Data processing terms

You are the controller of your customers’ personal data: you decide whose details go in and what they are asked. Praze is your processor: we hold and send on your instructions and for no other purpose.

These terms form part of your agreement with us under our terms and apply for as long as you have an account. They are made between you and Billy Pitman, trading as Praze.

• Whose details: the customers of your business whose details you enter, import, or send through the API.
• What details: name, mobile number, email address, the job and its date, any note you add, the messages sent to them, whether those were delivered, whether the review link was opened, the IP address it was opened from, and anything they text back.
• What we do with them: store them, send the review request and one reminder, record what happened, and show it to you.
• For how long: while your account is open, and until you ask us to delete them after it closes.

• Only act on your instructions. Using Praze in the ordinary way is the instruction. We will not process your customers’ details for anything else, and if the law ever required us to, we would tell you first unless the law forbade that too.
• Keep them secure. Encrypted in transit and at rest, access limited to the few people who need it, and every administrative action on an account recorded.
• Keep our staff bound to confidence.
• Use only the sub-processors listed in our privacy policy — today Twilio, Resend, Stripe, Clerk, Google and Railway — each under written terms no weaker than these. We will give you 30 days notice by email before adding or changing one, and you may end your subscription without penalty if you object.
• Help you answer your customers. If one of them asks to see, correct or delete what you hold, tell us and we will do our part. If one contacts us directly we will pass it to you rather than answer for you.
• Tell you quickly if something goes wrong. If there is a personal data breach affecting your customers we will tell you without undue delay and in any event within 48 hours of becoming aware, with what we know and what we are doing.
• Delete it when you say. On request after your account closes we will delete your customers’ details, except anything we must keep by law.
• Let you check. We will give you the information you reasonably need to satisfy yourself we are doing all this, and submit to an audit where the law requires one.

• That you have a lawful basis for each person you ask us to message, and that you obtained their details in the course of doing work for them.
• That the details you give us are accurate, and that you keep them so.
• That you tell your customers, in your own privacy notice, that you use a service to send review requests on your behalf.
• That you act on opt-outs made to you directly, as we act on those made to us.

Some of our sub-processors operate outside the UK. Where personal data leaves the UK we rely on the safeguards the law provides — an adequacy decision, or the International Data Transfer Addendum to the EU standard contractual clauses. You authorise those transfers by agreeing to these terms.

Where these terms and our terms disagree about personal data, these terms win. Where they and UK data protection law disagree, the law wins.