AuditOpti Data Processing Addendum

This DPA applies where OptiRank Studio processes Customer Personal Data on behalf of the Customer in connection with AuditOpti. Examples include client contact email addresses the Customer adds for report delivery, personal data of the Customer's team members using the Service, and personal data that may appear in website content, crawl results or reports the Customer generates.

OptiRank Studio acts as an independent controller, and not as a processor, for personal data it processes for its own purposes, such as managing customer accounts and billing, securing the Service, preventing abuse, improving the Service and meeting legal obligations. That processing is described in the AuditOpti Privacy Policy. Where applicable law assigns a different role to a party for a particular activity, the parties will comply with the obligations that apply to that role.

In this DPA, capitalized terms have the following meanings:

• Customer means the person or organization that has accepted the Agreement and uses AuditOpti.
• Controller means the party that determines the purposes and means of processing personal data.
• Processor means the party that processes personal data on behalf of a Controller.
• Personal Data means any information relating to an identified or identifiable natural person, as defined by applicable Data Protection Laws. Customer Personal Data means Personal Data that OptiRank Studio processes on behalf of the Customer under the Agreement.
• Data Subject means the identified or identifiable natural person to whom Personal Data relates.
• Processing means any operation performed on Personal Data, such as collection, recording, organization, storage, retrieval, use, disclosure, erasure or destruction, and “process” has a corresponding meaning.
• Subprocessor means a third party engaged by OptiRank Studio that processes Customer Personal Data.
• Security Incident means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• Data Protection Laws means all data-protection and privacy laws that apply to the processing of Customer Personal Data under the Agreement, which may include UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, where applicable, the EU or UK General Data Protection Regulation.

OptiRank Studio will process Customer Personal Data only on the Customer's documented instructions, unless applicable law requires otherwise. In that case, OptiRank Studio will inform the Customer of the legal requirement before processing, unless the law prohibits doing so.

The Agreement, this DPA and the Customer's configuration and use of the Service, such as the websites it submits, the schedules it sets and the recipients it adds for reports, are the Customer's complete documented instructions. Additional instructions must be agreed in writing. OptiRank Studio will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.

The Customer is responsible for its use of the Service and for Customer Personal Data. The Customer will:

• ensure it has a lawful basis for the processing of Customer Personal Data carried out through the Service;
• provide any notices to Data Subjects that Data Protection Laws require;
• obtain any consents, authorizations or permissions required, including permission to audit the websites it submits;
• ensure that its instructions to OptiRank Studio comply with Data Protection Laws;
• not submit to the Service special categories of personal data, payment card data or other data that it is prohibited from processing or that the Service is not designed to handle; and
• comply with all Data Protection Laws that apply to it as a Controller.

The subject matter, duration, nature and purpose of the processing, and the categories of Personal Data and Data Subjects, are described in Annex 1. Technical SEO audits do not require Personal Data, and the Customer is encouraged to limit Customer Personal Data to what is necessary for its use of the Service.

OptiRank Studio will ensure that its personnel and contractors authorized to process Customer Personal Data are subject to appropriate confidentiality obligations, whether contractual or statutory, and access Customer Personal Data only to the extent necessary to provide, support and secure the Service.

OptiRank Studio will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against Security Incidents, taking into account the nature, scope, context and purposes of the processing and the risks to Data Subjects. The measures in place at the date of this DPA are described in Annex 2 and cover access control, authentication, authorization, encryption in transit, logging, monitoring, backups, incident response, least-privilege access and secure development practices.

OptiRank Studio may update its security measures over time, provided that updates do not materially reduce the overall level of protection. This DPA does not represent that OptiRank Studio holds any particular third-party security certification.

OptiRank Studio will notify the Customer of a Security Incident affecting Customer Personal Data without undue delay after becoming aware of it, subject to applicable law and to any measures needed to contain the incident or to meet the legitimate requests of law enforcement.

The notification will describe, to the extent then known, the nature of the incident, the categories and approximate volume of data affected, the likely consequences and the measures taken or proposed. OptiRank Studio will take reasonable steps to contain and remediate the incident and will provide further information as it becomes available. Notification of a Security Incident is not an acknowledgement of fault or liability.

The Customer authorizes OptiRank Studio to engage Subprocessors to provide infrastructure, database hosting, background processing, storage, authentication, payments, email delivery, crawling and data services, and AI services. The Subprocessors currently used for the production AuditOpti service are:

OptiRank Studio will impose data-protection obligations on each Subprocessor that are appropriate to the services it provides and will remain responsible for its Subprocessors' performance of those obligations.

Before a new Subprocessor begins processing Customer Personal Data, OptiRank Studio will update the list above and, for material changes, notify customers by email or through the Service where reasonably practicable. The Customer may object to a new Subprocessor on reasonable data-protection grounds by contacting hello@auditopti.com. The parties will discuss the objection in good faith; if it cannot be resolved, the Customer may cancel the affected Service as described in the Terms of Service.

Taking into account the nature of the processing, OptiRank Studio will provide reasonable assistance to the Customer, where technically and legally appropriate, in responding to requests from Data Subjects to exercise their rights under Data Protection Laws. If OptiRank Studio receives such a request directly relating to Customer Personal Data, it will, where legally permitted, refer the Data Subject to the Customer and will not respond substantively without the Customer's authorization, unless required by law.

Where required by Data Protection Laws and proportionate to the processing, OptiRank Studio will provide reasonable assistance to the Customer in carrying out data protection impact assessments and any related consultations with supervisory authorities, to the extent the Customer does not otherwise have access to the relevant information.

If OptiRank Studio receives a legally binding request from a government authority or law enforcement agency for access to Customer Personal Data, it will review the request for legal validity, disclose only the data it is legally required to disclose, and, where legally permitted, notify the Customer before disclosure so that the Customer can seek a protective order or other remedy. Where notice is not permitted, OptiRank Studio will consider whether it can lawfully challenge or narrow the request.

OptiRank Studio and its Subprocessors process Customer Personal Data in the locations described in Section 9 and Annex 1, which may be outside the country in which the Customer or Data Subjects are located.

Where Data Protection Laws require safeguards for a transfer of Customer Personal Data to another country, the parties will ensure that the transfer is made using a lawful transfer mechanism, which may include an adequacy decision, Standard Contractual Clauses or another mechanism recognized by the applicable law. Where the parties agree that a specific mechanism is required, it will be documented in writing.

On the Customer's reasonable written request, OptiRank Studio will provide information reasonably necessary to demonstrate its compliance with this DPA, such as written responses to security and privacy questionnaires and descriptions of its security measures.

Requests may be made no more than once in any twelve-month period, unless required by a supervisory authority or following a Security Incident affecting the Customer. Information provided is OptiRank Studio's Confidential Information, and requests must be reasonable in scope, must not compromise the security of the Service or other customers, and may be subject to reasonable costs where they require significant effort. This DPA does not grant access to OptiRank Studio's or its Subprocessors' physical facilities or systems.

On termination of the Agreement, or on the Customer's written request, OptiRank Studio will delete Customer Personal Data within a reasonable period, or, where the Customer requests it before deletion and it is technically feasible, provide Customer Personal Data available in the Service in a commonly used format. OptiRank Studio may retain Customer Personal Data where required by applicable law, in which case it will continue to protect that data under this DPA and process it only for the purposes of that legal requirement. Backup copies are deleted in the normal course of backup rotation.

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms of Service and the Agreement, to the extent permitted by applicable law. Nothing in this DPA limits any liability that cannot be limited under Data Protection Laws.

If there is a conflict between the documents that make up the Agreement, the following order applies:

1. this DPA, for matters relating to the processing of Customer Personal Data;
2. any applicable order or subscription terms; and
3. the Terms of Service.

This order of precedence is subject to any mandatory requirements of applicable law.

This DPA is governed by the laws of the United Arab Emirates, and disputes arising out of or in connection with it will be submitted to the courts of competent jurisdiction in the United Arab Emirates, in each case except where Data Protection Laws require that this DPA, or a transfer mechanism incorporated into it, be governed by the law of, or subject to the courts of, another jurisdiction.

Questions about this DPA can be sent to:

The following technical and organizational measures apply to the AuditOpti service at the date of this DPA.