You (the customer) are the data controller of the personal data you put into the Service, or a processor acting for your own clients. SEO War Room is your data processor (or subprocessor). Each party complies with the data protection law applicable to it, including the GDPR, UK GDPR, and CCPA/CPRA where relevant.

Subject matter and duration: provision of the SEO War Room platform for the term of your subscription. Nature and purpose: hosting, storage, retrieval, analysis, and display of data you submit, to deliver the Service's features. Categories of data: contact and identity data of your team and clients, website and search performance data, content, and communications you store in the platform. Data subjects: your personnel, your clients, and your clients' end users to the extent their data appears in connected analytics.

We process personal data only on your documented instructions: these Terms, your configuration of the Service, and your use of its features constitute those instructions. We will inform you if we believe an instruction violates data protection law.

Access to customer personal data is limited to personnel who need it to operate or support the Service, and who are bound by confidentiality obligations.

We implement and maintain the technical and organizational measures described on our Security page, including encryption in transit (TLS) and at rest (AES-256), workspace isolation enforced by database row-level security, role-based access control, encrypted storage of integration tokens, and routine dependency and vulnerability review. We may improve these measures over time but will not materially reduce the overall level of protection during a subscription term.

You authorize the subprocessors listed on our Subprocessors page. We impose data protection obligations on each subprocessor consistent with this DPA and remain responsible for their performance. We will update that page at least 30 days before adding a new subprocessor that processes customer personal data; if you have a reasonable objection, you may raise it within that window and, if we cannot address it, terminate the affected subscription with a pro-rata refund of prepaid fees.

The Service provides self-serve tools to access, export, correct, and delete personal data. Where a request cannot be fulfilled through those tools, we will provide reasonable assistance so you can respond to data subject requests within your legal deadlines.

We will notify you without undue delay, and in any event within 72 hours of confirming a personal data breach affecting your data, with the information reasonably needed for your own notification obligations: the nature of the breach, categories and approximate volume of affected data, likely consequences, and the measures taken or proposed.

During the subscription you can export your data at any time. On termination, you have 30 days to export, after which we delete customer personal data from production systems within 30 days and from backups within 90 days, unless law requires longer retention.

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including our security documentation and subprocessor list. Where that documentation is insufficient to satisfy a legal requirement, you may request a written audit response, no more than once per year.

Where processing involves transfers of EU, UK, or Swiss personal data to countries without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (module two or three, as applicable) and the UK Addendum, which are incorporated into this DPA by reference, with us as data importer and you as data exporter.

If this DPA conflicts with the Terms of Service regarding processing of personal data, this DPA controls. Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service.