This Data Processing Addendum (“DPA”) forms part of the Terms of Service between AIRankSurge (the processor) and the customer (“you”, the controller). It applies where AIRankSurge processes personal data on your behalf that is subject to UK GDPR, EU GDPR or similar law.
1. Details of processing
| Subject matter | Providing the AIRankSurge service under the Terms |
| Duration | The term of your subscription, plus the deletion periods in section 8 |
| Nature and purpose | Crawling and auditing your websites, generating findings and proposed changes, applying approved changes through connectors, verification, reporting and support |
| Types of personal data | Personal data that appears on your public web pages (for example staff names or contact details), business profile details, team members’ names and emails, and Search Console data if connected |
| Data subjects | Your team members, and individuals named on your websites |
2. Our obligations
We will:
- process personal data only on your documented instructions, which are the Terms, this DPA and your use of the Service, unless the law requires otherwise (in which case we’ll tell you unless the law forbids it);
- make sure people authorised to process the data are bound by confidentiality;
- implement appropriate technical and organisational security measures, described on our trust and security page, including encryption in transit and of credentials at rest, access control and logging;
- help you respond to data subject requests and meet your obligations on security, breach notification and impact assessments, taking into account the nature of the processing;
- notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting your data;
- delete or return your personal data when the Service ends, as set out in section 8;
- make available the information needed to show compliance with this DPA, and allow reasonable audits (normally by answering a written questionnaire) once a year with 30 days’ notice.
3. Subprocessors
You authorise us to use the subprocessors listed on our subprocessors page. We’ll give at least 30 days’ notice of a new subprocessor by updating that page and emailing account owners. You may object on reasonable data protection grounds; if we can’t address the objection, you may cancel the affected Service and receive a pro-rata refund of prepaid fees. We impose data protection terms on each subprocessor that are no less protective than this DPA and remain responsible for their performance.
4. International transfers
Where personal data is transferred outside the UK or EEA to a country without an adequacy decision, the Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant) apply and are incorporated by reference.
5. Your obligations
You’re responsible for having a lawful basis for the personal data on your websites and in the data you provide, and for the instructions you give us.
6. Liability
Each party’s liability under this DPA is subject to the limitations in the Terms, except where the law does not allow it.
7. Conflicts
If this DPA conflicts with the Terms on data protection matters, this DPA prevails.
8. Deletion
After your account closes, you can export your data for 30 days. We then delete your personal data within a further 30 days, and from encrypted backups when they’re overwritten, unless the law requires us to keep it.
To request a signed copy of this DPA, email hello@airanksurge.com.