Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between [Company Name] ("Processor") and the customer ("Controller") and applies where the Controller is subject to the GDPR or equivalent data protection legislation.

1. Roles

The Controller determines the purposes and means of processing personal data. The Processor processes personal data only on the Controller's documented instructions. For personal data the Processor collects directly from data subjects (e.g. user account data), the Processor acts as a Controller in its own right and the Privacy Policy applies.

2. Subject matter and nature of processing

• Subject matter: Processing of personal data to provide the GEO.actor services.
• Nature: Collection, storage, analysis, and transmission of personal data as necessary to operate the Platform.
• Purpose: Provision of AI visibility tracking, content optimisation, and related services as described in the Terms of Service.
• Duration: For the term of the subscription agreement, plus the retention periods set out in the Privacy Policy.
• Types of personal data: Email addresses, names, IP addresses, usage logs, outreach contact data (where the outreach feature is used).
• Categories of data subjects: The Controller's employees, contractors, and end users of the Platform; outreach contacts (where applicable).

3. Processor obligations

The Processor shall:

• Process personal data only on documented instructions from the Controller, unless required to do so by law.
• Ensure that persons authorised to process personal data are bound by confidentiality obligations.
• Implement appropriate technical and organisational security measures (see Section 5).
• Not engage sub-processors without the Controller's prior written consent or general authorisation. General authorisation is granted by accepting this DPA; the current sub-processor list is in the Privacy Policy.
• Assist the Controller in fulfilling its obligations under Articles 32–36 of the GDPR.
• Delete or return all personal data to the Controller on termination of the agreement, within the timelines set out in the Privacy Policy.
• Provide the Controller with all information necessary to demonstrate compliance with Article 28 GDPR.

4. International transfers

Where personal data is transferred outside the EEA, the Processor relies on one or more of the following lawful transfer mechanisms:

• EU adequacy decisions (e.g. EU-US Data Privacy Framework where applicable).
• Standard Contractual Clauses (SCCs) as adopted by the European Commission (Implementing Decision (EU) 2021/914), incorporated herein by reference.

A copy of the applicable SCCs is available on request at gkadiysky@gmail.com.

5. Security measures

The Processor implements the following technical and organisational measures:

• Encryption of personal data at rest (AES-256) and in transit (TLS 1.3).
• API keys stored encrypted; displayed only as the last 4 characters.
• Access control: role-based access, principle of least privilege.
• Audit logging of all access to personal data.
• Regular security reviews and penetration testing.
• Incident response plan with 72-hour breach notification to supervisory authority.
• Data minimisation: only data necessary for the stated purposes is collected.

6. Sub-processors

The Controller will be notified of any changes to the sub-processor list at least 14 days before the change takes effect and may object in writing within that period. The current list is also published in the Privacy Policy.

Schedule 1 — Sub-processors

7. Contact

DPA enquiries: gkadiysky@gmail.com