Data processing terms

This website (rankpilot.solutions) and the "rankpilot" service are operated by Detrix Digital (detrixdigital.com), legal entity: [full legal name and entity type of the contracting company, to be added by the owner]. In this document "we", "us" and "our" mean that company. "You" means the person or organisation using the website or buying our services.

Registered address: [registered business address, to be added by the owner]. General contact: [email, to be added by the owner].

These terms apply when we process personal data on your behalf while delivering services (for example when you give us access to analytics, Google Search Console, a customer database or a website that holds visitor data). They form part of our Terms of service. They do not apply to personal data we collect for our own purposes through this website; see our Privacy policy. Where the GDPR, UK GDPR, CCPA or APPI apply, these terms are intended to meet the contract requirements of GDPR/UK GDPR Article 28, of the CCPA (service-provider terms) and of the APPI for entrustment of personal data. [Owner: have these terms reviewed together with the Terms before signing the first client.]

1. Roles

For personal data we process on your behalf, you are the controller (or business, or personal information handling business operator) and we are the processor (or service provider, or entrustee). You decide the purposes and means of processing; we process only on your documented instructions.

2. Details of the processing

• Subject matter and purpose: performing the services in the Engagement Document, such as analysing website and search data and reporting on visibility.
• Duration: the term of the engagement, plus the time needed to return or delete data.
• Types of personal data: as little as possible. Typically aggregated analytics data, website visitor technical identifiers, and business contact details. We do not need, and ask you not to give us, sensitive data or data on children.
• Data subjects: your website visitors, customers and staff, to the extent their data is in the systems you give us access to.

3. Our obligations

1. Process personal data only on your documented instructions, including on transfers, unless the law requires otherwise, in which case we tell you first where lawful. The Engagement Documents and your use of the services are your instructions. We will tell you if we think an instruction breaks data protection law.
2. Ensure that people authorised to process the data are bound by confidentiality.
3. Apply appropriate technical and organisational measures to protect the data, including access control, encryption in transit, credential management, and limiting access to those who need it.
4. Assist you, taking into account the nature of the processing, in responding to requests from individuals to exercise their rights, and refer to you any such request we receive.
5. Assist you with security, breach notification, data protection impact assessments and prior consultation, as far as it relates to our processing.
6. Notify you without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting your data, with the information we have.
7. On ending the services, and at your choice, delete or return the personal data, and delete existing copies unless the law requires us to keep them. Backups are removed on their normal cycle.
8. Make available information needed to show compliance and allow for audits by you or your auditor on reasonable notice, no more than once a year unless there has been a breach, during business hours, under confidentiality, and at your cost. We may satisfy this by providing recent third-party certifications or written answers.
9. For the CCPA: we will not sell or share the personal information; retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes specified in the Engagement Document; or combine it with other personal information, except as the CCPA permits. We will tell you if we can no longer meet our CCPA obligations, and you may take reasonable steps to stop and remediate unauthorised use.
10. For the APPI: we handle entrusted personal data only within the scope of the entrustment, and take security control measures and supervise our own subcontractors to the standard the APPI requires.

4. Sub-processors

You give us general authorisation to use sub-processors. Our current sub-processors are the providers described in our Privacy policy: [owner to list each sub-processor, its role and its country, for example hosting, database, email, analytics and reporting tools]. We bind each of them to terms with equivalent data protection obligations, remain responsible for them, and will tell you of intended changes by email at least 14 days beforehand. You may object on reasonable data protection grounds within that period; if we cannot reasonably accommodate the objection, either of us may end the affected service.

5. International transfers

We may process data in countries other than yours. Where data protection law restricts a transfer, we will rely on an approved mechanism: for the EEA, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with Module 2 (controller to processor) and Module 3 (processor to processor) as applicable, which are incorporated by reference with the details in sections 2 and 4; for the UK, the UK Addendum or the International Data Transfer Agreement; and for Japan, the arrangements required by the APPI. A provider's certification under the EU-US Data Privacy Framework may be used where available.

6. Your responsibilities

You confirm that you have a lawful basis for giving us the data, that you have given any notices and obtained any consents the law requires, and that your instructions comply with law. You remain responsible for the accuracy and legality of the data and for your own compliance as controller.

7. Liability and order of precedence

The limits of liability in the Terms apply to these data processing terms, to the extent the law allows. Nothing here limits any liability that the law does not allow to be limited, or a data subject's rights. If these terms conflict with the Standard Contractual Clauses, the Clauses prevail for the transfer concerned. Otherwise these terms prevail over the rest of the Terms on data protection matters.

8. Contact

Data protection questions or notices: [privacy contact email, to be added by the owner].