Cart

Your cart is empty

Review Magnet

Data Processing Agreement

Last updated: 7 June 2026

This Data Processing Agreement ("DPA") forms part of the agreement between you ("Customer", the data controller) and ABL Media Group, trading as Review Magnet ("Review Magnet", "we", the data processor), and applies whenever we process personal data on your behalf through the Review Magnet service. By using the service to collect or manage reviews from your own customers, you agree to this DPA.

1. Roles

For personal data about your own customers and contacts that you collect or process through Review Magnet (for example to send review requests), you are the data controller and we are your data processor. For our own account, billing and website data, we are the controller, as described in our Privacy Policy.

2. Subject matter, duration, nature and purpose

We process personal data for the duration of your use of the service, for the sole purpose of providing the service: collecting and sending review requests, capturing and displaying reviews and feedback, operating NFC and QR review tools, and providing the dashboard and reporting.

3. Types of personal data and data subjects

  • Data subjects: your customers and contacts.
  • Types of data: names, email addresses, phone numbers, the review or feedback content they provide, and related scan or interaction events.

4. Our obligations as processor

  • Process the personal data only on your documented instructions, including for international transfers, unless required otherwise by law (in which case we will inform you, unless the law prohibits it).
  • Ensure that people authorised to process the data are bound by confidentiality.
  • Implement appropriate technical and organisational security measures (Article 32 GDPR), including encryption in transit, access controls, and hashing of IP addresses in logs.
  • Assist you, taking into account the nature of processing, in responding to data subject requests and in meeting your security, breach notification and data protection impact assessment obligations.
  • Notify you without undue delay after becoming aware of a personal data breach affecting your data.
  • At your choice, delete or return the personal data at the end of the service, and delete existing copies unless we are required by law to keep them. See also our Data Retention policy.
  • Make available the information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits on reasonable notice.

5. Sub-processors

You give general authorisation for us to engage sub-processors to deliver the service. We impose data protection terms on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance. Our current sub-processors include:

  • Stripe — payment processing (billing data).
  • Resend — email delivery (review requests and notifications).
  • Twilio — SMS delivery, where SMS review requests are used.
  • Cloudflare — content delivery, security and cookieless analytics.
  • Our self-hosted application platform (Cloudron) on infrastructure we administer.

We will give you a way to be informed of any intended changes to sub-processors so you can object.

6. International transfers

Where a sub-processor processes personal data outside the European Economic Area, the transfer is protected by an appropriate safeguard such as the European Commission's standard contractual clauses.

7. Data subject requests

If we receive a request from one of your data subjects, we will, where legally permitted, direct them to you and assist you in responding. You can also action most requests directly in the dashboard.

8. Liability and governing law

This DPA is governed by the laws of Ireland and the courts of Ireland have jurisdiction. Where it conflicts with other terms between us on the subject of data protection, this DPA prevails.

9. Contact

ABL Media Group — Review Magnet
Ireland
[email protected]