ReplyTown GDPR and PECR compliance.
This page describes the controls required before ReplyTown accepts live customer data. Production activation depends on those controls being implemented and tested.
- Explicit consent
Opt-in for cookies and SMS, never pre-ticked.
- Data minimisation
Only what the intake flow needs, nothing more.
- Retention limits
Retention periods are agreed and enforced before production data is accepted.
- Right to erasure
Delete a lead and its messages on request.
Our compliance position
ReplyTown is intended for the UK market. Website consent and any communication consent are treated as separate obligations. Production use is blocked until the relevant workflow, lawful basis, retention and data-processing responsibilities are documented and tested.
Website cookies
Cloudflare Web Analytics is cookieless, first-party, and collects no personal data, so it needs no consent banner. The Cloudflare Zaraz Consent Management Platform appears on first visit and gates any consent-required tools by purpose. All purposes are opt-in by default and stored in a first-party cookie for audit.
SMS opt-in
Where SMS is part of an approved customer workflow, the lawful basis, sender identification, opt-out language and suppression behaviour must be configured and tested before activation. The launch plans do not include a ReplyTown-funded messaging account.
Data handling and AI
The production design requires field-level data minimisation and prohibits personal message bodies in generic logs. No AI provider may receive live personal data until its purpose, contract, retention and fallback behaviour have been reviewed and approved.
Security
Provider secrets must remain in deployment environments. Server-side identity, role and tenant checks, authenticated webhooks and append-only consent events are required launch gates and are being tested before customer data is accepted.
Your rights
Under UK GDPR you have the right to access, correct, and erase your data, and to object to processing. Contact us to exercise any of these rights, and we will respond within the statutory period.
Contact
For data requests or compliance questions, contact us.