GDPR Compliance

1. Overview

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that applies to all organisations that process personal data of individuals in the European Economic Area (EEA) and the United Kingdom. It came into force on 25 May 2018.

AutoReviewsPilot takes data protection seriously. This page explains how we comply with GDPR and what it means for you as a user of our platform.

For general information about how we process your data, please refer to our Privacy Policy.

2. Data Controller & Data Processor

Under GDPR, there are two key roles in data processing:

AutoReviewsPilot as Data Controller

When you create an account and use our service, AutoReviewsPilot is the Data Controller for your account data (name, email, billing information, etc.). We determine the purposes and means of processing this data.

AutoReviewsPilot as Data Processor

When you upload your customers' contact information to our platform to send review request emails, you are the Data Controller for your customers' data, and AutoReviewsPilot acts as your Data Processor.

This means:

• You are responsible for ensuring you have a lawful basis to process your customers' data
• You must ensure your customers are aware their data may be used to request reviews
• We process your customers' data only according to your instructions and this agreement
• We have implemented technical and organisational security measures to protect the data

3. Lawful Basis for Processing

We process personal data under the following lawful bases as required by GDPR Article 6:

Processing Activity	Lawful Basis	GDPR Article
Account creation and management	Contract performance	Art. 6(1)(b)
Payment processing and billing	Contract performance	Art. 6(1)(b)
Sending transactional emails	Contract performance	Art. 6(1)(b)
Security and fraud prevention	Legitimate interests	Art. 6(1)(f)
Technical platform improvement	Legitimate interests	Art. 6(1)(f)
Tax and financial record keeping	Legal obligation	Art. 6(1)(c)
Marketing communications	Consent	Art. 6(1)(a)

4. Your Rights Under GDPR

GDPR grants data subjects (individuals whose data is processed) the following rights. We are committed to facilitating these rights.

Right of Access (Article 15)

You have the right to obtain a copy of all personal data we hold about you and information about how we process it. We will respond within 1 month (extendable by 2 months for complex requests).

Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected. You can update most of your data directly in your account settings.

Right to Erasure (Article 17)

You have the right to request deletion of your personal data when:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent (where consent is the legal basis)
• You object to processing and there are no overriding legitimate interests
• The data has been unlawfully processed

Note: We may retain certain data for legal obligations (e.g., financial records required by tax law).

Right to Restriction (Article 18)

You may request restriction of processing while accuracy is contested, or while an objection is being considered.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV) and to transmit that data to another controller.

Right to Object (Article 21)

You have the right to object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.

Rights Related to Automated Decision-Making (Article 22)

AutoReviewsPilot does not make automated decisions that produce legal or significant effects on individuals.

How to Exercise Your Rights

Submit a request to privacy@autoreviewspilot.com with the subject line "GDPR Rights Request". We will verify your identity and respond within 30 days. Requests are free of charge.

5. Data Processing Agreement (DPA)

If your business requires a formal Data Processing Agreement (DPA) under GDPR Article 28 (e.g., for enterprise compliance), please contact us at legal@autoreviewspilot.com.

Our standard DPA covers:

• Subject matter and duration of processing
• Nature and purpose of processing
• Type of personal data and categories of data subjects
• Obligations and rights of the controller
• Sub-processor list and approval mechanism
• Security measures implemented
• Assistance with data subject rights
• Deletion/return of data upon contract end
• Audit rights

6. International Data Transfers

Under GDPR Chapter V, transferring personal data outside the EEA requires appropriate safeguards. Where we use service providers outside the EEA, we ensure adequate protections through:

• Standard Contractual Clauses (SCCs): European Commission approved contractual clauses (2021 SCCs) with all US-based processors.
• Adequacy decisions: UK adequacy decision for transfers to the UK (and vice versa).
• EU-US Data Privacy Framework: For participating US providers.

Our primary sub-processors and their locations:

Sub-processor	Location	Purpose	Safeguard
Stripe	USA / Ireland	Payment processing	SCCs + DPF
cPanel/Hosting Provider	EU/EEA	Server infrastructure	GDPR compliant

7. Data Breach Notification

In accordance with GDPR Articles 33 and 34:

• Supervisory authority: We will notify the relevant supervisory authority within 72 hours of becoming aware of a breach that poses a risk to individuals' rights.
• Affected individuals: Where the breach is likely to result in a high risk to your rights, we will notify you directly without undue delay.

We maintain an internal breach register and have incident response procedures in place.

8. Data Protection Impact Assessments (DPIA)

We conduct Data Protection Impact Assessments (DPIAs) as required by GDPR Article 35 for any new feature or processing activity that is likely to result in a high risk to individuals' rights and freedoms. Where required, we consult with supervisory authorities prior to processing.

9. Data Retention Periods

Data Category	Retention Period	Legal Basis
Account personal data	Duration of account + 30 days	Contract / Art. 6(1)(b)
Customer email lists	Deleted within 30 days of account closure or on request	Contract / Art. 6(1)(b)
Financial/billing records	7 years	Legal obligation / Art. 6(1)(c)
Email delivery logs	90 days	Legitimate interests / Art. 6(1)(f)
Security/access logs	90 days	Legitimate interests / Art. 6(1)(f)
Support tickets	3 years after closure	Legitimate interests / Art. 6(1)(f)
Encrypted backups	Purged within 90 days after deletion	Contract performance

10. US Users — California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of personal information we collect, use, share or sell.
• Right to Delete: Request deletion of personal information we collected from you.
• Right to Opt-Out: We do not sell personal information. There is nothing to opt out of.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Right to Correct: Request correction of inaccurate personal information.

To exercise California rights, contact privacy@autoreviewspilot.com with subject "CCPA Request".

11. Supervisory Authorities

If you believe we have not handled your data in accordance with GDPR, you have the right to lodge a complaint with your national supervisory authority:

• UK: Information Commissioner's Office (ICO) — ico.org.uk — 0303 123 1113
• Ireland: Data Protection Commission — dataprotection.ie
• Germany: Your state's Datenschutzbehörde
• France: Commission Nationale de l'Informatique et des Libertés (CNIL) — cnil.fr
• Netherlands: Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl
• EU (ODR): ec.europa.eu/consumers/odr

12. Contact — Data Protection Officer

For all GDPR-related enquiries, data subject rights requests, or to obtain a copy of our Data Processing Agreement:

• Email: privacy@autoreviewspilot.com
• Subject line: "GDPR Enquiry" or "Data Subject Rights Request"
• Response time: Within 30 days (72 hours for breach notifications)