Legal
Data Processing Information
Scope
During engagements we typically access client systems (analytics, Search Console, CMS, Google Business Profile) containing limited personal data such as reviewer names or enquiry records. For that data we act as a processor on the client’s documented instructions under a data processing agreement issued with every service contract.
Sub-processors
Current sub-processors: HubSpot (CRM), Make (automation), Resend (email), our hosting provider, and Google Workspace (business systems). Clients are notified of sub-processor changes in advance through the mechanism in the DPA.
Security measures
Access by invitation rather than shared passwords; multi-factor authentication on all business systems; a password manager with per-client vaults; least-privilege access; encrypted devices; documented offboarding that revokes access at engagement end.
Client responsibilities
Clients remain controllers of their customer data and are responsible for the lawfulness of their own marketing lists and review practices. We will decline instructions that would breach data protection law — for example, scraping personal data or fabricating reviews.