Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between the customer (“Controller” or “you”) and Tech Innovation Hub LLC (the “Processor”, “we”, or “us”) for the use of the SearchVoro platform and website (the “Service”). It governs our processing of personal data on your behalf and reflects the requirements of Article 28 of the EU General Data Protection Regulation (“GDPR”) and the equivalent provisions of the UK GDPR. Where this DPA conflicts with the Terms of Service on the subject of data protection, this DPA controls.

1. Definitions

“Personal data”, “processing”, “controller”, “processor”, “data subject”, and “supervisory authority” have the meanings given in the GDPR. “Customer personal data” means personal data contained in the data you submit to, or that is generated for you by, the Service and that we process on your behalf. “Subprocessor” means a third party engaged by us to process customer personal data.

2. Roles of the parties

For customer personal data, you act as the controller (or as a processor acting on behalf of your own controller) and we act as your processor. Each party will comply with its obligations under applicable data protection law. You are responsible for the lawfulness of the data you provide and the instructions you give, including having a valid legal basis and the authority to connect and modify any property or CMS you link to the Service.

3. Scope and instructions

We process customer personal data only on your documented instructions, including with regard to international transfers, unless required to do otherwise by applicable law (in which case we will inform you before processing, unless the law prohibits it). Your instructions are set out in this DPA, the Terms of Service, and your configuration and use of the Service. We will promptly inform you if, in our opinion, an instruction infringes applicable data protection law.

4. Confidentiality

We ensure that personnel authorized to process customer personal data are bound by appropriate confidentiality obligations and are trained on their responsibilities. Access is granted on a least-privilege, need-to-know basis and is logged.

5. Security measures

We implement and maintain appropriate technical and organizational measures to protect customer personal data, taking into account the state of the art and the risks of processing. These measures include encryption of integration credentials at rest, TLS in transit, tenant isolation that fails closed, role-based least-privilege access, audit logging, and reversible, approval-gated changes to connected systems. A current description is maintained on our Security & Trust page, which forms Annex 2 to this DPA.

6. Subprocessors

You provide general authorization for us to engage subprocessors to process customer personal data. Our current subprocessors, the processing they perform, and their locations are listed on our Subprocessors page, which forms Annex 3 to this DPA. We impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and we remain responsible for their performance. We will give you reasonable prior notice of the addition or replacement of a subprocessor and provide a mechanism to object on reasonable data-protection grounds; if we cannot reasonably accommodate an objection, you may terminate the affected Service.

7. International transfers

Where processing of customer personal data involves a transfer from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the transfer is made subject to appropriate safeguards, including the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), which are incorporated into this DPA by reference and completed with the details in the Annexes. The controlling origin region for hosting is disclosed in the Subprocessors register.

8. Assistance to the controller

Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as possible, in fulfilling your obligation to respond to requests from data subjects exercising their rights, and in ensuring compliance with your obligations regarding security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities. If we receive a request directly from a data subject relating to customer personal data, we will not respond except on your instructions or as required by law, and will promptly forward the request to you.

9. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting customer personal data, and will provide information reasonably available to us to help you meet your own notification obligations. We will take reasonable steps to mitigate the effects of, and to minimize any damage resulting from, the breach.

10. Deletion and return

On termination of the Service, and at your choice, we will delete or return customer personal data and delete existing copies, unless applicable law requires continued storage. Deletion follows the retention and export process described in our Privacy Policy. Routine backups are deleted on their normal cycle.

11. Audits and information

We will make available to you information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. To protect the security of other customers, audits are conducted on reasonable prior notice, no more than once per year absent a regulatory requirement or a confirmed breach, subject to confidentiality, and may be satisfied through documentation, questionnaires, and any third-party assessments we make available.

12. Duration

This DPA takes effect when you accept the Terms of Service or begin using the Service and remains in effect for as long as we process customer personal data on your behalf.

Annex 1 — Details of processing

Subject matter: provision of the SearchVoro SEO and AI-visibility platform. Duration: the term of the agreement plus any legally required retention. Nature and purpose: auditing connected web properties, tracking rankings and AI citations, generating content and recommendations, and applying approved changes to connected systems. Types of personal data: account and contact details of your authorized users; and any personal data incidentally contained in the web content, analytics, and connected-system data you submit or connect. Categories of data subjects: your authorized users and individuals whose personal data may appear in the properties and data you connect. We do not intend the Service to process special categories of personal data; you should not submit them.

Annex 2 — Security measures

The technical and organizational measures described on our Security & Trust page.

Annex 3 — Subprocessors

The subprocessors listed on our Subprocessors page.

Contact

To request a countersigned copy of this DPA, raise a data-protection question, or object to a subprocessor, contact [email protected]. Tech Innovation Hub LLC is a Wyoming limited liability company with its business headquarters in Houston, Texas, United States.