Data Processing Addendum

Version 2026-10-19 draft · The legal documents are published in English. The English version governs.

Draft. This document is being reviewed by counsel and is not yet in force. The product has not launched.

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Fikrtna Technology ("Processor") and the Customer ("Controller") and applies to personal data the Processor processes on the Controller's behalf in providing FIKRTNA SEO.

1. Subject matter and duration

Processing of personal data contained in the Controller's connected data sources, crawled sites, outreach contacts and replies, for the duration of the subscription and the 30-day deletion period after it.

2. Nature and purpose

Collection, storage, analysis and display of search-performance data; application of changes the Controller approves; sending of outreach messages the Controller approves; measurement and reporting. No other purpose.

3. Categories of data and data subjects

Search query, page and device statistics (which may contain personal data in query strings or URLs); names and business contact details of people at other organisations entered for outreach, and their replies; names and email addresses of the Controller's own members. Data subjects: the Controller's members, visitors to the Controller's sites as reflected in aggregate statistics, and outreach contacts.

4. Processor obligations

• Process only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's use of the product's controls.
• Ensure people authorised to process the data are bound by confidentiality.
• Implement the technical and organisational measures in Annex 1.
• Engage sub-processors only as set out in section 5.
• Assist the Controller with data-subject requests and with its security, breach-notification and impact-assessment obligations, by the product's export, audit and deletion functions and on request.
• Delete or return the data at the end of the service, by purging the organisation 30 days after the deletion request, except where law requires retention.
• Make available the information needed to demonstrate compliance and allow audits, which may be satisfied by the security overview and any third-party reports we hold.
• Notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting its data.

5. Sub-processors

The Controller authorises the sub-processors listed on the sub-processors page. The Processor gives 30 days' notice of any addition or replacement by updating that page and emailing the organisation's owners; the Controller may object on reasonable grounds within that period, and may terminate if the objection cannot be resolved.

6. International transfers

Data is held in the region shown in the Privacy Policy. Where a sub-processor is outside that region, the transfer is covered by standard contractual clauses or an equivalent safeguard, which the Processor will provide on request.

7. Controller obligations

The Controller warrants that it has the right to connect the data sources and sites it connects, that outreach contacts it enters are people whose contact details are published for that purpose or who otherwise may lawfully be contacted, and that its instructions comply with applicable law.

8. Liability

Liability under this DPA is subject to the limits in the Terms of Service.

Annex 1: Technical and organisational measures

• Tenant isolation enforced in the database by row-level security on every tenant table, applied to the table owner as well, with a continuous test suite.
• Credentials encrypted with a key per organisation, bound to that organisation, with every decryption audited.
• Read-only access to Google data through a separate grant; writes to sites only through the Controller's own connections and only after approval.
• A hash-chained, append-only audit log of every action, exportable by the Controller.
• Two-factor authentication required for owners; passkeys supported; session and key revocation.
• Encrypted transport; encryption at rest and a managed key service at the hosting layer; backups to two repositories with a tested restore.
• Deletion by crypto-shredding of the organisation's keys and purging of its data 30 days after request.

Items that depend on production hosting are marked as pending on the security overview until the Service launches.