Privacy Policy
Last updated: 28 June 2026
This notice explains what personal data NeedReview collects, why we collect it, who we share it with, how long we keep it, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).
1. Who we are
NeedReview ("we", "us", "our") is a reputation-management service for UK clinics and local businesses, operated by Rory Gray as a sole trader, based in the United Kingdom. For the personal data described in this notice, we are the data controller.
Contact for privacy matters
Email: team@needreview.co.uk
ICO registration number: [to be added once registered]
2. The data we collect
When you enquire or request a teardown
- Your name and the name of your business
- Your email address and, if you choose to give it, your phone number
- Your business type and town or city
- A link to your Google profile or website
- Anything else you put in a message to us
When you become a customer
- Account and billing details (payments are taken by Stripe; we do not store your full card number)
- Details needed to run the service, including access you grant to your review profiles
- Your customers' contact details that you provide or that flow through your systems, so we can send review requests on your behalf (see section 7)
Automatically
- Basic technical data such as IP address and browser type, used to keep the site secure and working. Our hosting provider may set essential cookies for this purpose. The site sets no advertising or tracking cookies.
3. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry and prepare your free teardown | Legitimate interests (responding to a request you made), or consent |
| Provide and run the service you sign up for | Performance of a contract |
| Take payment and keep accounting records | Contract, and legal obligation (tax and accounting law) |
| Send you occasional updates about NeedReview | Consent, or our legitimate interest in keeping customers informed. You can opt out at any time. |
| Keep our site and systems secure | Legitimate interests |
4. Who we share it with
We do not sell your personal data. We share it only with service providers who help us run NeedReview, and only as far as needed:
- Hosting and forms — our website host, which captures form submissions and keeps the site online
- Scheduling — our booking tool, when you book a call
- Payments — our payment processor, when you subscribe
- Email — the provider that delivers and receives our email
- Review platforms — Google and other review sites, to send requests and post approved replies for our customers
- AI drafting — an AI provider that helps draft review replies. Replies are reviewed and approved before anything is published.
We may also disclose data where the law requires it, or to protect our rights.
5. International transfers
Some of our providers are based outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
6. How long we keep it
- Enquiries that do not become customers: up to 24 months from your last contact with us, then deleted.
- Customer records: for the length of your contract, and for up to 7 years afterwards where we need them for tax, accounting or legal reasons.
- You can ask us to delete your data sooner (see section 8).
7. When we handle your customers' data
If you are a NeedReview customer and we send review requests to your customers on your behalf, you remain the data controller for those customers' personal data and we act as your data processor. We process that data only on your instructions and under a data processing agreement. You confirm you have a lawful basis and the right to share those contacts with us.
8. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data erased
- restrict or object to how we use it
- receive your data in a portable format
- withdraw consent at any time, where we rely on consent
To exercise any of these, email team@needreview.co.uk. We will respond within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would appreciate the chance to put things right first.
9. Cookies
Our site does not use advertising or analytics tracking cookies. Our hosting provider may set essential cookies needed for security and for forms to work. We load web fonts from Google, which receives your IP address when fonts are served. If we add analytics or other non-essential cookies in future, we will update this notice and ask for your consent where required.
10. Changes to this notice
We may update this notice from time to time. When we make material changes we will update the date above and, where appropriate, let you know.