GDPR and Reviews: What Service Businesses Need to Know

Every review contains personal data: the reviewer's name, email address, and the content of their feedback. Under GDPR, this data requires a lawful basis for processing, transparent communication about how it's used, and mechanisms for individuals to exercise their rights. For service businesses operating in the EU, understanding these requirements isn't optional — it's a legal obligation.

The good news is that review collection aligns well with GDPR's 'legitimate interest' basis. A service business has a legitimate interest in collecting feedback about their services, and the individual has a reasonable expectation that their feedback may be published. However, this must be communicated clearly at the point of collection — the reviewer should know their name and review text will be displayed publicly.

GPS data introduces additional considerations. Location data is classified as sensitive under GDPR and requires explicit consent before collection. Provn handles this through a consent flow in the scanner interface — the reviewer must explicitly allow location access, and the purpose (verification only) is clearly stated. Critically, raw GPS coordinates are discarded immediately after verification. Only the distance and pass/fail result are retained, minimising the data footprint.

Data retention and deletion rights are straightforward: review data is retained while the business account is active. If the business deletes their account, all associated data — reviews, interactions, check-ins, and personal information — is permanently purged. Individual reviewers can request deletion of their review data through the business or directly via the contact form. The key principle is transparency: tell people what you collect, why you collect it, and how long you keep it.