Data processing agreement
This agreement forms part of the Get Ranking terms of service between the customer (the controller) and Get Versed Training Ltd (the processor). It applies when we process personal data on the customer's behalf, as required by Article 28 of the UK GDPR.
1. Details of the processing
| Item | Detail |
|---|---|
| Subject matter | Providing Get Ranking: storing, analysing and scoring content, AI writing, review links and publishing to connected websites |
| Duration | For as long as the customer has a Get Ranking account, plus the deletion period in clause 9 |
| Nature and purpose | Hosting, analysis, AI processing, emailing and transfer to connected services, only to provide the service |
| Personal data | Names and contact details of the customer's team members and reviewers; any personal data the customer includes in content, comments or briefs |
| Data subjects | The customer's staff, its clients and their staff, reviewers, and people mentioned in content |
| Special category data | Not intended. The customer will not upload special category or criminal offence data unless agreed in writing |
2. Our obligations as processor
We will:
- process personal data only on the customer's documented instructions, which are these terms and the customer's use of the service, unless the law requires otherwise (we will tell the customer first unless that is prohibited);
- make sure everyone who processes the data is bound by confidentiality;
- keep appropriate technical and organisational security measures in place (clause 5);
- only use sub-processors under clause 6;
- help the customer respond to data subject requests, as far as reasonably possible;
- help the customer with security, breach notification, impact assessments and consultation with the ICO, taking into account the information available to us;
- delete or return personal data at the end of the service (clause 9);
- make available the information needed to show we comply with this agreement, and allow audits under clause 8.
3. The customer's obligations
The customer is responsible for having a lawful basis for the personal data it uploads, for giving any required privacy information to the people concerned, and for the accuracy of its instructions.
4. Personal data breaches
We will tell the customer without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting the customer's data. We will give the information we have and update it as we learn more.
5. Security measures
- Data encrypted in transit (TLS) and hosted in London on DigitalOcean's managed infrastructure
- Database accepts connections only from the Get Ranking application
- Passwords for connected services encrypted at rest (AES-256-GCM)
- Sign-in by single-use email link; no user passwords stored
- Each workspace's data is separated, and every request is checked against the signed-in user's workspace
- Access to production systems limited to authorised staff
- Daily database backups kept by the hosting provider for seven days
6. Sub-processors
The customer gives general authorisation for the sub-processors below. We will give at least 30 days' notice by email before adding or replacing one, and the customer may object on reasonable data protection grounds. If we cannot resolve the objection, the customer may end the agreement and receive a pro rata refund of prepaid fees.
| Sub-processor | Purpose | Location |
|---|---|---|
| DigitalOcean, LLC | Hosting and database | London, UK |
| Anthropic, PBC | AI processing when the customer uses AI features | United States |
| Resend | Transactional email | Ireland (EU) |
| Stripe Payments Europe, Ltd | Payments and invoicing | Ireland and United States |
| DataForSEO OÜ | Search results and keyword data (keywords and website addresses only) | Estonia (EU) |
We impose data protection terms on each sub-processor that are no less protective than this agreement, and remain liable for their performance.
7. International transfers
Where a sub-processor processes personal data outside the UK, we rely on UK adequacy regulations (including the UK-US data bridge where the recipient is certified) or the UK International Data Transfer Addendum to the EU standard contractual clauses.
8. Audits
On reasonable written notice, and no more than once a year unless there has been a breach, we will answer the customer's reasonable questions about our compliance and provide relevant documents. Any on-site audit must be agreed in advance, at the customer's cost.
9. Deletion at the end
When the account closes, the customer has 30 days to export its documents. We then delete the customer's personal data within a further 30 days, except where the law requires us to keep it (such as billing records). Backups are overwritten in line with the provider's backup cycle.
10. Liability and order of precedence
The liability limits in the terms of service apply to this agreement. If this agreement conflicts with the terms of service on data protection, this agreement takes priority.