Privacy Policy

Nod, trading as part of the Optima Group (“Nod”, “we”, “us” or “our”) provides a customer feedback, customer experience and reputation management platform.

Nod enables businesses to collect customer feedback through NFC touchpoints, QR codes and web links, understand customer experiences, identify trends and areas requiring attention, and provide customers with access to third-party review platforms.

Our website is www.giveusthenod.co.uk.

This Privacy Policy explains how Nod handles personal information when you:

• visit our website;
• create or use a Nod business account;
• communicate with us;
• purchase or use our services; or
• interact with a customer feedback experience powered by Nod.

Businesses using Nod

Where a business uses Nod to collect feedback from its customers, that business will generally decide why the feedback is collected and how it is used.

In those circumstances, the business will generally act as the data controller and Nod will generally act as its data processor.

If you have a question about how a particular business uses your feedback, you should normally contact that business directly.

Where Nod is the controller

Nod may act as an independent data controller for activities where we determine why and how personal information is processed, including:

• managing Nod accounts;
• administering subscriptions;
• billing;
• operating and securing our website and services;
• fraud and abuse prevention;
• service analytics;
• communicating with business customers;
• complying with legal obligations; and
• establishing, exercising or defending legal claims.

Depending on how you interact with Nod, we may process the following information.

Business and account information

This may include:

• your name;
• business email address;
• organisation;
• job role;
• account information;
• login and authentication information; and
• subscription details.

Billing information

We may process information relating to your Nod subscription and payments. Payments may be processed by Stripe. Where Stripe processes card payments directly, Nod does not need to receive or store your complete payment card details.

Customer feedback

When you interact with a Nod feedback experience, we may process:

• ratings;
• feedback comments;
• feedback categories selected;
• business location;
• Nod touchpoint used;
• date and time of the interaction; and
• related feedback information.

Optional customer contact information

Some businesses may allow customers to request contact following their feedback.

If you choose to use this feature, we may collect information such as:

• your name;
• email address;
• telephone number; and
• information relevant to your request.

Providing this information is optional unless clearly stated otherwise.

Technical information

We may collect technical information required to operate, protect and understand use of our services, including:

• IP address;
• device type;
• browser information;
• interaction logs;
• security logs;
• cookie identifiers; and
• analytics information.

Communications

If you contact Nod, we may retain your message and associated contact information.

We may process information to:

• provide and operate Nod;
• deliver customer feedback experiences;
• provide businesses with their Nod portal;
• create and administer business accounts;
• manage locations and touchpoints;
• display customer feedback to the appropriate business;
• facilitate customer recovery and follow-up;
• analyse feedback;
• identify themes and trends;
• generate reports and insights;
• process subscriptions and payments;
• provide customer support;
• measure and improve our website and services;
• maintain security;
• prevent fraud, abuse and unauthorised access;
• comply with legal obligations; and
• establish, exercise or defend legal claims.

Nod may use automated and AI-assisted technology to help businesses understand customer feedback.

For example, these tools may be used to:

• identify recurring themes;
• analyse sentiment;
• identify emerging trends;
• identify feedback that may require attention;
• summarise feedback;
• generate insights; and
• suggest potential actions.

Nod does not intend to submit customer contact information, such as names, email addresses or telephone numbers, to AI analysis services.

We use technical and organisational measures designed to minimise the personal information supplied for AI-assisted analysis.

AI-generated outputs may occasionally be incomplete or inaccurate. They are intended to assist businesses in understanding feedback and should not replace appropriate human judgement.

Where Nod acts as a data controller, our lawful basis will depend on why information is being processed.

We may process personal information where:

• it is necessary to perform a contract or take steps before entering into a contract;
• processing is necessary for our legitimate interests in operating, securing, administering and improving Nod;
• we need to comply with a legal obligation; or
• you have given consent where consent is required.

Where Nod processes customer feedback on behalf of a participating business, that business is responsible for identifying the appropriate lawful basis for its processing and providing any privacy information required by law.

We may use trusted service providers to help us operate Nod.

These may provide services including:

• hosting;
• databases;
• authentication;
• storage;
• analytics;
• payments;
• security;
• customer support;
• communications; and
• AI-assisted processing.

Our current or expected technology providers include Lovable Cloud using Supabase technology, Google Analytics and Stripe. Pages also load their fonts from Google's font service, and when a touchpoint is linked to a public review page (such as Google), the browser may open a connection to that review site's domain as soon as the page loads — no information about you or the business is sent at that point.

We may add or replace providers as Nod develops.

We may also disclose information where reasonably necessary:

• to comply with law;
• to respond to a court, regulator or competent authority;
• to investigate fraud or security incidents;
• to establish, exercise or defend legal claims; or
• in connection with a genuine sale, investment, merger, acquisition or restructuring of Nod, subject to appropriate safeguards.

Some of our service providers may process information outside the United Kingdom.

Where UK data protection law treats this as a restricted international transfer, we will use an applicable adequacy regulation, approved contractual safeguards or another lawful transfer mechanism where required.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected.

This may take account of:

• our contractual obligations;
• a business Subscriber’s instructions;
• legal requirements;
• accounting requirements;
• security requirements;
• dispute resolution; and
• the establishment, exercise or defence of legal claims.

Customer feedback and associated personal information will be retained in accordance with the applicable business subscription arrangements and our data processing obligations.

Nod uses technical and organisational measures designed to protect personal information against accidental or unlawful:

• loss;
• destruction;
• alteration;
• unauthorised disclosure; or
• unauthorised access.

No online service can guarantee absolute security.

Depending on the circumstances, UK data protection law may give you rights to:

• access your personal information;
• correct inaccurate information;
• request deletion;
• restrict certain processing;
• object to certain processing;
• receive certain information in a portable format; and
• withdraw consent where processing is based on consent.

Where your request relates to feedback collected for a particular business through Nod, that business may be the appropriate organisation to contact because it will generally be the data controller.

Nod will provide reasonable assistance where we process that information on the business’s behalf.

You may also have the right to complain to the Information Commissioner’s Office (ICO).

Our website may use technologies that are necessary to operate the website and services.

Subject to obtaining any consent required by law, we may also use Google Analytics and advertising or measurement technologies.

Please see our Cookie Policy for more information.

Nod is designed as a business customer-feedback service and is not intentionally directed at children.

Businesses using Nod should consider their own customers and legal obligations when configuring feedback experiences.

We may update this Privacy Policy as Nod develops or where legal, regulatory or technical requirements change.

The latest version will be published on our website.

If you have questions about this Privacy Policy or Nod’s use of personal information, contact: