SEO Guard — Data Processing Addendum
In short. When we access your site or CMS, we act as your processor for any personal data that happens to be there (for example, user accounts or order details visible in the CMS). We follow your instructions, keep the data confidential, apply the security measures in Annex II, and do not use it to train AI models. We will tell you of a personal-data breach within 48 hours of becoming aware of it. New subprocessors are announced at least 30 days in advance, and you may object. This Addendum includes the EU Standard Contractual Clauses (2021/914) and the UK IDTA Addendum as a fallback for transfers to countries that are not covered by an adequacy decision. Argentina has an EU adequacy decision. This Addendum forms part of the Terms of Service. See also the Privacy Policy for processing we do as a controller.
1. Purpose, parties and order of precedence
1.1 This Data Processing Addendum (the DPA) is an addendum to the SEO Guard Terms of Service (the Terms) between Nicolas Schmidt, a sole trader (monotributista) in Argentina, CUIT 20-32600187-3, fiscal domicile Córdoba 41, Villaguay, Entre Ríos, CP 3240, Argentina, trading as SEO Guard (the Provider), and the Customer that accepts the Terms (the Customer). Together they are the parties.
1.2 This DPA applies when the Provider processes Personal Data as a processor on behalf of the Customer, who acts as controller (or as a processor for a third-party controller, in which case the Provider is a subprocessor and clause 2.3 applies).
1.3 This DPA forms part of the Agreement as defined in the Terms. Capitalised terms that are not defined here have the meaning given in the Terms. Data Protection Law means, as applicable, Regulation (EU) 2016/679 (GDPR), the UK GDPR and the Data Protection Act 2018 (UK GDPR), Argentine Law 25.326 and its regulations, and any similar law that applies to the processing.
1.4 If there is a conflict on the processing of Personal Data, this DPA prevails over the Terms. The Standard Contractual Clauses or the UK Addendum, where they apply, prevail over this DPA on the international transfer they cover.
2. Roles and instructions
2.1 The parties acknowledge that:
(a) the Provider is a controller of business-contact, account, billing and prospect data, as described in the Privacy Policy — that processing is not subject to this DPA, except for international-transfer provisions that the Provider applies to its own suppliers;
(b) the Provider is a processor of Personal Data that is present on the Site or visible through the CMS or its API (for example, account names, email addresses, comments, or order information that appears in pages, media libraries, product records or CMS responses while the Provider crawls, diagnoses, monitors or applies Auto-Fixes). The Customer is the controller of that data (or a processor, as in clause 2.3).
2.2 The Provider will process Processor Personal Data only: (a) to provide the Service; (b) on the Customer's documented instructions, which are set out in the Agreement, the Customer's onboarding and written (including email) instructions; and (c) as required by law, in which case the Provider will tell the Customer before processing, unless the law prohibits that notice.
2.3 If the Customer is itself a processor (for example, an agency whose client owns the Site), the Customer warrants that its controller has authorised this DPA, including the appointment of the Provider and the subprocessors in Annex III. The Customer is responsible for forwarding notices and for the lawfulness of the instructions it gives.
2.4 The Provider will inform the Customer without undue delay if, in its opinion, an instruction infringes Data Protection Law. The Provider is not obliged to provide legal advice. It may suspend the affected processing until the instruction is confirmed, withdrawn or modified.
2.5 Processor Personal Data means the Personal Data described in Annex I.B.
3. Details of the processing
The subject matter, duration, nature, purpose, types of Personal Data and categories of data subjects are set out in Annex I.B. The duration is the term of the Agreement plus the deletion or return period in clause 10.
4. Confidentiality
The Provider will ensure that anyone it authorises to process Processor Personal Data (including personnel and subprocessors) is bound by a confidentiality duty, by contract or by law, that survives the end of their engagement, and that they process the data only as needed to perform the Agreement.
5. Security
5.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks to individuals, the Provider will implement the appropriate technical and organisational measures in Annex II (the TOMs), including the measures required by Article 32 GDPR and the equivalent UK GDPR provision, to ensure a level of security appropriate to the risk.
5.2 The Customer is responsible for the security of the Site itself, of the CMS, and of the credentials it issues, and for deciding whether the TOMs are appropriate for the data that may be present on the Site.
5.3 The Provider will not use Processor Personal Data, Reports that still identify the Customer or an individual, or Site content, to train AI models, whether its own or a third party's. Diagnosis prompts sent to an AI model provider are limited to compact technical audit metadata, as described in Annex II, and are subject to a no-training instruction.
6. Subprocessors
6.1 The Customer gives a general authorisation to the Provider to engage the subprocessors listed in Annex III, and to engage further subprocessors under this clause 6.
6.2 The Provider will enter into a written agreement with each subprocessor that imposes data-protection obligations no less protective than this DPA, including security, confidentiality, deletion, and assistance with data-subject rights and breaches, and, where required, the Standard Contractual Clauses or the UK Addendum. The Provider remains responsible to the Customer for each subprocessor's performance.
6.3 The Provider will give the Customer at least thirty (30) days' prior notice of the addition or replacement of a subprocessor, by email and by updating Annex III or a subprocessor list linked from https://seoguardhq.com. The notice will identify the subprocessor, its location and its role.
6.4 The Customer may object to a new or replacement subprocessor on reasonable data-protection grounds, by notice within fifteen (15) days of the Provider's notice. The parties will then discuss a workaround in good faith (for example, not using that subprocessor for that Customer). If no workaround is reasonably available before the change takes effect, the Customer may terminate the affected Service by notice, and the Service will continue only until the end of the current Paid Period, without additional Fees. That termination is the Customer's exclusive remedy for an objection that cannot be resolved.
6.5 A change that is forced by a subprocessor's corporate reorganisation under the same parent, with no material change in the processing or location, may be notified as soon as practicable rather than thirty days in advance.
7. Assistance with data-subject rights and compliance
7.1 Taking into account the nature of the processing, the Provider will assist the Customer, by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects to exercise their rights under Data Protection Law (access, rectification, erasure, restriction, objection, portability, and the right not to be subject to a solely automated decision).
7.2 If the Provider receives a request that is clearly directed at Processor Personal Data, it will not respond itself except to tell the person to contact the Customer, and will forward the request to the Customer without undue delay.
7.3 The Provider will assist the Customer, taking into account the nature of the processing and the information available to the Provider, with data-protection impact assessments, prior consultations with supervisory authorities, and the Customer's Article 32 security obligations, in each case solely in relation to the Provider's processing. Reasonable requests that go beyond the ordinary Service may be charged at a rate agreed in advance.
8. Personal Data breaches
8.1 The Provider will notify the Customer of a Personal Data breach affecting Processor Personal Data without undue delay and in any event within forty-eight (48) hours of becoming aware of it, by email to the Customer's notice address. That commitment is stricter than, and in any event no later than, the seventy-two (72) hour outer timeframe often used for controller notifications to a supervisory authority.
8.2 The notice will, to the extent then known, describe: (a) the nature of the breach, including the categories and approximate number of data subjects and of records concerned; (b) the likely consequences; (c) the measures taken or proposed to address the breach and mitigate its effects; (d) the point of contact at the Provider (by default, [email protected]). The Provider will update the Customer as further information becomes available.
8.3 The Provider will take reasonable steps to contain, investigate and remediate the breach, and will cooperate with the Customer's lawful notifications to authorities and to data subjects. The Provider will not notify a supervisory authority or data subjects on the Customer's behalf unless the Customer asks it to, or the law requires the Provider to do so.
9. International transfers
9.1 The Provider is established in Argentina. The European Commission has recognised Argentina as providing an adequate level of protection for Personal Data (Commission Decision 2003/490/EC, as it continues in force). The United Kingdom likewise treats Argentina as adequate. Transfers of Personal Data from the EEA or the United Kingdom to the Provider in Argentina may therefore take place on the basis of that adequacy, without additional transfer tools as between the Customer and the Provider.
9.2 Some subprocessors are in countries that may not benefit from an adequacy decision. For those transfers, the parties incorporate the following, which apply automatically when a transfer requires a safeguard under Data Protection Law:
(a) the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the SCCs), including:
- Module 2 (controller to processor), where the Customer is a controller in the EEA (or otherwise subject to the GDPR) and the Provider or a subprocessor is the data importer;
- Module 3 (processor to processor), where the Customer is a processor and transfers to the Provider, or where the Provider transfers to a subprocessor;
(b) the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner and in force from 21 March 2022, as it may be revised (the UK Addendum), for transfers subject to the UK GDPR.
9.3 For the SCCs: optional docking clause 7 is incorporated; in clause 9 of Modules 2 and 3, Option 2 (general written authorisation) applies, with the notice period in clause 6.3 of this DPA; in clause 11, the optional complaint process is not used; in clause 17, Option 1, the governing law is the law of Ireland; in clause 18, the courts are the courts of Ireland. Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA. The competent supervisory authority for clause 13 is determined as in Annex I.C.
9.4 For the UK Addendum: Table 1 is completed with the parties in Annex I.A; Table 2 selects the SCCs as described in this clause 9, including the modules and options above; Table 3 is completed by Annexes I, II and III of this DPA; Table 4, "Ending the Addendum when the Approved Addendum changes", is completed so that neither party may terminate the UK Addendum solely because the Information Commissioner issues a new version, unless that new version requires it. The Alternative Part 2 Mandatory Clauses are not used. The Addendum is governed by the laws of England and Wales, and the courts of England and Wales have jurisdiction, as the UK Addendum provides.
9.5 If a transfer tool is declared invalid or insufficient, the parties will in good faith adopt a replacement safeguard so that the processing can continue lawfully. The Provider may suspend the affected transfer until that is done.
9.6 For transfers from Argentina to other countries, the Provider uses the safeguards required by Law 25.326 and AAIP Disposition 60-E/2016 (or any successor), including model clauses or adequacy, as applicable.
10. Deletion or return
10.1 When the Agreement ends, or earlier if the Customer so instructs in writing and it is feasible without undermining the Service still to be performed, the Provider will, at the Customer's choice, delete or return Processor Personal Data, and delete existing copies, within thirty (30) days.
10.2 If the Customer does not make a choice within fifteen (15) days after the Agreement ends, the Provider will delete the Processor Personal Data within the remainder of the thirty-day period.
10.3 The Provider may retain copies to the extent and for the period that applicable law requires (for example, tax or accounting records, or a suppression record needed to honour an opt-out). Any retained data remains subject to this DPA's confidentiality and security duties, and will be isolated from active use.
10.4 Deletion includes instructing subprocessors to delete the same data, and includes backups within a reasonable backup-rotation cycle not exceeding a further thirty (30) days, except for backups that are infeasible to edit individually, which will expire in the ordinary cycle and will not be restored except as required by law.
11. Audits
11.1 The Provider will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA and with Article 28 GDPR (and the equivalent UK GDPR provision).
11.2 In the first instance, that information will be documentation: a description of the TOMs, the then-current subprocessor list, relevant certifications or third-party audit summaries if the Provider holds them, and written answers to reasonable security questionnaires, not more than once in any twelve-month period unless a Personal Data breach or a genuine, documented suspicion of material non-compliance reasonably requires another.
11.3 If the Customer, acting reasonably, considers that the documentation is not sufficient to demonstrate compliance, the Customer may conduct an on-site or remote audit, itself or through an independent auditor bound by confidentiality, during Business Days, on at least thirty (30) days' written notice (or less if a supervisory authority or a Personal Data breach reasonably requires it), in a way that does not unreasonably disrupt the Provider's operations or jeopardise other customers' security or Confidential Information. The Customer bears its own costs and the Provider's reasonable costs of an on-site audit, unless the audit reveals a material breach of this DPA by the Provider, in which case the Provider bears those reasonable costs.
11.4 The Provider may object to an auditor that is a competitor or is not reasonably independent or qualified. The parties will then agree an alternative auditor.
11.5 A supervisory authority with a legal right to audit the processing may do so in accordance with Data Protection Law. The Provider will cooperate with that audit in relation to Processor Personal Data.
12. Liability
Liability arising under this DPA is subject to the limitations and exclusions in the Terms, without prejudice to any mandatory liability under Data Protection Law that cannot be limited as between a party and a data subject or a supervisory authority. Nothing in this DPA limits a party's obligations to data subjects under the SCCs or the UK Addendum where those instruments apply.
13. Term, changes and general
13.1 This DPA takes effect on the date the Agreement takes effect and lasts until the Provider has deleted or returned Processor Personal Data in accordance with clause 10.
13.2 Changes to this DPA follow clause 21 of the Terms. A change required by Data Protection Law or by a supervisory authority may take effect on the notice needed to comply.
13.3 Clauses 4, 8, 10, 11, 12 and 13, and any duty that by its nature should survive, survive termination until they have been fulfilled.
13.4 The governing law, dispute-resolution, language, notice and general clauses of the Terms apply to this DPA, except where the SCCs or the UK Addendum require otherwise for a transfer they cover.
Annex I — Parties and description of the processing
A. List of parties
Data exporter (Customer)
- Name, address and contact: as stated in the order, invoice, onboarding record or acceptance record.
- Role: controller, or processor as described in clause 2.3.
- Activities: operating the Site and commissioning the Service.
- Signature and date: the Customer's acceptance of the Agreement under clause 27 of the Terms constitutes signature of this DPA and, where applicable, of the SCCs and the UK Addendum.
Data importer (Provider)
- Name: Nicolas Schmidt, trading as SEO Guard.
- Address: Córdoba 41, Villaguay, Entre Ríos, CP 3240, Argentina.
- CUIT: 20-32600187-3.
- Contact: [email protected].
- Role: processor (or subprocessor, where clause 2.3 applies).
- Activities: providing the Service described in the Terms.
- Signature and date: the Provider's publication of this DPA and its entry into the Agreement with the Customer constitute signature.
B. Description of the transfer and of the processing
| Item | Description |
|---|---|
| Subject matter | Processing of Personal Data that is present on the Site or visible through the CMS or its API, as a necessary incident of delivering the Service. |
| Duration | The term of the Agreement, plus the deletion or return period in clause 10. |
| Nature | Collection (by crawling publicly available pages of the Site and by reading CMS or API responses), organisation, storage, consultation, use for diagnosis, limited alteration through Auto-Fixes, disclosure to authorised subprocessors, and deletion or return. There is no profiling of end users, and no decision-making about a data subject with legal or similarly significant effects. |
| Purpose | To perform the Service: technical SEO audit, monitoring, Reports, uptime alerts, and Auto-Fixes the Customer has authorised. |
| Categories of data subjects | Individuals whose Personal Data appears on the Site or in the CMS, which may include the Customer's staff, customers, prospects, commenters, account holders and other visitors. The Provider does not seek special-category or children's data, but such data might appear incidentally if the Customer has placed it on the Site. |
| Categories of Personal Data | Data that appears in crawled pages, media metadata, product or content records, and CMS API responses. This may include names, email addresses, usernames, profile or comment text, order or address information visible in those systems, URLs, and similar content the Customer has stored. It does not include payment-card data: the Provider does not request and does not need access to the Customer's payment-card environment. Credentials the Customer grants to the Provider (API tokens, application passwords) are processed as confidential security data, not as a category to be analysed. |
| Special categories | Not intended. If they appear incidentally, they are processed only as part of the same technical operations and are not used for any other purpose. |
| Frequency | Continuous or periodic during the term, aligned with weekly crawls, monitoring checks, monthly Reports and Auto-Fix runs. |
| Retention | As in clause 10. Audit files, backups of Auto-Fix data and Reports are kept for the term and then deleted or returned. The Customer holds its own copy of Reports under the licence in the Terms. |
| Transfers to subprocessors | As in Annex III, for the purposes stated there. |
C. Competent supervisory authority
For the SCCs, the competent supervisory authority is: (a) the supervisory authority of the EU Member State in which the data exporter is established; or (b) if the exporter is not established in the EEA, the supervisory authority of the Member State in which the exporter's representative under Article 27 GDPR is established; or (c) if (a) and (b) do not apply, the supervisory authority of the Member State where the data subjects whose data is transferred are predominantly located. If that cannot be determined, the Irish Data Protection Commission is designated as the default for this clause.
Annex II — Technical and organisational measures (TOMs)
The Provider implements the following measures, which it may update provided the overall level of protection is not materially reduced (a material reduction is a change under clause 21 of the Terms).
1. Encryption in transit. All access to the Platform, to the Provider's website, and to CMS or API endpoints the Provider calls, uses TLS/HTTPS. Email is transmitted using TLS where the receiving server supports it.
2. Least-privilege API tokens. The Provider asks only for the CMS and API permissions reasonably required for the Service (as described in the Terms). Tokens are used solely to perform the Agreement. The Customer may revoke them at any time.
3. Protected secret storage. Production secrets for the Provider's own infrastructure (for example, Cloudflare Worker secrets and deployment tokens) are stored in encrypted secret stores. CMS tokens and similar Customer credentials are stored in an access-restricted environment, available only to the systems and authorised personnel that perform the Service, and are not committed to public source-control repositories. The Provider will encrypt those Customer credentials at rest.
4. Access control and logging. Access to Customer credentials, audit stores and Reports is limited to the Provider and personnel or subprocessors who need it. Access to production systems is logged. Personnel are bound by confidentiality.
5. No AI training on Customer data. Processor Personal Data, identifiable Reports and Site content are not used to train AI models. Where an AI model provider (currently xAI, Inc., for diagnosis in plain language) is used, the Provider sends only compact technical audit metadata (a limited set of fields such as issue types, capped URL lists and short technical summaries), not CMS credentials, not payment data, and not a full dump of Site content, and instructs the provider not to use the input to train models.
6. Auto-Fix safety. Before an Auto-Fix is applied, the data about to be changed is backed up. The change is verified (successful HTTP response) and rolled back if verification fails. The Customer may require preview-only mode, as described in the Terms.
7. Network and platform security. The public website is served over HTTPS with security headers. Inbound forms use abuse-prevention measures (including honeypot, minimum fill time, and rate limiting on a one-way hash of the IP address, kept for a short period). The Provider applies least-privilege access to cloud accounts.
8. Separation. Each Customer's credentials, audit files and Reports are stored against that Customer's Site identifier and are not used to perform the Service for another customer.
9. Availability and resilience. Uptime monitoring of Customer Sites and of the Platform, backups of Auto-Fix data, and the availability target and support process in the SLA.
10. Personnel and devices. Personnel who can access Processor Personal Data use reasonably secured devices and unique credentials. There is no large-scale operations team: access is confined to the people who run the Service.
11. Incident response. The Provider maintains a process to detect, contain, investigate and notify Personal Data breaches within the timeframe in clause 8.
12. Deletion. Credentials are revoked or deleted at the end of the Agreement. Processor Personal Data is deleted or returned under clause 10.
13. International transfers. Transfers are made on the bases in clause 9, including adequacy for Argentina and the SCCs / UK Addendum for subprocessors that require them.
Annex III — Authorised subprocessors
The Customer authorises the following subprocessors. Locations indicate the subprocessor's principal establishment and the usual processing location; a provider may also process in other regions as described in its own terms.
| Subprocessor | Country | Role | Personal Data typically involved |
|---|---|---|---|
| Cloudflare, Inc. | United States | Hosting, CDN, security, Cloudflare Pages and Workers, email routing, and storage of inbound form submissions and unsubscribe records in Workers KV | IP addresses and request logs (as determined by Cloudflare's standard logging), form and unsubscribe data, email-routing metadata |
| Sendinblue SAS (Brevo) | France (EU) | Sending transactional and B2B service or outreach emails | Recipient email address, name if provided, message content and delivery status; engagement data if the sending API records it |
| Google LLC (PageSpeed Insights API) | United States | Laboratory and field performance measurement of public URLs of the Site | Public URLs of the Site, and any Personal Data those public URLs themselves expose |
| xAI, Inc. (AI model provider, Grok models) | United States | Plain-language diagnosis of audit findings | Compact technical audit metadata only, as in Annex II.5 |
| Google LLC / Google Ireland Limited (Gmail) | United States / Ireland | Mailbox that receives mail forwarded from [email protected] (Cloudflare Email Routing) | The content of emails the Customer or a data subject sends to the Provider |
| Telegram Messenger Inc. / Telegram FZ-LLC | Optional, only if the Customer opts in to Telegram alerts | Delivery of operational or uptime alerts the Customer has requested | Alert content (typically Site domain and uptime status) and the chat identifier the Customer provides |
Wise Payments Limited and its affiliates (Wise) process the Customer's billing and payment data as a payment-service provider. The Provider is the controller of that billing data, so Wise is not a subprocessor under this DPA. Wise is listed in the Privacy Policy.
The Provider may also disclose data if required by law, a court or a competent authority, under clause 11.3 of the Terms.
Nicolas Schmidt, trading as SEO Guard CUIT 20-32600187-3 Córdoba 41, Villaguay, Entre Ríos, CP 3240, Argentina [email protected] · https://seoguardhq.com