Data processing agreement

1. Parties and roles

1.1This data processing agreement belongs to GeoReady's terms of service and applies between GeoReady (processor) and the customer (controller). It takes effect when the customer accepts the terms of service.

1.2If the customer is an agency that uses GeoReady for its own clients, the agency is the controller towards GeoReady (or itself a processor on behalf of its client) and GeoReady is the (sub)processor. The agency ensures its agreements with its clients are consistent with this.

1.3For data GeoReady processes for its own purposes, such as billing and platform security, GeoReady is itself the controller; the privacy policy applies to that.

2. Subject, purpose and duration

2.1GeoReady processes personal data solely to provide the service as described in the terms of service: managing accounts and users, running tracking, showing results, sending reports and notifications, and providing support.

2.2Processing lasts for the term of the agreement, plus the period in article 11 during which data is returned or deleted.

3. Types of data and data subjects

3.1Data subjects: the customer's users (employees, team members, an agency's client logins) and people named in public AI answers or sources, such as the owner of a business.

3.2Data: users' name, business email address, role and language; login details and technical data such as IP address and sign-in time; data the customer enters, such as contact details in the business profile, notes and names on actions; and names that happen to appear in public AI answers.

3.3GeoReady does not ask for special categories of personal data or for data about the customer's own customers. The customer does not enter such data in the service.

4. Processing on instructions

4.1GeoReady processes personal data only on the customer's documented instructions. The agreement, the settings the customer chooses in the app and this data processing agreement count as those instructions.

4.2If GeoReady considers an instruction to infringe the GDPR, GeoReady informs the customer immediately.

4.3GeoReady does not process the data for its own purposes, except in anonymized and aggregated form as set out in article 10 of the terms of service, or where required by law.

5. Confidentiality

5.1Everyone with access to personal data on GeoReady's behalf is bound by confidentiality. Access is limited to those who need it for the service or for support at the customer's request.

6. Security

6.1GeoReady takes appropriate technical and organizational measures, taking into account the state of the art, the costs and the risks. These include at least:

6.2encrypted connections (HTTPS/TLS) for all traffic; data separated per organization and enforced in the database (row-level security); roles and permissions per user, with limited access for read-only members and client logins; hashed passwords and API keys; two-step verification for users; single-use invitation links; logging of administrative actions in an audit log; and least-privilege access for administrators.

6.3GeoReady reviews these measures periodically and adjusts them where needed. A change never lowers the level of protection.

7. Subprocessors

7.1The customer gives GeoReady general authorization to engage the subprocessors in the annex. GeoReady imposes the same obligations on them as in this agreement and remains responsible to the customer for their compliance.

7.2If GeoReady adds or replaces a subprocessor, GeoReady will give at least 30 days' notice by email. The customer may object on reasonable grounds within that period. If the parties cannot find a solution, the customer may cancel the agreement as of the effective date.

7.3When tracking, GeoReady sends the customer's prompts to the AI providers. Prompts should not contain personal data (article 5 of the terms of service).

8. Transfers outside the EEA

8.1Some subprocessors are established, or process data, outside the European Economic Area. GeoReady transfers data only where there is a valid basis under Chapter V GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

9. Data subject rights and assistance

9.1GeoReady assists the customer with appropriate measures in responding to data subject requests, such as access, rectification, erasure and portability. Users can change or export much of their data themselves in the app. If a request reaches GeoReady directly, GeoReady forwards it to the customer.

9.2GeoReady provides reasonable assistance with a data protection impact assessment or prior consultation with the supervisory authority, insofar as it concerns GeoReady's processing.

10. Personal data breaches

10.1GeoReady notifies the customer of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it.

10.2The notification includes, where known: the nature of the breach, the categories of data and approximate number of data subjects affected, the likely consequences and the measures taken or proposed. GeoReady keeps the customer informed and assists with any notification to the supervisory authority and data subjects. Notifying remains the customer's responsibility.

11. End and deletion

11.1After the agreement ends, the customer can still export its data for 30 days. GeoReady then deletes the personal data, including copies, unless retention is required by law. Data held in a backup is overwritten in the normal backup cycle.

11.2On request, GeoReady confirms the deletion in writing.

12. Information and audits

12.1On request, GeoReady makes available all information needed to demonstrate compliance with this agreement.

12.2The customer may have an audit carried out by an independent expert bound by confidentiality at most once a year, with at least 30 days' notice. The customer bears the costs, unless the audit shows a material failure by GeoReady. GeoReady may first offer a recent independent statement or report as an alternative.

13. Liability and other provisions

13.1Liability is governed by article 12 of the terms of service.

13.2This data processing agreement runs for as long as GeoReady processes personal data for the customer. In case of conflict with the terms of service, this agreement prevails as regards the processing of personal data. This agreement is governed by Dutch law.

13.3If the customer would like a signed copy for its records, or wants to use its own template, please email info@geoready.nl.

Annex: subprocessors