Privacy policy
Version of 22 October 2026.
This English version is provided for convenience. In case of discrepancy, the French version prevails. Read the French version.
For businesses established in France or Belgium.
Who processes your data
BoostImpact is a trading name of Girlden LTD, a company registered in England and Wales under number 14837617, registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Contact for any question about your data: info@boostimpact.agency.
The company is established in the United Kingdom and offers its services to businesses located in France and Belgium. No data protection officer has been appointed to date.
Depending on the data, the company acts in one of two roles:
- Controller for the data of its business clients, of businesses that request a free audit, and of visitors to this website.
- Processor, on behalf of the business, for the data of that business's own customers: review requests by email, reviews and comments received, messages left on the business's review page. The controller is then the business; its obligations and ours are set out in the data processing agreement. If you are a customer of a business, please send your requests to that business; if you write to us, we forward your request to it.
Data processed as controller
| Why | What data | Legal basis | How long |
|---|---|---|---|
| Producing and sending the free audit of your Google listing, at your request | Business name, town or city, type of business, email, link to your Google listing; if you provide it: phone number | Pre-contractual measures taken at your request (article 6(1)(b) GDPR) | At most 3 years after the last contact (CNIL reference framework on “managing commercial activities”); content obtained from Google's APIs (reviews, contact details): 30 days at most, a rule Google imposes on users of its APIs |
| Writing to you at most three times after the audit (2, 5 and 10 days after the report is sent), unless you book a call, reply or unsubscribe | Email, business name, audit date, replies and unsubscription | Legitimate interest in presenting a service related to your business activity (article 6(1)(f)); you can object at any time using the link in each email | Unsubscribe list kept for as long as it is needed so we no longer write to you: 3 years after unsubscription; other data: at most 3 years after the last contact (CNIL reference framework on “managing commercial activities”) |
| Providing the service to the business client: client area, content, replies to reviews, posts, service emails | Login email, contact's name and phone number, business information, uploaded photos, content produced, approval decisions, activity log | Performance of the contract (article 6(1)(b)) | Term of the contract, then 5 years (limitation period, article L110-4 of the French Commercial Code) |
| Invoicing and keeping accounts | Company name, address, SIREN number or Belgian enterprise number, VAT number, invoices, payments | Legal obligation (article 6(1)(c)) | Statutory retention period for accounting records: 10 years (article L123-22 of the French Commercial Code) |
| Keeping proof of acceptance of the terms of sale and the data processing agreement | Order and acceptance box ticked on the payment page (Stripe), date, accepted version | Legitimate interest in proving the contract (article 6(1)(f)) | Term of the contract, then 5 years (limitation period, article L110-4 of the French Commercial Code) |
| Keeping the services secure and running | Hosting providers' technical logs (IP address, date, page requested) | Legitimate interest (article 6(1)(f)) | Period set by each hosting provider; at most 1 year on our side |
This website sets no audience measurement or advertising cookies. The client area keeps your session in your browser's local storage, which is necessary to stay logged in; logging out ends the session.
Data processed on behalf of businesses
| Why | What data | How long |
|---|---|---|
| Asking the business's customers for a review, once, with at most one reminder | First name, email, date of visit, customer's consent confirmed by the business; sending, page opening, click through to Google | Deleted 120 days after the visit or the request |
| No longer writing to people who have unsubscribed | Email, reason (unsubscribe link or request to the business) | For as long as the business is a client, so that the unsubscription can be honoured |
| Replying to the business's Google reviews | Review text, rating, author's first name and initial, review identifier, reply | Text, rating and author deleted 30 days after receipt; the identifier is kept so the same review is not handled twice |
| Replying to comments received on the business's social networks (plans that include it) | Comment text, name displayed by the network, identifier, reply | Text and author deleted 30 days after receipt |
| Passing on to the business a message left on its review page | Rating, message and first name, both optional; no email address | 12 months after receipt |
| Producing content from the business's photos | Uploaded photos, which may show people | Term of the contract, then 30 days |
| Editing a video from the videos filmed by the business (plans that include it) | Original uploaded videos, which may show people and their voices, attached photos, the business's note | Original videos deleted 30 days after the edit is approved or rejected; an unfinished upload is deleted after 24 hours. The edited video follows the rule for content |
A review page or an approval link only opens with a random identifier that cannot be guessed; an approval link can be used once only and expires after 7 days.
Recipients and processors
Your data is neither sold nor rented. It is accessible to the company's authorised staff and to the following providers, each for its own task:
| Provider | Role | Location | Safeguard for transfers outside the Union |
|---|---|---|---|
| Supabase Pte. Ltd. | Database, accounts, client area files | European Union, Ireland (eu-west-1 region); company in Singapore | Any transfers outside the Union covered by European Commission standard contractual clauses (Supabase pages read on 13/10/2026) |
| GitHub, Inc. | Production of content and audits (GitHub Actions); hosting of the website and client area (GitHub Pages) | United States | EU–US Data Privacy Framework and standard contractual clauses (GitHub privacy statement read on 13/10/2026) |
| n8n | Automations: receiving the website's forms, sending emails, chaining tasks | European Union, Frankfurt (Germany), n8n Cloud | Standard contractual clauses in n8n's data processing agreement |
| Anthropic | Writing captions, replies to reviews and ideas (Claude), including photo analysis | United States | Data processing addendum included in the commercial terms, with standard contractual clauses (Anthropic page read on 13/10/2026) |
| Reading reviews and publishing on the Google listing (Business Profile API); public listing data for the audit (Places API) | Google data centres worldwide | Google LLC certified under the EU–US Data Privacy Framework, plus standard contractual clauses | |
| WasenderApi (WaSender) | Sending WhatsApp alerts to the business owner who asked for them in their account (their number; business name, rating, first name and initial of the review's author, excerpt of the published reply); the message is then carried by WhatsApp (Meta) | Company in London (United Kingdom) according to its privacy policy, read on 22/10/2026; place of processing not stated, to be checked | No data processing agreement or standard contractual clauses announced by WaSender in the pages read: to be checked. Only business owners who ticked the box receive these alerts; the others are notified by email |
| Metricool | Scheduling posts on social networks | European Union, Spain | No transfer outside the Union announced by Metricool |
| Email sending provider | Sending and receiving emails | Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); Google data centres worldwide | Google LLC certified under the EU–US Data Privacy Framework, plus standard contractual clauses |
Posts approved by the business are, by their nature, made public on its Google, Facebook, Instagram or TikTok accounts.
Transfers outside the European Union
As the company is established in the United Kingdom, the data of people located in the European Union is transferred to it in the United Kingdom. Safeguard applicable to this transfer: European Commission adequacy decision for the United Kingdom, renewed in December 2025, valid until 27 December 2031. Transfers to the providers above rely on the safeguards shown in the table.
Your rights
You can ask for access to your data, its rectification, its erasure, the restriction of its processing and its portability, and you can object to processing based on legitimate interest, in particular to prospecting emails: the unsubscribe link in each email is enough. Write to info@boostimpact.agency. You will receive a reply within the time limits set by the GDPR.
Texts written by artificial intelligence are submitted to the business or governed by its settings; no decision producing legal effects concerning you is made by automated means.
You can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL): cnil.fr/fr/adresser-une-plainte, or, if you are in Belgium, with the Belgian Data Protection Authority: dataprotectionauthority.be. As the company is established in the United Kingdom, the UK authority, the Information Commissioner's Office, can also be contacted: ico.org.uk.
Security
Login to the client area with an email address and a personal password, chosen from a link sent by email. Each business sees only its own data, a rule enforced by the database itself. Access keys to the services never leave the servers. Exchanges are encrypted (https).
Changes
This policy may change; the version in force is dated at the top of this page. Business clients are notified by email of any change that concerns them.