Version 1.0 — Last updated: September 1, 2026
Data Processing Agreement
Our Data Processing Agreement (DPA) governs how EmbedMyReviews processes personal data on your behalf — whether that data belongs to your own business or to the clients you manage under your white-label brand. It is pre-signed by EmbedMyReviews, so there is no back-and-forth: download it, complete your details, sign, and keep a copy for your records.
Download the signed DPA (PDF)How to execute the DPA
- Download the PDF above. It is already signed by EmbedMyReviews Ltd.
- Complete the Customer details in the signature block at the end of the document.
- Sign it and retain a copy for your records — no countersignature or return to us is required.
The DPA is incorporated by reference into our Terms of Service and takes effect from the date you sign it (or, if earlier, the date you agreed to our terms). Questions? Contact [email protected].
What the DPA covers
- Our role as your processor (or sub-processor, where you act for your end clients under your white-label brand)
- Purpose limitation, confidentiality, and CCPA service-provider commitments — we never sell or share your data
- Sub-processor authorisation, 10 business days' advance notice of changes, and your right to object
- Security measures, including our database-per-tenant isolation model
- Personal data breach notification within 72 hours of us becoming aware
- Assistance with data subject requests and data protection impact assessments
- International transfer safeguards (UK GDPR, EU SCCs, and the UK Addendum)
- Deletion of your data within 30 days of a written request after termination
Where your data lives
EmbedMyReviews Ltd is a UK company (registered in England and Wales, company number 14593246). Our production infrastructure — application servers, databases, and backups — is hosted with Hetzner Online GmbH in Germany, in data centres operating under an ISO/IEC 27001-certified information security management system. Each customer organisation's data is stored in its own dedicated database, not in shared tables.
Sub-processors
This is the live list of sub-processors referenced in Section 5 of the DPA, current as of September 1, 2026. We give at least 10 business days' notice before adding a new sub-processor, by email to your account owner and by updating this page.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Cloud hosting of application servers, databases, and backups | Germany (EU) |
| Cloudflare, Inc. | CDN, DNS, object storage for widget assets and media, bot protection | United States (global network) |
| WebBuilds B.V. (Ploi) | Server provisioning and management | Netherlands (EU) |
| Stripe Payments UK, Ltd. | Payment processing and subscription billing | United Kingdom |
| FunFirst s.r.o. (Emailit) | Platform-provided email delivery | Czech Republic (EU) |
| Twilio Inc. (SendGrid) | Email delivery for EmbedMyReviews-managed sending domains | United States |
| Contiguity LLC | Platform-provided SMS, WhatsApp, and email message delivery | United States |
| OpenRouter, Inc. | AI processing for platform AI features (review replies, insights, sentiment) | United States |
| DataForSEO OÜ | Collection of publicly available business, search, and review data for reports and review syncing | Estonia (EU) |
| Crisp IM SAS | Customer support chat and helpdesk | France (EU) |
| Umami Software, Inc. | Privacy-focused product analytics | United States |
| Microsoft Corporation (Clarity) | Product session analytics | United States |
Connected platforms are not sub-processors
Third-party platforms and providers that you or your end clients connect under your own accounts or at your direction — for example Google Business Profile, Meta (including WhatsApp Business), review platforms, or your own email, SMS, or AI provider accounts connected under a bring-your-own-key arrangement — act on your behalf, not ours. Their processing is governed by your own terms with them, not by this DPA.
Using EmbedMyReviews with your own clients?
If you offer review management to your clients under your white-label brand, you likely need a DPA between your agency and each client as well. A ready-to-adapt template is available in the Asset Vault inside your EmbedMyReviews dashboard.
Contact
For DPA questions, sub-processor objections, or data protection matters:
EmbedMyReviews Ltd, 124 City Road, London, EC1V 2NX, United Kingdom · Company No. 14593246
See whether EMR fits the way
your agency actually runs.
Try the real workflows, brand the platform, and decide with your own eyes whether it belongs in your stack.