Data Processing Agreement
This data processing agreement ("DPA") forms part of the Terms of Service between SEOMISE LTD ("we", the processor) and the customer that accepts it for its workspace ("you", the controller). It applies where we process personal data on your behalf in providing SEOmise, and is written to meet Article 28 of the GDPR and of the UK GDPR.
1. Subject matter and duration
We process the personal data contained in the content you add to or connect with your workspace for as long as you use the service, and until it is deleted under section 10.
2. Nature and purpose
Storing, analysing and showing that data to provide the features you use: site audits and monitoring, rank and search data, local SEO and Google Business Profile management, reviews and replies, link management, visitor analytics (Live view), reports, approved changes to your website through the connectors, and AI-assisted drafts that a person approves.
3. Types of personal data and data subjects
- Your team: names, e-mail addresses, roles and activity.
- Reviewers and people who ask questions on your Business Profile: names, opinions and the content of reviews and questions.
- Visitors to your website, where you add the Live view tracker: pages viewed, clicks, scrolling, device and approximate location, with IP addresses shortened by default.
- People named in content you add (for example on your web pages or in ReFame projects).
No special category data is needed for the service; please do not add it.
4. Your instructions
We process personal data only on your documented instructions, which are this DPA, the Terms of Service and your use of the service, unless the law requires otherwise. We will tell you if we believe an instruction breaks data protection law.
Our own use of service data to improve SEOmise (described in the Data Use Policy) uses de-identified or aggregated data; anonymous group figures are built only from groups of at least 10 separate businesses and never include customer names, domains or addresses, and Google data is never used for it. A workspace owner can opt out of pooled use under Account.
5. Confidentiality and security
Everyone authorised to process the data is bound by confidentiality. We apply the technical and organisational measures described on our security page and trust centre, including encryption in transit and of secrets and stored records at rest, role-based access, two-step sign-in for staff, an append-only audit log, encrypted backups and periodic access reviews.
6. Sub-processors
You authorise the sub-processors listed below and on our sub-processors page. We impose the same data protection obligations on each and remain responsible for them. We will update that page before adding or replacing a sub-processor, and you may object on reasonable grounds.
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe | Taking subscription payments, invoices and the customer billing portal | Ireland and the United States |
| Brevo | Sending service e-mail: invitations, password resets, alerts and reports | European Union |
| Anthropic | AI analysis and drafts (audit summaries, link plans, review reply drafts) when you ask for them | United States |
| Connecting Google Business Profile (locations, reviews, posts, performance) and Google Search Console (search performance of your sites) when you link them | United States and other Google locations | |
| DataForSEO | Backlink and referring-domain data for the websites you add | European Union |
| WordPress.com mShots (Automattic) | A picture of a website's home page while you add it as a project | United States |
7. International transfers
Where personal data is transferred outside the UK or the EEA, the transfer is covered by an adequacy decision or the European Commission's Standard Contractual Clauses (with the UK addendum where needed).
8. Helping you
We help you answer requests from data subjects (the service has self-service export, correction and deletion), carry out data protection impact assessments and meet your security obligations, taking into account the nature of the processing.
9. Personal data breaches
We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to notify your supervisory authority within 72 hours.
10. Deletion and return
You can export your workspace's data at any time. When you close your workspace, its data is deleted after the recovery period (30 days), and from backups as they are replaced, except where the law requires us to keep it (such as invoices). The Data Retention Policy lists every period.
11. Audits
We make available the information needed to demonstrate compliance with this DPA and allow for audits, which may be met by our latest security documentation and answers to your reasonable questions.
12. Law
This DPA is governed by the law that governs the Terms of Service (Ireland).
13. Contact
Data protection questions: e-mail at [email protected]. If your organisation needs its own terms, contact us.
