Personal data processing agreement
Version of 16 October 2026. Article 28 of Regulation (EU) 2016/679 (GDPR).
This English version is provided for convenience. In case of discrepancy, the French version prevails. Read the French version.
For businesses established in France.
1. Parties and acceptance
This agreement binds the business client (the “Controller”) and Girlden LTD, a company registered in England and Wales under number 14837617, registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, which operates the BoostImpact service (the “Processor”). It forms part of the service contract and prevails over the terms of sale for everything relating to personal data. The Controller accepts it, in writing in electronic form, by ticking the box provided before sending its onboarding form.
2. Subject matter, duration, nature and purpose
Subject matter. The Processor processes, on behalf of the Controller, the personal data needed for the service described in the terms of sale.
Duration. The term of the service contract, then the time needed for the return or erasure provided for in section 10.
Nature of the operations. Collection by file import and through the review page, recording, storage, consultation, drafting of proposed replies, sending of emails, publication after approval or according to the Controller's settings, erasure.
Purposes.
- sending the Controller's customers a review request and at most one reminder, and honouring their unsubscription;
- receiving and passing on to the Controller the messages left on its review page;
- reading the Controller's Google reviews and social media comments, proposing and publishing the replies;
- producing videos from reviews chosen by the Controller;
- producing posts from the Controller's photos.
3. Data and data subjects
| Data subjects | Data | Retention |
|---|---|---|
| The Controller's customers asked for a review | First name, email, date of visit, confirmation of their consent; sending, page opening, click through to Google | Deleted 120 days after the visit or the request |
| People who have unsubscribed | Email, reason | Term of the contract, to honour the unsubscription |
| Authors of Google reviews | Text, rating, first name and initial, review identifier | Text, rating and author deleted at 30 days; identifier kept |
| Authors of comments on the Controller's social networks | Text, displayed name, identifier | Text and author deleted at 30 days |
| People who write to the Controller through its review page | Rating, optional message and first name | Period to be set by the Controller; failing that: A_DECIDER |
| People visible in the Controller's photos | Image | Term of the contract |
No special category data within the meaning of article 9 GDPR is requested.
4. Obligations and rights of the Controller
- It determines the purposes and ensures there is a legal basis for each processing operation; for review requests, it obtains its customers' prior consent, keeps proof of it and confirms it at each import.
- It informs its customers of the processing (template in section 13).
- It provides accurate data, limited to what is necessary.
- It may at any time give instructions, request information or an audit under the conditions of section 9.
5. Instructions
The Processor processes the data only on the documented instructions of the Controller. The following count as instructions: the terms of sale, this agreement, the client area settings and the Controller's approvals, and its written requests. The same applies to any transfer to a country outside the European Union, unless required by the law to which the Processor is subject; in that case it informs the Controller before the processing, unless that law prohibits it.
The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or another data protection rule.
6. Confidentiality
The people authorised to process the data are bound by confidentiality, through a written undertaking or an appropriate statutory obligation.
7. Security
The Processor takes the measures required by article 32 GDPR, in particular:
- each business sees only its own data, a rule enforced by the database itself;
- login to the client area by a link sent by email, with no password; random approval links, single-use, valid for 7 days;
- access keys to the services kept on the servers, never in the pages;
- encrypted exchanges (https); client area data hosted in a European region;
- automatic deletion at the periods set out in section 3;
- a log of operations for each business.
8. Sub-processors
The Controller authorises the use of the sub-processors listed in the privacy policy, under “Recipients and processors”. The Processor informs the Controller by email of any addition or replacement at least 30 days in advance; the Controller may object by cancelling at no cost before that date.
The Processor imposes on each sub-processor data protection obligations equivalent to those in this agreement and remains fully liable to the Controller for their performance.
9. Assistance, information and audit
- Data subjects' rights. The Processor forwards to the Controller, within 5 working days, any request it receives from a data subject, and helps it respond. Unsubscribing from a review request is handled directly and immediately.
- Data breach. The Processor notifies the Controller of any personal data breach without undue delay after becoming aware of it, with the information available to it, so that the Controller can meet its own obligations.
- Other obligations. It helps the Controller ensure compliance with the obligations in articles 32 to 36 GDPR (security, breaches, impact assessment, prior consultation), taking into account the nature of the processing and the information available to it.
- Evidence and audit. It makes available to the Controller the information needed to demonstrate compliance with this agreement, and allows an audit, carried out by the Controller or by an auditor bound by confidentiality, no more than once a year, with 30 days' notice, at the Controller's expense.
10. End of the agreement
At the end of the service, as chosen by the Controller within 30 days, the Processor either returns the data to it in a common format and then deletes it, or deletes it directly. Without a reply within that period, it deletes the data. Providers' backup copies are erased according to their own cycle: A_VERIFIER. The Processor keeps only what the law requires it to keep.
11. Transfers outside the European Union
The Processor is established in the United Kingdom. Some sub-processors are established outside the European Union; the applicable safeguards are shown for each of them in the privacy policy. Safeguard applicable to the transfer of data from the Union to the Processor in the United Kingdom: A_VERIFIER.
12. Liability and duration
The parties' liability follows the terms of sale. This agreement lasts as long as the service contract and, for section 10, until the data has been completely deleted.
13. Information template for your customers
Text the Controller can display at the till or on its form, to be adapted:
“By leaving us your email, you agree to receive from us a single request for a review of your visit, and at most one reminder. This email is sent on our behalf by our service provider. You can unsubscribe using the link in the email. Your first name and email are deleted 120 days after your visit. To exercise your rights, contact [business name and contact details].”