Recenzík.
Request the 30-day pilot

Data Processing Agreement

Version 1.4 · effective from the date of publication of this version on recenzik.cz.

This document describes the conditions under which we process personal data as a processor on behalf of our client (the controller). It forms an integral part of the service agreement between the provider (us) and the client (you). It complies with Article 28 of the GDPR.

1. Parties and their roles

Controller: the client — the entrepreneur who ordered the service. Processor: Bc. Xinchi Jiang, independent contractor (OSVČ), Company ID (IČO) 21591202, Jindř. Lukeše 244, 273 08 Pchery.

The client sets the rules for selecting reviews and the content of replies, and decides whether and how they are published. In Mode A, the client approves the exact wording of each reply and must also authorize us in writing to publish approved replies. In Mode B, the written authorization defines which routine replies we may publish without individual approval and which cases we must refer to the client. The authorization and any approvals are the client's instructions under Art. 3.2 of the Terms and Conditions. Technical access to the profile is not, by itself, an instruction to publish. We process personal data only on the client's documented instructions.

For our own business records, invoicing, and acquisition, we are the controller ourselves — this is described in the Privacy Policy document.

2. Subject-matter, nature, and purpose of processing

Purpose: preparing draft replies to customer reviews on one Google profile of the client and submitting them to the client for approval or for the client to publish themselves, or — during the pilot or continuous care, under a mode agreed in writing and the client's documented instructions — manually publishing them on this profile.

Nature of operations: receiving materials, storing them, accessing them, modifying their format, creating a draft reply using the language model of another processor listed in Art. 6, human review of the draft, submitting it to the client for approval or for the client to publish themselves, or manually publishing the reply on the client's Google profile within the limits of written authorization and any applicable approval, followed by deletion.

Duration of processing: for the duration of the service and no longer than 30 days after its termination, until settlement according to Art. 8.

3. Categories of data subjects

  • authors of customer reviews,
  • persons mentioned in the review text (client's employees, other guests or customers),
  • contact and approving persons on the client's side.

4. Categories of personal data

  • review text and its rating, language, date, and link to the source,
  • name or nickname of the author of the review, optionally an anonymity flag,
  • data that the author themselves included in the text — this may also include a description of health status, accusations, or other sensitive content; its scope is decided by the author, not us,
  • materials from the client: reply style, verified facts about the premises, topics we should not open, signature,
  • draft reply and record of its approval, or of its publication according to the authorization,
  • contact data of the approving person.

We do not request or process passwords, tokens, or access credentials to the client's systems.

5. Our obligations

We commit that:

  1. we process data only on documented instructions from the client, including instructions regarding transfers to a third country; if we consider that an instruction infringes legal regulations, we will point it out;
  2. we will bind to confidentiality every person who gains access to the data — currently, this is only the provider themselves;
  3. we will take appropriate technical and organizational measures under Art. 32 GDPR (see Art. 7);
  4. we will engage another processor only under the conditions set out in Art. 6;
  5. we will assist the client in handling requests from data subjects — if someone approaches us directly with a request, we will not handle the request ourselves and will pass it to the client without undue delay;
  6. we will assist the client in fulfilling obligations under Art. 32 to 36 GDPR, taking into account the nature of processing and the data available to us;
  7. upon termination of the service, we will return or delete the data at the choice of the client (Art. 8);
  8. we will provide the client with information necessary to demonstrate compliance with these obligations and allow for audits under Art. 9;
  9. we will notify the client of any personal data breach without undue delay after becoming aware of it (Art. 33(2) GDPR), and provide them with the information we have about it so they can fulfill their own notification obligation.

6. Subprocessors

The client hereby grants general written authorization for the engagement of other processors.

The current list is publicly available in the [Subprocessors](/subdodavatele) document. As of the effective date of these conditions, these mainly include:

  • language model provider (OpenAI) — processes the review text, its rating and language, the author's designation, the business name, and materials about the reply style; the processing occurs for the duration of a single API call, inputs are not stored by the provider for training,
  • email inbox and onboarding forms provider (Google Workspace) — communication with the client, materials sent by email, and answers from the onboarding form (Google Forms, optionally Google Sheets),
  • website hosting provider — technical website visit data.

The public register, purposes of engagement, and locations of individual providers are listed in the Subprocessors document. The contractually relevant categories of data remain those listed in this document.

We commit that:

  • we will impose on every subprocessor the same obligations that we have,
  • we will inform the client in advance, at least 30 days ahead, of any intended change,
  • the client may object to the change within this period; if we do not reach an agreement, they may terminate the contract and we will refund a proportionate part of the price for the unused days,
  • we are responsible to the client for the fulfillment of the subprocessor's obligations.

7. Security

Taking into account the nature of processing — it is a single-person service without client access to our systems — we apply in particular:

  • processing on our own devices and through approved suppliers,
  • access limited to a single person, the provider; no other staff and no remote access by clients or third parties,
  • separation of individual clients' materials; we do not use the materials of one client for the order of another,
  • the principle of minimization: we do not accept data we do not need to prepare the reply, especially unnecessary identifiers of review authors,
  • requirement for the model provider not to store inputs and not to use them for training (Art. 6),
  • deletion of materials after the conclusion of the order according to Art. 8,
  • no storage of access data, passwords, or client tokens.

We do not list measures here that we have not verified. A client who needs a specific commitment to encryption, backups, or recovery time can arrange it with us separately; without such an agreement, it cannot be inferred from these conditions.

We exchange materials with each other by email, or via the onboarding form. The client acknowledges that email is not a fully secure channel and commits not to send us via email or the form data beyond what is necessary to prepare the reply.

8. Return and deletion

Upon termination of the service, the client chooses whether we return or delete the materials. If they do not communicate their choice within 30 days of termination, we will delete the materials.

Deletion includes review texts, author designations, all versions of draft replies including rejected ones, materials about style and verified facts, even in working copies, in email communication, and in answers from the onboarding form.

We may only retain:

  • minimal contractual and billing records, which the law obliges us to keep,
  • a record of the scope and time of the order for the possible defense of legal claims.

These records do not contain review texts or data of their authors.

We will confirm the deletion in writing upon request.

9. Audit

Upon the client's written request, we will provide them with information necessary to demonstrate compliance with these conditions.

The client may conduct an inspection once a year; they will announce the date at least 30 days in advance and conduct it in such a way as not to disrupt our operations and not to endanger the data of other clients. The costs of the inspection are borne by the client, unless a material breach on our part is proven.

10. Transfers outside the EU

Our own processing takes place in the Czech Republic.

Transfers outside the EU/EEA occur to the extent performed by the providers listed in the Subprocessors document — especially the transfer of the review text and related data to the language model provider. These transfers are based on standard contractual clauses adopted by the European Commission, or an adequacy decision, according to the contractual terms of the given provider.

Outside this framework, we do not transfer data to third countries.

11. Duration

These conditions apply for the period during which we process personal data for the client, and their provisions on confidentiality, deletion, and audit survive even after the termination of the contract.

Termination of the contract does not extinguish the obligations under Art. 8.