Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between OctaneAudit, a service operated by Nguyen Van Bao, an individual, at Tri Thuy 2, Ninh Hai, Ninh Hoa Town, Khanh Hoa 652900, Vietnam ("OctaneAudit", "Processor") and the customer identified in the applicable order ("Customer", "Controller"). It applies to the extent OctaneAudit processes Personal Data on behalf of Customer in the course of providing the Services, where that processing is subject to the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, or other data protection laws that distinguish controllers from processors ("Data Protection Laws").

This DPA is incorporated automatically into the agreement between the parties when Customer orders the Services. No signature is required. Customers who need a countersigned copy for their records may request one at [email protected].

1. Definitions

"Personal Data", "Data Subject", "Processing", "Controller", "Processor", "Supervisory Authority" and "Personal Data Breach" have the meanings given in Data Protection Laws.

"Customer Data" means Personal Data that OctaneAudit processes on behalf of Customer in providing the Services, including Personal Data contained on websites Customer asks OctaneAudit to audit or monitor.

"Sub-processor" means a third party engaged by OctaneAudit to process Customer Data.

"Services" means the audit and monitoring services described in the Terms of Service and the applicable order.

2. Roles and scope of processing

Customer is the Controller and OctaneAudit is the Processor of Customer Data. For Personal Data that OctaneAudit collects for its own purposes (such as Customer's account details, billing records and usage analytics), OctaneAudit is an independent Controller and the Privacy Policy applies.

Subject matter and duration. Processing of Customer Data for the purpose of delivering technical SEO audits and website monitoring, for the duration of the agreement and the retention periods in Section 9.

Nature and purpose. Crawling publicly accessible pages of the websites designated by Customer; collecting technical, performance and content data from those pages; analysing that data; generating reports and alerts; storing reports for Customer's access.

Categories of Data Subjects. Customer's employees, contractors and end users whose Personal Data appears on the designated websites, and Customer personnel who use the dashboard.

Categories of Personal Data. Names, job titles, email addresses, images and other Personal Data that Customer has published on the designated websites; names and email addresses of Customer's dashboard users; alert recipient email addresses. OctaneAudit does not intentionally collect special categories of data and Customer must not designate websites where such data is publicly accessible without appropriate safeguards.

3. Customer instructions

OctaneAudit will process Customer Data only on documented instructions from Customer, including with regard to international transfers, unless required to do otherwise by applicable law, in which case OctaneAudit will inform Customer before processing (unless the law prohibits such notice). The Terms of Service, this DPA, Customer's configuration in the dashboard and Customer's orders constitute Customer's complete instructions. OctaneAudit will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

Customer warrants that it has the right to designate each website for processing and has provided any notices and obtained any consents required under Data Protection Laws for OctaneAudit to process the Personal Data on those websites.

4. Confidentiality

OctaneAudit ensures that personnel authorized to process Customer Data are bound by confidentiality obligations and receive appropriate data protection training. Access is limited to personnel who need it to deliver the Services.

5. Security measures

OctaneAudit implements and maintains appropriate technical and organizational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, including:

• encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256 for databases, backups and report storage);
• role-based access control with least privilege, unique credentials and mandatory two-factor authentication for staff systems;
• network segmentation, firewalling, rate limiting and DDoS protection;
• logging and monitoring of access to production systems;
• automated dependency and vulnerability scanning with timely patching;
• daily encrypted backups with periodic restore testing;
• secure software development practices including code review;
• an incident response process with defined roles and escalation.

OctaneAudit may update these measures provided the overall level of protection is not reduced. A current description is available on request.

6. Sub-processors

Customer provides general authorization for OctaneAudit to engage the Sub-processors listed below. OctaneAudit will impose data protection obligations on each Sub-processor that are no less protective than this DPA and remains liable for their performance.

OctaneAudit will give Customer at least 14 days' notice of any new Sub-processor by updating this page and, for customers who have subscribed to notices, by email. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees.

7. International transfers

Where Customer Data originating in the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties rely on the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914, Module Two: controller to processor), which are incorporated by reference, together with the UK International Data Transfer Addendum and the Swiss amendments where applicable. For the purposes of the Clauses: Customer is the data exporter; OctaneAudit is the data importer; Clause 7 (docking) applies; Option 2 of Clause 9 applies with the notice period in Section 6; Clause 11 optional language does not apply; Clause 17 governing law is Ireland; Clause 18 forum is the courts of Ireland; and Annexes I and II are completed by Sections 2, 5 and 6 of this DPA.

8. Assistance to Customer

Taking into account the nature of the processing, OctaneAudit will assist Customer, by appropriate technical and organizational measures and insofar as possible, in fulfilling Customer's obligations to respond to Data Subject requests. If OctaneAudit receives a request directly from a Data Subject relating to Customer Data, it will redirect the Data Subject to Customer without responding substantively, unless legally required.

OctaneAudit will also assist Customer in ensuring compliance with obligations relating to security, breach notification, data protection impact assessments and prior consultation with Supervisory Authorities, taking into account the information available to OctaneAudit. Assistance beyond what is reasonably included in the Services may be charged at OctaneAudit's then-current rates.

9. Return and deletion

Audit reports and crawl data are retained for 24 months after delivery so Customer can re-download them, unless Customer requests earlier deletion. Monitoring check results are retained for 12 months on a rolling basis. Upon termination of the agreement, or at Customer's written request at any time, OctaneAudit will delete Customer Data within 30 days, except where retention is required by law. Backups containing Customer Data are overwritten on a rolling 30-day cycle. Customer may export reports from the dashboard at any time before deletion.

10. Personal Data Breach notification

OctaneAudit will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Data. The notification will describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. OctaneAudit will provide further information as it becomes available and cooperate with Customer's reasonable investigation and notification obligations.

11. Audits and information

OctaneAudit will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party security assessments where available. Customer may conduct an audit, or appoint an independent auditor bound by confidentiality, no more than once per year (or more often if required by a Supervisory Authority or following a Personal Data Breach), on at least 30 days' written notice, during normal business hours, in a manner that does not unreasonably disrupt OctaneAudit's operations. Customer bears the cost of audits unless they reveal a material breach of this DPA.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except where Data Protection Laws prohibit such limitation. Nothing in this DPA limits the rights of Data Subjects under the Standard Contractual Clauses.

13. Term and precedence

This DPA takes effect when Customer accepts the Terms of Service or places an order, and remains in force for as long as OctaneAudit processes Customer Data. In case of conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms of Service with respect to the processing of Customer Data. OctaneAudit may update this DPA to reflect changes in law or the Services; material changes will be notified in accordance with the Terms.

14. Contact

Data protection enquiries: [email protected] Legal: [email protected] OctaneAudit, operated by Nguyen Van Bao, Tri Thuy 2, Ninh Hai, Ninh Hoa Town, Khanh Hoa 652900, Vietnam