We value your privacy and the protection of your personal data. This document explains how our platform processes personal data in connection with sending review requests and their subsequent handling, including the protection of the personal data of entrepreneurs using our platform.

Who’s Who in Managing Your Personal Data?

If you are an entrepreneur who has established a business relationship with us (hereinafter referred to as the “Client”) for the purpose of using our platform’s services, we act as the controller of your personal data.

If you are a customer (hereinafter referred to as the “Customer”) who has used the services or products of our Client, then the Client themselves is the controller of your personal data. Our platform acts solely as the processor of personal data on behalf of our Client.

What Personal Data Do We Process and Why?

For the Client, we process:

• Identity and company details – first name, last name, trade name, company name
• Identification data – Company ID, VAT ID, place of business, VAT payer status
• Contact information – email address and phone number

The legal basis for processing these data is the provision of services under the contract between the parties, the fulfillment of accounting and tax obligations, and our legitimate interest in protecting our rights as the service provider.

Facebook and Instagram Integration

If you choose to connect your Facebook Page and Instagram Business account,
Ratemat uses Meta’s APIs (Facebook Login for Business, Pages API, Instagram API)
to publish your approved Google reviews as posts to your own Facebook Page and
Instagram account, on your request.

For this feature we process and store:

• access tokens for your Facebook Page and Instagram account (stored encrypted),
• basic metadata of the connected Page/Instagram account (IDs, names),
• the content you choose to publish (images and captions).

We use this data only to publish content you approve. We do not sell it or use it
for advertising or profiling. Tokens are stored encrypted and refreshed only to
keep the connection working.

• How to disconnect and delete this data:
  In Facebook, go to Settings → Business Integrations and remove the Ratemat app.

After disconnecting, we automatically delete the stored tokens and connection
metadata. See our data deletion page: https://app.ratemat.cz/social/meta-ratemat/data-deletion-info

For the Customer, we process:

• Contact details – email address and/or phone number

This is solely for the purpose of sending a link to write a review. These data are provided to us by the Client based on their legitimate interest in obtaining feedback on the services or products the Customer has used.
If you, as a Customer, decide to write a review, we also process the content of your review and any additional personal data you include.

The legal basis for processing these data is the Client’s legitimate interest in obtaining feedback. Publishing the review, however, requires your consent, which you give (or withhold) to the relevant platform before submitting your review for publication.

How Do We Use Your Data?

We use the Client’s data to fulfill contractual obligations, enforce rights under the agreement, record Client information in our internal CRM system, and issue accounting and tax documents.

We use the Customer’s contact details exclusively to send the link for writing a review. The review content is then:

1. sent to the Client’s dashboard on our platform; and
2. published on an external review platform, but only with the explicit consent you provide to that platform before submission.

Your Rights

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase data, where there is a legal basis for deletion
• Restrict processing, where there is a legal basis for restriction
• Data portability
• Object to processing – any objection must be specific
• Withdraw consent to processing, where processing is based on consent

If you are a Customer of our Client, please contact the Client directly to exercise these rights, as they are the controller of your data (our platform is only the processor).
How Long Do We Retain Your Data?

We retain your personal data only as long as necessary to fulfill the processing purpose.

Data Security

We have implemented appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse.

If you have any questions regarding the processing of your personal data, you may contact us at [email protected].

Last updated: February 1, 2025