access only the data of the businesses they own or are authorised members of. The stored Google credential is readable only by the application's service role, never by user sessions. Administrative access to production systems is restricted to Recensio personnel, protected by strong authentication, and used only for operating and supporting the Service.
Credential and secret management. Secrets are held in environment variables of the hosting platform, never in source code. Webhooks from third-party providers are verified by signature. Scheduled jobs are authenticated with a dedicated secret compared in constant time.
Minimisation of data sent to third parties. Only the data needed for each Sub-processor's function is sent to it, as detailed in the Sub-processor List. In particular: the artificial-intelligence provider receives the reviewer's name, the review text, business context and approved examples, and the prompt is neither logged nor retained by Recensio; the email provider never receives review text; the error-monitoring provider never receives review text or reviewer names, and error reports are sent only through a wrapper that controls what is included.
Purpose and tenant separation. Customer Data is logically separated per business. Learning examples are bound to the single business they derive from. No cross-customer analytics, pooling or model training takes place (Section 5).
Automation safeguards. Automatic approval of replies is off by default and can only be enabled by the Customer's explicit, recorded confirmation, which can be withdrawn at any time with immediate effect. A quality-control check assesses every reply before automatic publication; a safety mechanism detects sensitive or critical content and holds the affected reply for manual review in every mode; a reply is never published automatically without a valid quality-control verdict on the exact text to be published.
Abuse prevention and availability. Sign-up and login are protected against automated abuse. Requests are rate-limited. The Service is hosted on a platform with redundant infrastructure. Application errors are monitored centrally.
Deletion and disconnection. Disconnecting a business or deleting an account revokes the Google authorisation with Google and deletes the stored credential; deletion of a business does not proceed if revocation fails, so that no orphaned credential is left behind. Deletion of an account removes related records by cascading deletion.
Backups. Backups are encrypted, kept in the EU and retained for no more than 7 days.
Organisational measures. Recensio is a small organisation; every person with access to Customer Data is bound by confidentiality and acts on Recensio's instructions. Sub-processors are engaged under written data processing agreements. Legal documents are kept consistent with the actual behaviour of the Service, and changes to data flows are reviewed for data protection impact before release.
Annex III — Sub-processors
The Sub-processors authorised at the date of this DPA, with the purpose of each engagement, the personal data each receives, its processing location and the transfer safeguard relied upon, are listed at https://recensio.ai/sub-processors. That list forms part of this DPA and is updated in accordance with Section 8.
Contact
RECENSIO LIMITED Unit 2, 2 Bridge Street, Athlone, Co. Westmeath, N37 F1W4, Ireland Company registration number (CRO): 820098 Email: support@recensio.ai