Data Processing Agreement | Page Optimized

What this is

This agreement applies whenever Page Optimized processes personal data on your behalf, and forms part of the terms of service. Accepting the terms accepts this.
You are the controller. We are the processor. Where you are yourself processing on behalf of your own client, you are their processor and we are a sub-processor, and this agreement passes through.
You do not need to sign anything for it to apply. If your counterparty requires a signed copy, email support@pageoptimized.com and we will send one countersigned.

Subject matter: providing the SEO platform described in the terms of service.
Duration: for as long as your account exists, plus the thirty-day export window and the thirty-five-day backup cycle.
Nature and purpose: storing, organizing, analyzing, and displaying search performance data, and transmitting the parts of it needed to complete a run you requested.
Categories of personal data: names, email addresses, and roles of the people in your workspace; the email address of anyone you invite; portal viewers are not identified. Website data we process for you may incidentally contain personal data if your pages do.
Categories of data subjects: your staff, your clients' staff whom you invite, and people whose personal data appears on websites you analyze.
We process no special category data deliberately and ask that you do not put any into the product.

We process personal data only on your documented instructions. Using the product is an instruction. If a law forces us to do something else we tell you first, unless that law forbids it.
Everyone with access is bound by confidentiality and reaches only what their role requires.
We apply the security measures described in the privacy policy and will not weaken them during the agreement.
We help you answer data subject requests, run impact assessments, and consult a regulator, at no charge for anything of reasonable scale.
We tell you about a personal data breach without undue delay and always within seventy-two hours of becoming aware.
On termination we delete or return the data at your choice, apart from copies in backups, which expire on the thirty-five-day cycle and are not restored to live use.

You give general authorization for the sub-processors listed on our sub-processors page, which is the current list at all times.
We give thirty days notice before adding one. Email support@pageoptimized.com to be notified, and you will be.
You may object on reasonable data protection grounds. If we cannot resolve it, you may terminate the affected part of the service and we refund the unused period.
Each sub-processor is bound by obligations no weaker than these, and we remain responsible to you for what they do.

Where personal data leaves the UK, EU, or Switzerland, the Standard Contractual Clauses apply and are incorporated here by reference: Module Two where you are a controller, Module Three where you are a processor for your own client.
The UK Addendum applies to UK transfers, and the Swiss amendments to Swiss ones.
You are the data exporter. We are the data importer. The annexes are the two sections above, which describe the processing and the security measures.

We will answer a reasonable security questionnaire once a year, and sooner after a breach that affected you.
You may audit our compliance where a regulator requires it, on thirty days notice, once in twelve months, at your cost, and under confidentiality.
In most cases our written answers and documentation resolve it, and we would rather spend the time answering your questions properly than hosting a visit.

Questions?

Contact Page Optimized through the contact form.