Data Processing Agreement

This Data Processing Agreement (the “DPA”) forms part of the Terms of Service between the Customer and [Company name] and governs the processing of personal data that [Company name] carries out on behalf of the Customer to provide GeoKy, pursuant to Article 28 of Regulation (EU) 2016/679 (the “GDPR”).

The Customer acts as controller and [Company name] as processor. Terms not defined here have the meaning given to them in the GDPR.

Subject matter: the provision of the Service described in the Terms. Nature and purpose: hosting, storage, analysis and transmission of the data needed to measure a brand’s presence in AI engine answers, produce reports and manage accounts and billing. Duration: the term of the subscription plus the retention period described in the section on return and deletion.

Data subjects: the Customer’s users of the Service (employees and collaborators) and any natural persons whose data the Customer enters in the Service. Categories of data: identification and contact data (name, email address), authentication and usage data (logs, IP address, technical identifiers) and content entered by the Customer (such as brand, competitor and website information, and prompts).

The Service is not designed to process special categories of personal data or data relating to criminal convictions, and the Customer undertakes not to enter them.

[Company name] processes personal data only on the Customer’s documented instructions, which consist of the Terms, this DPA and the configuration of the Service, unless the law requires otherwise; in that case it informs the Customer, unless the law prohibits it. [Company name] informs the Customer if, in its opinion, an instruction infringes data protection law.

[Company name] ensures that the persons authorised to process personal data are bound by confidentiality and, taking into account the nature of the processing, assists the Customer in responding to data subject requests and in complying with Articles 32 to 36 of the GDPR.

[Company name] implements appropriate technical and organisational measures under Article 32 of the GDPR, including: encryption of data in transit and at rest provided by the infrastructure providers; separation of each customer’s data through access controls at database level; access to production systems limited to authorised personnel; payment card data handled exclusively by the payment provider; monitoring of errors and availability.

[Company name] notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data, providing the information available to allow the Customer to meet its obligations under Articles 33 and 34 of the GDPR.

The Customer gives a general authorisation to engage sub-processors. The sub-processors in use are listed in Annex A. [Company name] informs the Customer of any intended addition or replacement at least 15 days in advance; the Customer may object on reasonable data protection grounds and, if no agreement is reached, may terminate the subscription before the change takes effect.

[Company name] imposes on each sub-processor data protection obligations equivalent to those of this DPA and remains responsible to the Customer for their performance.

Some sub-processors are established or process data outside the European Economic Area, as indicated in Annex A. In those cases transfers are based on an adequacy decision, including the EU-US Data Privacy Framework where the recipient is certified, or on the Standard Contractual Clauses adopted by the European Commission.

[Company name] makes available to the Customer the information necessary to demonstrate compliance with Article 28 of the GDPR and allows audits, including inspections, by the Customer or by an auditor it appoints who is bound by confidentiality. Audits require at least 30 days of notice, take place no more than once a year except after a personal data breach, and are at the Customer’s expense.

When the subscription ends, the Customer may request the export of the personal data by writing to [Contact email] within 30 days. In any case, [Company name] deletes the personal data processed on the Customer’s behalf within 60 days of the end of the subscription, unless the law requires them to be kept.

Liability under this DPA is subject to the limitations set out in the Terms, to the extent permitted by the GDPR. In case of conflict between the Terms and this DPA on the processing of personal data, this DPA prevails.