Version of 9 September 2026. GDPR article 28. Annex to the terms. Accepted when you subscribe to BabyRock Social.
1. Parties
Controller: the shop (Paid Account) that owns the Google Business Profile.
Processor: BABYROCK MINERALS, S.L., NIF B88957212, Avenida Ramon Escayola 129, 08197 Sant Cugat del Vallès (Barcelona). Contact: [email protected].
2. Subject
The processor processes, only to provide BabyRock Social, the content of Google reviews on that listing (text, stars, date, the author’s public name on Google) and the reply drafts and published texts, including the journal of who approved what was published.
With the current product, the processor also handles the content the shop sends or connects for its presence: posts, comments and private messages on Instagram and Facebook, the photos and texts the shop sends on WhatsApp, and the content of its website (hours, services and contact details).
It does not process health data, lists of the shop’s customer phone numbers, or the shop’s own WhatsApp with those customers.
3. Duration
For the life of the BabyRock Social contract and 24 months after, unless a legal duty or a dispute requires longer. Then the journal is deleted or anonymised. Replies already public on Google stay on the controller’s listing.
4. Instructions
The processor processes that data only to: read reviews, draft replies, ask for your OK on 1- to 3-star reviews, publish, edit or delete replies on the listing, warn of a listing change or a vanished review, and defend a claim about a published text. On the plans that include social media and the website, also: publish and answer comments and private messages, keep the Google listing and the website current, and tell the shop what needs its approval.
A person authorised by the processor reviews every reply before it is published. AI may help with the draft.
The processor does not use that data to advertise other products, or to train a third-party model from your listing, beyond what is strictly needed to generate the draft for that review.
5. Processor duties
- Process only under this agreement and documented instructions (these terms and what you send on WhatsApp about a given text).
- Ensure authorised persons are bound to confidentiality.
- Appropriate security: restricted access, no owner Google passwords, publication sessions isolated per shop, a log of who published.
- Help the controller with data-subject rights, to the extent the data is in our journal and not only at Google.
- Notify without undue delay a security breach that affects this data.
- Not appoint sub-processors outside article 6 without telling you. A material sub-processor change will be notified; if that does not suit you, you may cancel at the end of the paid period.
- At the end, delete journal data within the article 3 period, except where the law requires keeping it.
6. Sub-processors
- Google (Google Business Profile / reviews).
- xAI (help with the draft).
- Hosting of the app and database in the EU.
- Meta, only if a review extract travels in the 1 to 3 star WhatsApp to you (you are already controller of that thread).
There are no operators outside the EEA today. If there are, they will be added here with the matching transfer tool.
7. Transfers
If a sub-processor is outside the EEA, the processor uses a Chapter V GDPR safeguard (standard contractual clauses or another).
8. Controller duties
The listing is yours. You warrant that you can instruct us to reply in your name and that processing public reviews on your listing has a legal basis. You will not give us illegal instructions (buying reviews, filtering by stars, insulting a person).
9. Audit
The controller may ask, no more than once a year unless there is an incident, for a written description of security measures. An on-site inspection is agreed with reasonable notice and without access to other shops’ data.
10. Law
Spanish law. Courts of Barcelona, with the same consumer caveat as the terms.