We haven’t yet completed update of the terms and conditions. However, I can already provide some high level details.
Generally, Customer Reviews is a “data processor” because we provide a service for sending review invitation emails on behalf of merchants. Whilst a data processor has fewer direct obligations under legislation, we must still protect the personal data involved as we will still be liable to the data controller/merchant.
However, there is also an option to publish verified copies of reviews on cusrev.com website. When a copy of a review is published on cusrev.com, we are considered to be a “data controller”, meaning we have the primary responsibility to ensure that the GDPR is complied with.
We have registered with the Information Commissioner’s Office in the UK and are waiting for assignment of a registration number.
I will share links to the updated terms and conditions and privacy policy as soon as we complete their update.