← Back to Trust Center

Data Processing Agreement

Last updated: May 29, 2026

This Data Processing Agreement and its Annexes A and B ("DPA") is between ReviewWheel LLC, a Georgia limited liability company ("ReviewWheel," "we"), and the Customer ("Customer," "you"). It governs ReviewWheel's Processing of Customer Personal Data on the Customer's behalf in connection with the Services under the Terms of Service ("Agreement"). This DPA is part of the Agreement; if it conflicts with the Agreement, this DPA controls as to the subject matter here. It supersedes any prior DPA.

1. Definitions

  • Business, Service Provider, Contractor, Consumer, Sell, Share have the meanings given in the CCPA.
  • Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Process/Processing have the meanings given in applicable US Data Protection Laws.
  • CCPA means the California Consumer Privacy Act of 2018 (Cal. Civ. Code §1798.100 et seq.), as amended by the California Privacy Rights Act.
  • US State Privacy Laws means the CCPA and the comprehensive consumer-privacy laws of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and Utah (UCPA), and other US state privacy laws as they take effect.
  • Data Protection Laws means all US federal and state laws relating to data protection and privacy applicable to a party's Processing under the Agreement.
  • Customer Personal Data means Personal Data within Customer Data that ReviewWheel Processes on the Customer's behalf — principally the Customer's Consumer contact information (the past/present customers of the Customer's business).

Note: This DPA addresses US law only. ReviewWheel operates in the United States; it does not offer Services in the EU/UK and this DPA contains no GDPR, Standard Contractual Clauses, or international-transfer terms.

2. Roles and compliance

For purposes of Data Protection Laws, the Customer is the Controller / Business of Customer Personal Data and ReviewWheel is the Processor / Service Provider, Processing on the Customer's behalf. Each party will comply with its obligations under applicable Data Protection Laws.

3. Customer instructions

ReviewWheel Processes Customer Personal Data only on the Customer's documented instructions, unless required by law to do otherwise. The Agreement and this DPA are the Customer's complete and final instructions; additional instructions must be agreed in writing. ReviewWheel will inform the Customer if, in its opinion, an instruction violates Data Protection Laws.

4. Customer responsibilities and consent

The Customer is responsible for the lawfulness of the Customer Personal Data it provides and the instructions it gives. The Customer represents that it has all necessary rights, consents, and relationships to provide Customer Personal Data to ReviewWheel and to have review-request messages sent to its Consumers in compliance with applicable law (including the TCPA, CAN-SPAM, and A2P 10DLC requirements — see Agreement §7). The Customer will indemnify ReviewWheel against losses arising from its failure to do so.

5. Nature, scope, purpose (Annex A)

Annex A sets out the subject matter, nature, purpose, and duration of Processing, the types of Customer Personal Data, and the categories of Data Subjects.

6. ReviewWheel's obligations

ReviewWheel will:

  1. Implement and maintain appropriate technical and organizational security measures to protect Customer Personal Data (Annex B), and may update them provided protection is not materially degraded.
  2. Ensure personnel authorized to Process Customer Personal Data are bound by confidentiality obligations.
  3. Taking into account the nature of Processing, reasonably assist the Customer (at the Customer's request and cost) in responding to Data Subject rights requests and in meeting the Customer's obligations regarding security, breach notification, and data-protection assessments.
  4. Notify the Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data.
  5. On termination, delete or return Customer Personal Data (and copies) at the Customer's direction, except where retention is required by law or permitted under the Privacy Policy §7 retention windows. Data is "deleted" when put beyond further use.
  6. Make available information reasonably necessary to demonstrate compliance with this DPA.

7. Service Provider / Processor commitments (US state law)

CCPA. Where the CCPA applies, the Customer is a "Business" and ReviewWheel is a "Service Provider." ReviewWheel will: Process California Personal Information only to perform the Services (the Business Purpose) and not for any other purpose; not "sell" or "share" California Personal Information; not retain, use, or disclose it outside the direct business relationship with the Customer or for any commercial purpose other than the Services; and not combine it with personal information from other sources except as the CCPA permits. ReviewWheel certifies it understands and will comply with these restrictions.

Other US states. Where the VCDPA, CPA, CTDPA, TDPSA, or UCPA applies, ReviewWheel acts as a "processor" and will: Process Customer Personal Data only per the Customer's instructions; assist the Customer with Data Subject requests and security/assessment obligations; ensure personnel confidentiality; and engage sub-processors only under terms consistent with this DPA (Section 8).

8. Sub-processors

The Customer provides general authorization for ReviewWheel to engage sub-processors to Process Customer Personal Data, provided ReviewWheel: (a) imposes data-protection terms on each sub-processor consistent with this DPA, and (b) remains responsible for its sub-processors' acts and omissions. ReviewWheel's current sub-processors are listed in Annex C (the Sub-Processors page). ReviewWheel will give the Customer notice of new or replacement sub-processors at least 30 days in advance where the Customer has opted in to such notices.

9. Amendments

ReviewWheel may update this DPA to reflect changes in Data Protection Laws or its security practices, provided it does not materially reduce the protection of Customer Personal Data.

Annex A — Details of Processing

Parties

  • Controller / Business: the Customer, as identified in its ReviewWheel account.
  • Processor / Service Provider: ReviewWheel LLC, 6500 Halcyon Way APT 581, Alpharetta, GA 30005. Contact: [email protected].

Subject matter: ReviewWheel's provision of review-automation Services to the Customer.

Nature & purpose: Processing Consumer contact data to send review-request messages (SMS and email) on the Customer's behalf, handle opt-outs, track review-link clicks, and post review replies — solely to provide the Services.

Categories of Data Subjects: The Customer's Consumers (past and present customers of the Customer's business).

Categories of Personal Data: Name, phone number, email address; review-interaction metadata (e.g., link-click, opt-out status).

Sensitive data: None anticipated. The Services are not intended for sensitive personal information.

Frequency: Variable throughout the Agreement term.

Retention: Per the Privacy Policy §7 — Consumer lists retained while the account is active plus a post-cancellation grace period, then deleted.

Annex B — Technical and Organizational Security Measures

MeasureDescription
EncryptionPersonal data encrypted in transit (TLS 1.2+) and at rest, via the platform and sub-processors.
Access controlRole-based access; tenant isolation; authenticated access only.
Availability & resilienceManaged cloud services (AWS, Google Cloud, Cloudflare, Vercel); uptime monitoring; backups.
AuthenticationSigned tokens, role-based authorization, password protection; OAuth tokens encrypted at rest.
Physical securityInherited from managed-cloud sub-processors' data-center controls.
LoggingAudit/event logging via platform and cloud-provider tooling.

Annex C — Sub-Processors

The current sub-processors are listed at reviewwheel.com/sub-processors.