Data processing agreement

This data processing agreement ("DPA") forms part of the terms of service between RankWitty and the client ("you"). It applies where RankWitty processes personal data on your behalf while providing the service, under the UK GDPR, the EU GDPR and similar laws.

1. Roles

For personal data contained in the material you give us to write about, such as names of staff or customers in your brand details or your own articles, you are the controller and RankWitty is the processor. For your own account and billing data, RankWitty is the controller, as described in the privacy policy.

2. What we process and why

• Subject matter: writing, editing, publishing and tracking articles for you.
• Duration: for as long as you use the service, plus the deletion period below.
• Types of data: names, job titles, business contact details and other details you include.
• Data subjects: your staff, customers or other people you mention in your material.

3. Our commitments

• We process personal data only on your documented instructions, which include these terms and your orders.
• People who handle the data are bound by confidentiality.
• We help you respond to requests from data subjects and with data protection impact assessments where needed.
• We make available the information needed to show we meet this DPA.

4. Security

• Encryption of data in transit.
• Access limited by role: each client can see only their own data, enforced in the database.
• Two-step verification for admin accounts.
• Private storage for uploaded files, available only through short-lived links.
• Logs written with passwords, tokens and keys removed.

5. Sub-processors

You authorise the sub-processors listed in the privacy policy, including Anthropic (article drafting), DataForSEO (keyword research and position checks), Resend (email), Telegram (internal notifications), Cryptomus (payments) and Sentry (error reports). We will tell you before adding or replacing a sub-processor, and you may object. Each sub-processor is bound by data protection terms at least as strict as these.

6. Personal data breaches

We will notify you without undue delay after becoming aware of a breach affecting personal data we process for you, with the information you need to meet your own obligations.

7. International transfers

Where personal data is transferred outside the UK or the European Economic Area, we use appropriate safeguards such as standard contractual clauses.

8. Deletion

When the service ends, we delete or return personal data processed for you, unless the law requires us to keep it. Articles already published on network pages are public; ask us if you need one changed or removed.

9. Contact

For anything about this DPA, contact us.