Data Processing Agreement (DPA)

1. Subject matter of processing

We process data solely to provide the service and only on the documented instructions of the Controller (the settings and actions in the Platform).

2. Categories of data and data subjects

• the Controller's team members and clients (name, email);
• visitors to the Controller's websites, only in the form of aggregated statistics (Search Console, Analytics);
• individuals mentioned in content created by the Controller.

3. Obligations of the Processor

• confidentiality obligations for personnel with access;
• appropriate technical and organisational measures (see Privacy Policy – Security);
• assistance with data subject requests and data protection impact assessments;
• notification of personal data breaches without undue delay, and no later than 48 hours after becoming aware of them;
• deletion or return of the data upon termination of the contract.

4. Sub-processors

The Controller authorises the use of the sub-processors on the published list. We give at least 30 days' notice of changes by email or in the Platform; the Controller may object on reasonable grounds.

5. International transfers

Transfers outside the EU/EEA and Switzerland take place only with appropriate safeguards (adequacy decisions or standard contractual clauses).

6. Audit

Upon request, we make available the information necessary to demonstrate compliance. On-site audits must be scheduled 30 days in advance, at the Controller's expense.

7. Contact

Questions about this agreement: [email protected].