Home
Categories
Businesses
Blog

GDPR Policy

This GDPR Policy explains how Trustroller collects, processes, stores, and protects personal data in compliance with EU data protection laws, ensuring transparency, security, and user rights across our review platform.

Introduction and Scope of GDPR Compliance

Trustroller is committed to protecting the privacy, confidentiality, and security of personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection laws. This GDPR Policy explains how Trustroller collects, uses, processes, stores, and safeguards personal data when individuals access or use the Trustroller platform. This policy applies to all users, including reviewers, business representatives, and visitors located in the European Economic Area (EEA), the United Kingdom, and other regions where data protection regulations apply. By using Trustroller, you acknowledge that your personal data will be processed in accordance with this policy.

Personal Data We Collect

Trustroller may collect personal data directly from users or automatically through use of the platform. This may include names, email addresses, usernames, account credentials, business contact details, IP addresses, device identifiers, browser information, usage data, communication records, and support inquiries. For business users, this may also include company information, billing details, and profile data. Trustroller collects only the personal data necessary to provide services, ensure platform security, prevent fraud, comply with legal obligations, and improve user experience.

Legal Basis for Processing Personal Data

Trustroller processes personal data only when there is a lawful basis to do so under GDPR. These legal bases include user consent, performance of a contract, compliance with legal obligations, protection of vital interests, and Trustroller’s legitimate interests in operating and securing the platform. Where processing is based on consent, users have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Purposes of Data Processing

Personal data collected by Trustroller is used to operate and maintain the platform, manage user accounts, facilitate reviews and business interactions, process subscriptions and payments, provide customer support, improve platform functionality, detect and prevent fraud, and comply with legal and regulatory requirements. Trustroller may also use aggregated or anonymized data for analytics, reporting, and service optimization purposes. Personal data is not used for purposes incompatible with those described in this policy.

Data Sharing and Disclosure

Trustroller may share personal data with trusted third-party service providers who support platform operations, such as hosting services, payment processors, analytics providers, and customer support tools. These third parties process data only on Trustroller’s instructions and are required to implement appropriate technical and organizational safeguards. Trustroller may also disclose personal data where required by law, regulatory authorities, or valid legal processes. Personal data is never sold to third parties.

International Data Transfers

In certain circumstances, personal data may be transferred to and processed in countries outside the EEA or UK. Where such transfers occur, Trustroller ensures appropriate safeguards are in place, such as standard contractual clauses or equivalent legal mechanisms, to provide a level of protection consistent with GDPR requirements. Trustroller takes reasonable steps to ensure that international data transfers are lawful and secure.

Data Retention and Storage

Trustroller retains personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary depending on the nature of the data, user activity, account status, and regulatory requirements. When personal data is no longer required, Trustroller securely deletes or anonymizes the data in accordance with internal retention policies.

Data Security Measures

Trustroller implements appropriate technical and organizational security measures to protect personal data against unauthorized access, loss, alteration, or disclosure. These measures include access controls, encryption, secure storage systems, and internal data protection procedures. While Trustroller takes reasonable steps to safeguard personal data, no system can guarantee absolute security, and users acknowledge the inherent risks associated with online data transmission.

User Rights Under GDPR

Under GDPR, users have specific rights regarding their personal data, including the right to access, rectify, erase, restrict processing, object to processing, and request data portability where applicable. Users also have the right to withdraw consent and to lodge complaints with a competent data protection authority. Requests to exercise these rights may be submitted through Trustroller’s official support channels, and Trustroller will respond in accordance with applicable laws.

Cookies and Tracking Technologies

Trustroller uses cookies and similar tracking technologies to enhance platform functionality, analyze usage patterns, improve performance, and provide a better user experience. Users may manage or disable cookies through browser settings or available platform controls. Additional information regarding the use of cookies and tracking technologies is provided in Trustroller’s Cookie Policy.

 Data Accuracy and User Responsibility

Trustroller takes reasonable steps to ensure that personal data processed on the platform is accurate, complete, and up to date. However, users are responsible for ensuring that the information they provide is correct and current. Users may update or correct their personal data through their account settings or by contacting Trustroller support. Inaccurate or outdated data may affect service quality, account functionality, or compliance with legal requirements.

Automated Decision-Making and Profiling

Trustroller does not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals without human involvement. Any automated processes used on the platform are designed to enhance user experience, detect fraudulent activity, or maintain service integrity. Where profiling is used for analytics or moderation support, it is conducted in a manner consistent with GDPR principles and does not override human review or judgment.

Children’s Personal Data

Trustroller services are not intended for individuals under the age of 16. Trustroller does not knowingly collect or process personal data from children. If Trustroller becomes aware that personal data of a child has been collected without proper legal basis or parental consent, such data will be promptly deleted. Parents or guardians who believe their child has provided personal data to Trustroller may contact support for review and removal.

Data Breach Notification

In the event of a personal data breach that poses a risk to the rights and freedoms of individuals, Trustroller will take appropriate measures to investigate, contain, and mitigate the breach. Where required by law, Trustroller will notify the relevant supervisory authority and affected users within the timelines prescribed by GDPR. Trustroller maintains internal procedures to identify, assess, and respond to data security incidents effectively.

Third-Party Links and External Services

The Trustroller platform may contain links to third-party websites or services that are not operated or controlled by Trustroller. Trustroller is not responsible for the privacy practices, content, or security of such third-party services. Users are encouraged to review the privacy policies of external websites before providing personal data. Any data shared with third parties is governed by their respective privacy policies.

Business Account Data Processing

For business users, Trustroller processes personal and business-related data to enable profile management, review responses, analytics access, and subscription services. Business users are responsible for ensuring that any personal data they submit, publish, or process through Trustroller complies with applicable data protection laws. Trustroller acts as a data controller for platform operations and may act as a data processor in limited circumstances as defined by law.

Data Minimization and Purpose Limitation

Trustroller follows the GDPR principles of data minimization and purpose limitation by collecting only the data necessary for defined and legitimate purposes. Personal data is not retained or processed beyond what is required to deliver services, maintain platform integrity, or meet legal obligations. Any additional use of data is subject to appropriate safeguards and, where required, user consent.

Supervisory Authority and Complaints

Users have the right to lodge a complaint with a competent data protection authority if they believe their personal data has been processed unlawfully. Trustroller encourages users to contact support first to resolve concerns promptly and transparently. Trustroller cooperates fully with supervisory authorities and complies with lawful requests or investigations related to data protection compliance.

Updates to This GDPR Policy

Trustroller may update this GDPR Policy from time to time to reflect changes in legal requirements, platform functionality, or data processing practices. Material changes will be communicated through the platform or other appropriate channels. Continued use of Trustroller following any updates constitutes acceptance of the revised policy.

Contact Information and Data Protection Inquiries

For questions, concerns, or requests related to this GDPR Policy or personal data processing, users may contact Trustroller through official support channels or designated data protection contact points. Trustroller will make reasonable efforts to respond to inquiries in a timely and lawful manner in accordance with GDPR obligations.

Lawful Requests and Legal Obligations

Trustroller may disclose personal data where required to do so by applicable law, regulation, court order, or lawful request by public authorities, including data protection or law enforcement authorities. Such disclosures are limited to what is legally required and are carried out in a manner consistent with GDPR principles. Trustroller evaluates each request carefully to ensure that it is valid, proportionate, and lawful before responding.

Legitimate Interests Assessment

Where Trustroller relies on legitimate interests as a lawful basis for processing personal data, such processing is carried out only after balancing those interests against the fundamental rights and freedoms of data subjects. Legitimate interests may include platform security, fraud prevention, service improvement, and operational efficiency. Trustroller ensures that such processing does not override individual privacy rights and provides mechanisms for users to object where applicable.

Data Portability

In accordance with GDPR, users have the right to request a copy of their personal data in a structured, commonly used, and machine-readable format where processing is based on consent or contract and carried out by automated means. Upon request and where technically feasible, Trustroller may also transmit such data directly to another data controller at the user’s request. Data portability requests are subject to identity verification and legal limitations.

Right to Restrict Processing

Users have the right to request restriction of processing of their personal data under certain circumstances, such as when the accuracy of the data is contested or when processing is unlawful but erasure is opposed. When processing is restricted, Trustroller will store the data but not process it further except where permitted by law. Users will be informed before any restriction is lifted.

Right to Object

Where personal data is processed based on legitimate interests or for direct marketing purposes, users have the right to object to such processing at any time. Trustroller will assess objections promptly and cease processing unless compelling legitimate grounds exist that override the interests, rights, and freedoms of the data subject, or where processing is required for legal claims.

Consent Management and Withdrawal

Where processing of personal data is based on user consent, Trustroller ensures that consent is freely given, specific, informed, and unambiguous. Users have the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Consent withdrawal mechanisms are designed to be as simple as the methods used to provide consent.

Record Keeping and Accountability

Trustroller maintains internal records of data processing activities as required by GDPR. These records document the purposes of processing, categories of personal data, data recipients, retention periods, and security measures. Trustroller applies the principles of accountability and transparency by regularly reviewing and updating data protection practices and policies.

Training and Internal Awareness

Trustroller ensures that employees, contractors, and authorized personnel with access to personal data receive appropriate training on data protection, privacy principles, and security responsibilities. Internal access to personal data is limited to individuals who require it for legitimate operational purposes and is subject to confidentiality obligations.

Relationship With Other Policies

This GDPR Policy should be read together with Trustroller’s Privacy Policy, Cookie Policy, Terms of Use, and Business Terms & Conditions. In the event of any conflict between this GDPR Policy and other policies, the provisions that provide greater protection to personal data shall prevail, in accordance with applicable law.

Final Provisions

This GDPR Policy is effective as of the date published on the Trustroller website and remains in force until updated or replaced. Continued use of Trustroller after publication of updates constitutes acceptance of the revised policy. Trustroller is committed to continuous improvement of its data protection practices to ensure compliance with evolving legal and regulatory requirements.