Data Processing Addendum

Scope and roles

This addendum forms part of the applicable Attriboo service agreement when SEO RANK SERP LLC processes personal data on a customer's behalf. The customer is the controller, or a processor authorized by its controller; Attriboo is the processor or subprocessor for that data. Controller activities for Attriboo's own account administration, billing, security, and support are covered separately in the Privacy Policy.

The customer is identified by the account or service order that accepts this addendum. The processor is SEO RANK SERP LLC, 8 The Green, Dover, Delaware 19901, United States. The support form is the contact channel for instructions, rights assistance, incidents, and data-protection inquiries.

Processing description

Customer instructions and obligations

The agreement, customer configuration, and lawful written requests are documented instructions. The customer must have authority and a lawful basis for the processing and must give required notices and obtain required consent. The customer is responsible for the accuracy and lawful collection of its data and for its own privacy decisions.

We process customer personal data only on documented instructions, including for transfers, unless law requires otherwise. Where permitted, we inform the customer of a legal requirement before that processing. We will inform the customer if, in our opinion, an instruction infringes applicable data-protection law and may suspend that instruction while the concern is resolved.

Confidentiality and security

People authorized to process customer personal data must be bound by confidentiality duties and limited to appropriate access. We apply technical and organizational measures proportionate to the data, service, risks, and available technology, and do not materially reduce the overall protection during the service term.

Measures include authenticated workspace access, role and database access controls, separation of customer workspaces, protected management of server-side credentials, transport protection through the hosting providers, and procedures for handling incidents and restoration. Provider-operated infrastructure and backup controls form part of the relevant service configuration. We do not claim a certification, audit, encryption property, or recovery guarantee that has not been established.

Subprocessors

The customer generally authorizes the providers listed in the Subprocessor and Service Provider List for the relevant processing. We must impose appropriate data-protection duties on subprocessors and remain responsible for their performance of our processing obligations under applicable law.

We will give at least 15 days' advance notice of a new or replacement subprocessor for customer personal data, except where an urgent security or continuity need requires a shorter lawful period. The customer may object on reasonable data-protection grounds during that period through support. We will work toward a reasonable alternative; if the issue cannot be resolved, the customer may end the affected service and receive an appropriate unused prepaid-period refund.

Assistance and incidents

Taking into account the nature of processing and information available, we assist the customer with data-subject requests, security obligations, breach notifications, impact assessments, and required regulator consultations. We do not independently decide a visitor's request concerning customer-controlled data unless law requires it.

We notify the customer without undue delay after becoming aware of a personal-data breach affecting its data and provide available information about the nature, affected records, likely effects, and measures taken. We may provide information in stages as an investigation develops. The customer remains responsible for any notice it must give to people or authorities.

Return and deletion

On service termination or a lawful customer request, we will return or delete customer personal data as instructed, subject to legal retention obligations. We will agree a reasonable method and timeframe through support. Any retained copy must remain protected, isolated from ordinary use where appropriate, and deleted when the retention basis ends.

Backup copies may remain until their normal protected replacement cycle. The existence of a reporting limit does not itself establish a deletion schedule. The customer should arrange required exports and clarify retention before closing the account.

Information and audits

We will make information reasonably necessary to demonstrate these processing obligations available and cooperate with proportionate customer audits or inspections as required by law. The parties should first use available documentation and agree reasonable confidentiality, scope, timing, and safeguards to avoid exposing other customers' data or disrupting service. These arrangements do not prevent a competent authority from exercising its lawful powers.

Restricted international transfers

A restricted transfer must not occur without the lawful mechanism and any supplementary measures required for it. Where appropriate, the parties must enter the applicable European Commission Standard Contractual Clauses, UK addendum or transfer agreement, or rely on another valid recognized mechanism before the affected transfer. The relevant modules, annexes, entities, locations, and measures depend on the processing arrangement and must be completed accurately.

This addendum does not by itself certify that all transfer conditions have been met and does not substitute for required executed transfer terms or assessments. Request the applicable transfer documentation through support before beginning processing that requires it.

Order of terms

Mandatory law and applicable executed transfer clauses prevail over inconsistent service terms. This addendum prevails for the processing obligations it covers. Other service terms continue to apply where consistent with those obligations.