About This Policy
This Privacy Policy explains how Redrock Reputation Limited (“Redrock Rep”, “we”, “us” or “our”), a company registered in England and Wales (Company No. 16401695), collects, uses, shares and protects personal data when you use our website or services, interact with us as a business customer, or interact with services that we provide on behalf of our business customers.
This policy applies to: visitors to our website at redrockrep.co.uk; businesses subscribing to our services; and individuals whose information is processed through services we operate on behalf of those businesses (for example, customers who leave feedback or join a loyalty programme operated by one of our clients).
We are registered with the Information Commissioner's Office (ICO) as a data controller. Where we process personal data on behalf of a business customer, we generally act as a data processor and the business customer acts as the data controller. The controller/processor relationship is addressed further in our Data Processing Addendum, which forms part of our Terms and Conditions.
Information We Collect
We collect the following categories of personal data:
Business customer information
If you subscribe to our services, we collect your name, email address, phone number, business name and address, and any other information you provide when setting up or managing your account. We also collect correspondence and communications between you and our team.
Payment information
We collect billing records and transaction history. Payment card details are handled directly by our payment processor and are not stored by us.
End-customer information
Where we operate services on behalf of a business customer, we may process information provided by that business's customers. This includes Google review content, customer feedback submitted through private feedback tools (including name and email address where voluntarily provided by the respondent), and loyalty programme information (see Section 4).
Website usage information
We collect basic technical information when you visit our website, including IP address, browser type, device type, pages visited and referring URL. This is collected through standard web server logging. We do not currently operate active third-party analytics tracking on this website.
Enquiry information
If you contact us or submit an enquiry, we collect the information you provide in that enquiry, including any contact details and the content of your message.
How We Use Your Information and Lawful Bases
UK GDPR requires us to have a lawful basis for each purpose for which we process personal data. The table below sets out how we use personal data and the basis we rely on. Where we rely on legitimate interests, those interests have been balanced against individual rights and we do not consider them to be overridden.
| Purpose | Lawful basis |
|---|---|
| Providing subscribed services to business customers | Contract |
| Billing and account administration | Contract / legitimate interests |
| Responding to enquiries from prospective customers | Legitimate interests |
| Maintaining financial and legal records | Legal obligation |
| Processing end-customer data on behalf of a client | Redrock acts as processor; lawful basis is determined by the client as controller |
| Sending service-related communications to existing clients | Contract / legitimate interests |
| Sending marketing communications to existing clients | Legitimate interests (with right to object at any time) |
| Sending marketing communications to prospective clients | Legitimate interests or consent, as applicable |
Loyalty Programme Data
Where a business customer uses our digital loyalty services, personal data relating to loyalty members may be processed through systems provided or managed by Redrock Rep on that business customer's behalf.
Depending on the configuration selected by the business, this may include a loyalty member's first name, date of birth, loyalty membership identifier, stamps or points balance, reward history, redemption activity and notification preferences.
Redrock Rep generally processes this information as a data processor on behalf of the relevant business operating the loyalty programme. The business customer is the data controller and is responsible for determining the purposes and lawful basis for processing its customers' personal data. We may use third-party technology and infrastructure providers to operate and support loyalty programmes on behalf of clients.
Loyalty members may receive push notifications to their Apple or Google Wallet in connection with their loyalty membership. These notifications are sent through the wallet platform on the device and are subject to the individual's notification preferences on that device.
Where Redrock Rep collects personal data from loyalty members at the point of enrolment, privacy information is provided at that point. If you have a question about how your information is used in a loyalty programme operated by a specific business, please contact that business directly.
Cookies
Cookies are small text files placed on your device when you visit a website. We use a limited number of cookies on this website.
Functional cookies
Our website may use cookies that are necessary for it to function correctly, such as session management. These cannot be disabled without affecting how the site works.
Third-party scheduling cookies
This website uses Calendly to provide a booking feature. If you use the booking widget, Calendly may place its own cookies on your device. We do not control these cookies. You can review Calendly's privacy policy at calendly.com/legal/privacy-notice.
We do not use advertising or marketing cookies on this website. We do not use cookies to track your activity across other websites or to serve you targeted advertisements.
You can control cookies through your browser settings. Disabling functional cookies may affect the availability of certain features on this website.
Third-Party Service Providers
We use carefully selected third-party service providers to support the delivery of our services. These providers may process personal data on our behalf as sub-processors or, in some cases, as independent controllers. We put in place appropriate contractual arrangements with our service providers to protect personal data.
Categories of service providers we work with include:
- Payment processing providers
- Online form and data collection providers
- Hosting and infrastructure providers
- Reputation management and review technology providers
- Digital loyalty programme technology providers
- Scheduling and calendar service providers
- Email and communication service providers
A current list of our principal sub-processors is available to business customers on written request.
Data Sharing and Disclosure
We do not sell personal data. We share personal data only in the following circumstances:
- Service providers: As described in Section 6, we share data with third-party providers who assist in delivering our services. These providers are contractually required to protect personal data and use it only for the agreed purposes.
- Business customers: Where we process end-customer data on behalf of a business customer, we share or make available that data to the relevant business customer as part of delivering the service.
- Legal requirements: We may disclose personal data if required to do so by law, court order or regulatory obligation, or where necessary to protect the rights, property or safety of Redrock Rep, our clients or others.
- Business transfers: If Redrock Rep is involved in a merger, acquisition or sale of all or part of our business, personal data may be transferred as part of that transaction. Affected parties would be notified as required by law.
International Data Transfers
Some of our third-party service providers may be based outside the UK or European Economic Area, or may process data on servers located outside those territories. Where personal data is transferred internationally, we take steps to ensure that appropriate safeguards are in place in accordance with UK data protection law, such as relying on UK adequacy decisions, standard contractual clauses or other approved transfer mechanisms.
Data Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected. The factors we consider when setting retention periods include:
- The nature of the services provided and the ongoing relationship with the customer
- Legal and regulatory obligations, including financial record-keeping requirements
- The resolution of disputes or enforcement of agreements
- Instructions from the relevant data controller, where we are acting as processor
Business customer account information is generally retained for the duration of the subscription and for a reasonable period afterwards to meet legal and administrative requirements. Financial records are retained for a minimum of six years in accordance with UK tax and accounting requirements.
Where Redrock Rep processes personal data solely on behalf of a business customer, that data will be returned or deleted in accordance with our agreement with that customer and applicable legal requirements.
Security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee the absolute security of personal data. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.
Your Rights
Under UK GDPR, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to conditions or limitations under applicable law.
- Access: You have the right to request a copy of the personal data we hold about you.
- Rectification: You have the right to request correction of inaccurate or incomplete personal data.
- Erasure: You have the right to request deletion of your personal data in certain circumstances, for example where it is no longer necessary for the purpose for which it was collected.
- Restriction of processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while the accuracy of the data is being contested.
- Objection: You have the right to object to processing based on legitimate interests, including for direct marketing purposes. Where you object to direct marketing, we will stop processing your data for that purpose.
- Data portability: Where processing is based on consent or contract and carried out by automated means, you may have the right to receive your personal data in a structured, commonly used and machine-readable format.
- Withdraw consent: Where processing is based on your consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us at the address in Section 14. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Children's Privacy
Our services are directed at businesses and are not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a child, please contact us and we will take steps to delete it.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Where changes are material, we will notify affected parties by email or by a prominent notice on our website before the changes take effect. The date of the most recent update is shown at the top of this page.
Contact and Complaints
If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle personal data, please contact us:
Redrock Reputation Limited
Email: customerservice@redrockrep.co.uk
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113