Data Processing Addendum

This Data Processing Addendum (DPA) is part of the SEODash Terms of Service . It applies when you use SEODash for a business and we process personal data on your behalf. You accept it when you accept the Terms: there is nothing to sign. If you need a countersigned copy for your records, email privacy@seodash.com .

1. Parties and scope

• We are Blauer Digital Ltd, company number 16749729, C/O Pollock Accounting Ltd, 3 - 4 Sentinel Square, London, United Kingdom, NW4 2EL, trading as SEODash. We are the processor.
• You are the business customer that holds the SEODash account. You are the controller, or a processor acting for your own client, in which case we are your subprocessor.
• Customer personal data means personal data in the property data you connect (Search Console and GA4 data), the report recipients you add, and other personal data we process on your behalf to provide SEODash.
• Data protection law means the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR. Terms such as controller, processor, personal data breach and supervisory authority have the meanings given in those laws.

This DPA does not cover personal data we handle as a controller for our own purposes, such as your account, billing and support data and data about how accounts use SEODash. Our Privacy notice covers that.

If this DPA and the Terms conflict on data protection, this DPA wins.

2. Your instructions

We process customer personal data only on your documented instructions. You give those instructions through the Terms, this DPA, and the features you set up and use, for example connecting a property, scheduling a report, turning on AI features or AI Visibility, or creating a webhook. We will not process customer personal data for any other purpose, unless the law requires it; in that case we will tell you first, unless the law forbids that.

If we think an instruction breaks data protection law, we will tell you.

We never use customer personal data, or any data we receive from Google APIs, for the aggregated insights described in our Privacy notice . Those come only from data about how accounts use SEODash itself, which we handle as a controller, and they never identify you, a person or a property.

3. Your responsibilities

You are responsible for:

• having a lawful basis to connect each property and to have us process its data;
• giving the people in your data the information the law requires, and having the right to send reports to the recipients you add;
• not putting special category data (such as health data) into free-text fields such as annotations or chat, unless you have a lawful basis for it.

4. Confidentiality

Everyone we authorize to process customer personal data is bound by a duty of confidentiality, by contract or by law.

5. Security

We keep appropriate technical and organizational measures in place to protect customer personal data, taking into account the risks involved. Annex 2 describes them. We may improve them over time, but we will not reduce the overall level of protection.

6. Subprocessors

You give us general authorization to use subprocessors. The current list is on our Subprocessors page.

• We will give you at least 30 days' notice before a new subprocessor starts processing customer personal data, by updating that page and emailing the address on your account.
• You can object on reasonable data protection grounds within those 30 days by emailing privacy@seodash.com . We will work with you in good faith to find a solution. If we cannot, you may end the affected service and we will refund any prepaid fees for the unused part of it.
• We give each subprocessor data protection obligations that are at least as protective as this DPA, and we remain responsible to you for its performance.

7. Helping you meet your obligations

Taking into account the nature of the processing and the information we have, we will:

• help you respond to requests from people exercising their data protection rights. If we receive one directly, we will pass it to you and not answer it ourselves unless you ask us to;
• give you the information you reasonably need for data protection impact assessments and consultations with supervisory authorities about SEODash.

8. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting customer personal data. We will give you the information you need to meet your own obligations, as it becomes available, and take reasonable steps to contain the breach and reduce its effects.

Telling you about a breach is not an admission of fault.

9. Deletion at the end

When you delete a property, we delete its data after 30 days, except the shared property settings, which the Privacy notice explains. When you delete your account, or it closes, we delete customer personal data after a 30-day grace period, during which you can ask us for a copy at privacy@seodash.com . Deleted data can stay in backups for up to 30 more days before it is overwritten. We keep data after that only where the law requires it.

10. Audits

We will make available the information you reasonably need to show that we meet this DPA. Once a year, or after a personal data breach, we will answer a reasonable security questionnaire.

If that information is not enough, or a supervisory authority requires it, you may audit our compliance with this DPA, yourself or through an independent auditor bound by confidentiality. You must give us at least 30 days' notice, the audit must take place during business hours and must not disrupt our other customers or reveal their data, and you pay for it.

11. Transfers outside the UK and the EEA

We and our subprocessors may process customer personal data in the countries listed on the Subprocessors page, including the United States. Where a transfer needs safeguards under data protection law, we make sure one is in place: an adequacy decision or regulations, the EU-US Data Privacy Framework and its UK Extension, the EU Standard Contractual Clauses, the UK Addendum to them, or the UK International Data Transfer Agreement.

If you are in the EEA, your transfers to us in the UK rely on the European Commission's adequacy decision for the UK. If that decision stops applying, the EU Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, as the case may be) are incorporated into this DPA, with these choices: the optional Clause 7 is included; under Clause 9, option 2 applies with the notice period in section 6; the option in Clause 11 is not used; the supervisory authority under Clause 13 is the one competent for you; and Clauses 17 and 18 choose the law and courts of Ireland. Annexes 1 and 2 of this DPA complete the Clauses' annexes.

12. Google data

Customer personal data we receive from Google APIs is also covered by the Google API Services User Data Policy, including the Limited Use requirements, as our Privacy notice describes. Nothing in this DPA allows a use that policy forbids.

13. Liability and term

Each party's liability under this DPA is subject to the limits in the Terms, as far as data protection law allows. This DPA lasts as long as we process customer personal data for you.

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption. Data in transit is encrypted with TLS. Google access and refresh tokens are encrypted with AES-256-GCM. Cached data and archive files are encrypted at rest, and encryption keys are rotated.
• Access control. Every request is authenticated and checked against the account that owns the data, and the database enforces the same separation. Staff access to production is limited to the people who need it, and we look at customer data only as section 2 and our Privacy notice allow.
• Minimization. IP addresses are stored only as a keyed hash of the network part. Share links and report links are stored as hashes. Error reports are scrubbed of personal details before they are sent.
• Resilience. The Search Console and GA4 archive is backed up every week, and databases have point-in-time recovery.
• Deletion. Account deletion revokes Google access, API keys, links and webhooks at once, and a scheduled job then deletes the data from every store and checks it is gone.
• Monitoring. We monitor errors, scheduled jobs and unusual activity, and keep an audit trail of administrative changes.
• Suppliers. Our subprocessors are established infrastructure providers bound by data processing terms.