GDPR Compliance Statement

1. Our commitment to GDPR

GBPPromote is committed to protecting personal data and respecting the privacy rights of individuals in the European Union and European Economic Area.

We apply GDPR principles across the platform regardless of where a user is located — lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

2. Compliance at a glance

A summary for reviewers. Each row links to the section covering it in detail.

3. Roles and responsibilities Art 4, 24, 28

Our role depends on the processing in question, and both apply:

• Controller — for website usage, billing and subscriptions, marketing where consented, account administration, platform security and internal operations. We determine the purposes and means of that processing.
• Processor — when handling customer data on behalf of customers using the platform, including connected Google Business Profile data. We act only on the customer’s documented instructions.

Processor responsibilities are contractually defined in our Data Processing Agreement, which addresses all nine mandatory clauses of Article 28(3) and incorporates the Standard Contractual Clauses where a transfer requires them.

4. Data Protection Officer & EU representative Art 27, 37

Data Protection Officer

Under Article 37, appointing a Data Protection Officer is mandatory only where an organisation is a public authority, where its core activities require regular and systematic monitoring of data subjects on a large scale, or where its core activities involve large-scale processing of special category data.

None of those conditions applies to our processing. We do not process special category data, and our core activity is managing business listing information rather than monitoring individuals. We have therefore not appointed a statutory DPO.

We have instead designated a named contact responsible for data protection questions, complaints and rights requests, set out in section 17. That contact also serves as Grievance Officer under India’s Digital Personal Data Protection Act 2023.

Representative in the Union

Article 27 requires controllers and processors established outside the Union to designate a representative in the Union in certain circumstances, subject to exemptions for occasional processing that does not involve large-scale special category data and is unlikely to result in risk to individuals.

We keep this requirement under review as our EEA customer base changes. Where we designate a representative, we will name them on this page. In the meantime, EEA individuals can contact us directly using the details in section 17, and retain the right to complain to their local supervisory authority as set out in section 16.

5. Lawful bases for processing Art 6

Where processing relies on consent, withdrawal is as straightforward as giving it, and does not affect the lawfulness of processing carried out beforehand.

6. Transparency & information provided Art 12–14

Information about our processing is provided through:

• Our Privacy Policy
• Our Cookie Policy
• This GDPR Compliance statement
• Our Data Processing Agreement for customers acting as controllers
• Our AI Transparency statement for AI-assisted features
• Notices presented in the product at the point a feature is enabled

All are written to be understood without legal training, and are available without needing an account.

7. Categories of personal data processed

• Identity and contact information
• Business profile data authorised by customers
• Google Business Profile reviews and public business data, which may include reviewer names and review content
• Usage logs, IP addresses and technical metadata
• Billing and transaction metadata. Full card details are handled by our payment provider and never stored by us
• Customer support communications

8. Third-party processors & APIs Art 28

We engage a limited set of processors, each bound by written data protection terms no less protective than our own obligations. The categories, and the two processors most relevant to how the platform works, are:

The current list of named sub-processors, including each provider’s country of processing, is available on request at amit@gbppromote.com and is supplied with any signed DPA. Changes are notified with 30 days’ notice and a right to object, as set out in the DPA.

9. Data subject rights Art 15–22

How to make a request

Send your request to amit@gbppromote.com. We may need to verify your identity before acting, particularly for access and erasure requests.

We respond within one month of receiving a request, as required by Article 12(3). Where a request is complex or where several requests are received, that period may be extended by up to two further months, and we will tell you within the first month if an extension is needed and why.

10. Data Protection Impact Assessments Art 35–36

Where a processing activity is likely to result in a high risk to the rights and freedoms of individuals, we carry out a Data Protection Impact Assessment before beginning that processing, and implement measures to mitigate the risks identified.

Where a DPIA indicates residual high risk that cannot be mitigated, we consult the relevant supervisory authority before proceeding, as required by Article 36.

Where we act as processor, we provide reasonable assistance to customers carrying out their own DPIAs, as committed in the DPA.

11. Security measures Art 32

• Encryption in transit using HTTPS and TLS for all connections
• Encryption at rest where feasible and appropriate, including backups
• Role-based access control with least-privilege provisioning and unique named accounts
• Secure credential handling — passwords hashed, tokens and secrets stored separately from application data
• Audit logging and monitoring, with retention of logs for investigation
• Access review and prompt removal of access on role change or departure
• Confidentiality commitments from all personnel with access to personal data
• Regular security reviews, maintenance and patching
• Documented incident response covering identification, escalation, containment and remediation

The full technical and organisational measures are set out in Annex II of the Data Processing Agreement.

12. Personal data breaches Art 33–34

• Where we act as processor, we notify the affected customer without undue delay and in any event within 72 hours of becoming aware, so they can meet their own Article 33 obligation.
• Where we act as controller, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to individuals.
• Where a breach is likely to result in a high risk to individuals, we also communicate it to those individuals without undue delay.
• We document every breach, its effects and the remedial action taken, as Article 33(5) requires.

Notification includes the nature of the breach, approximate numbers of individuals and records affected, likely consequences, measures taken, and a contact point — supplemented as further information becomes available.

13. International data transfers Art 44–49

GBPPromote is established in India. Personal data may therefore be transferred outside the EEA, including to India and the United States, depending on our infrastructure and processors.

Those transfers are protected by appropriate safeguards, principally the Standard Contractual Clauses, Module Two (controller to processor) adopted by the European Commission, incorporated into our DPA with the annexes completed.

• UK transfers are covered by the SCCs as supplemented by the UK International Data Transfer Addendum issued by the ICO.
• Swiss transfers are covered by the SCCs with references read in accordance with the Swiss Federal Act on Data Protection.
• Technical and organisational measures under section 11 apply to data in transit and at rest throughout.

14. Records of processing Art 30

We maintain internal records of processing activities, covering the categories of data processed, the purposes of processing, the categories of recipients, transfers to third countries, retention periods and the security measures applied.

These records are made available to a supervisory authority on request, and relevant extracts are provided to customers as part of a security review or DPA request.

15. Data retention Art 5(1)(e)

Personal data is retained only for as long as necessary for the purpose it was collected for, to comply with legal obligations, and to enforce agreements.

Data may persist in encrypted backups until those expire on their normal rotation, during which it remains protected and is not actively processed. Full detail is in the Privacy Policy.

16. Supervisory authority & complaints Art 77

If you believe your rights have been infringed, you have the right to lodge a complaint with a supervisory authority — in particular in the EEA or UK country of your habitual residence, place of work, or where the alleged infringement occurred.

We would appreciate the chance to address your concern first, and you can raise it with the contact in section 17. Doing so does not limit your right to complain to a regulator, and you do not need to contact us before doing so.

17. Data protection contact

This page may be updated to reflect legal or operational changes. Material updates are posted here with a revised effective date.