Data processing agreement

Sometimes we process personal data on your behalf, for example if you put names of employees or clients in questions, or as an agency enter data of your clients. You are then the controller and we are the processor. This agreement forms part of the terms and conditions and applies automatically as soon as you have an account.

1. What we process and why

Only the data you put in your account (company details, websites, questions, competitors, possibly an agency name and logo) and the measurement results that come from it. We process it only to provide the service as described in the terms and conditions, and follow your instructions. You make sure you are allowed to give us this data.

2. Confidentiality and security

Only those who need it for the service have access, under a duty of confidentiality. We take appropriate measures: encrypted connections, encrypted passwords, access restrictions, limits against misuse, regular backups and server updates.

3. Sub-processors

You consent to the parties listed in the privacy policy: hosting and email, Stripe and the AI providers OpenAI, Google, Anthropic and Perplexity. Agreements with them offer at least the same protection. If a new party is added, we will let you know at least 30 days in advance. You can then object or cancel.

4. Transfers outside the EU

Some sub-processors are based in the US. For those transfers, the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses apply.

5. Data breaches

In case of a data breach affecting your data, we inform you without undue delay and no later than 48 hours after discovering it, with all the information you need for any notification.

6. Help with requests and audits

We help you with requests from data subjects (such as access or deletion) and give you the information you need to demonstrate that the processing is correct. An audit is carried out in consultation and at your own expense, at most once a year.

7. End

If you delete your account, we erase the data from the active systems immediately; it may remain in backups for up to 30 days. If only your subscription ends, we delete the measurement results after 90 days. This does not apply to data we are legally required to keep longer. If you want your data first, use "Download my data" under Account or email hello@hellogeolabs.com.