Data Processing Terms

These Data Processing Terms apply whenever Repomanta Information Technology Services, trading as Repomanta Digital Lab (“we”), handles personal data for a trade business on one of our plans (“you”). They form part of your agreement with us, together with your Order Form and our Terms of Service. On anything about personal data, these terms win over the Terms of Service.

You decide why and how your customers’ data is used, so you are the controller (an “APP entity” in Australia, an “agency” in New Zealand, a “business” under US state privacy laws). We act on your behalf as your processor (a “service provider” or “contractor” under US state laws).

• Purpose: running your plan. That means replying to enquiries and missed calls, following up quotes, requesting and replying to reviews, sending reminders and campaigns you approve, collecting enquiries into one inbox, tracking calls and forms, and reporting to you.
• People: your customers, past customers, enquirers and reviewers.
• Data: names, phone numbers, email addresses, suburb or address where needed for the job, job and enquiry details, messages and replies, call times and durations, review content, and opt-out records. We do not intentionally process sensitive or special-category data, and you agree not to ask us to.
• Duration: for as long as your plan runs, plus the handover period under “When a plan ends”.

We process your customers’ data only to run your plan, on your documented instructions. Your Order Form, and each message and campaign you approve, are those instructions. We tell you if we think an instruction breaks the law, and we may decline to follow it.

We never sell or share your customers’ data, use it for our own marketing, combine it with data from other clients, or use it to train or fine-tune any AI model. We use AI providers only under terms that exclude submitted data from training.

Everyone who can access your data is bound to keep it confidential and sees only what their work needs. Our measures include:

• multi-factor sign-in on every account that holds client data
• least-privilege access, removed as soon as it is no longer needed
• encryption in transit for all data we send and receive
• your Google, Meta, domain and messaging accounts set up in your name, so access can be withdrawn by you at any time
• test data, not live customer data, when building and testing automations

You authorise us to use sub-processors in the categories below. We bind each of them to data-protection terms at least as protective as these, and we stay responsible to you for what they do. The named providers for your plan are listed on request and in your Order Form.

We give you at least 14 days' notice by email before adding or replacing a named sub-processor. If you object on reasonable data-protection grounds, we will try to find another way. If we cannot, either of us may end the affected service with no early-exit charge.

If one of your customers asks us to see, correct or delete their data, or to stop messages, we pass the request to you within 2 business days and help you answer it. Opt-outs (a STOP reply or an unsubscribe) are actioned by us straight away, as described on our compliance page.

We also give you reasonable help with privacy impact assessments and with questions from a regulator about the data we process for you.

If we become aware of a breach affecting your customers’ data, we tell you without undue delay and in any case within 48 hours, with what we know at the time, and keep you updated. We take reasonable steps to contain it, and we help you meet any duty you have to notify a regulator or the people affected, for example under the UK GDPR, Australia’s Notifiable Data Breaches scheme, New Zealand’s notifiable privacy breach rules or a US state breach law.

We work from the Philippines, and some sub-processors are in other countries, so your customers’ data may be handled outside your country. Wherever it is, we protect it to the standard of these terms, and:

• Australia: we handle it in a way consistent with the Australian Privacy Principles, so you can meet APP 8.
• New Zealand: we protect it in a way that, overall, gives safeguards comparable to the Privacy Act 2020, so you can meet IPP 12.
• United Kingdom: where a transfer needs it, we agree to the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which are incorporated by reference when you ask for them.
• United States: we process it only for the business purposes in these terms, and we comply with the obligations US state privacy laws place on service providers and contractors.

Within 14 days of a plan ending we give you an export of your customers’ data, including opt-out records so you can keep honouring them. We then delete our copies within 30 days, unless the law requires us to keep something. The only thing we keep is the short record of each billed enquiry that supports an invoice, as set out in the Privacy Policy.

We give you the information you reasonably need to show that these terms are being met, usually as written answers. If that is not enough, you may audit our compliance once a year on 30 days' notice, at your cost, under a confidentiality agreement, in a way that does not expose other clients’ data.

• Have the consent or other lawful basis needed for each person and each message, as set out in the Terms of Service under Customer lists and messaging consent.
• Tell your customers, in your own privacy notice, that you use service providers to contact them.
• Keep your customer list accurate, and pass us opt-outs you receive directly.
• Give us only lawful instructions.

Liability under these terms is subject to the limits and carve-outs in the Terms of Service. Questions about data protection go to build@repomanta.com.