Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service or signed Master Services Agreement (the "Agreement") between V-technology LLC, doing business as RankFlow SEO ("Processor", "we"), and the customer ("Controller", "you") for the provision of services. It applies whenever Processor processes Personal Data (as defined in the GDPR, UK GDPR, or applicable US state privacy laws) on behalf of the Controller in connection with the services.

If there is any conflict between this DPA and the Agreement, this DPA controls with respect to the processing of Personal Data.

Subject matter and nature: provision of SEO consulting and execution services, including analytics review, content production, technical optimization, and reporting, as described in the plan the Controller subscribed to or the relevant Statement of Work.

Duration: the term of the Agreement and any post-termination assistance period necessary for the orderly return or deletion of Personal Data.

Purpose: to deliver the services to the Controller and to comply with the Controller's documented instructions.

Categories of Personal Data typically processed include: (a) end-user behavioral data from the Controller's website or apps, such as IP address, device and browser information, page views, referrers, and approximate geographic region; (b) contact details of the Controller's employees and contractors (name, work email, role) for engagement administration; and (c) any other Personal Data the Controller transmits to Processor under the Agreement.

Categories of data subjects: visitors and customers of the Controller's website or apps; employees, contractors, and other personnel of the Controller.

No special-category data. Processor does not require, and the Controller agrees not to provide, special categories of Personal Data (such as health, biometric, or children's data) except where expressly agreed in writing in a SOW.

Documented instructions. Processor will process Personal Data only on the documented instructions of the Controller, including with regard to international transfers, unless required by law to which Processor is subject; in such a case, Processor will inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

Confidentiality. Processor will ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Security. Processor will implement the technical and organizational measures described in the Annex to ensure a level of security appropriate to the risk.

Assistance to the Controller. Processor will, taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures, insofar as possible, with the fulfillment of the Controller's obligations to respond to requests for the exercise of data-subject rights and with the Controller's obligations under Articles 32 to 36 of the GDPR (security, breach notification, impact assessments, prior consultation).

Breach notification. Processor will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach, and will provide the Controller with reasonably available information to allow it to meet its own breach-notification obligations.

The Controller provides general written authorization for Processor to engage subprocessors for the services. Processor will maintain a current list of subprocessors and will inform the Controller of any intended changes concerning the addition or replacement of subprocessors with at least thirty (30) days' advance notice. The Controller may object to a new subprocessor in writing within fifteen (15) days of notice; if the parties cannot agree on a mutually acceptable resolution, the Controller may terminate the affected services on written notice without penalty.

Processor's current subprocessors are: Vercel Inc. (United States) for website and application hosting; Neon Inc. (United States) for database hosting; Stripe, Inc. (United States) for payment processing and billing; and Resend, Inc. (United States) for transactional email.

Processor remains fully liable to the Controller for the performance of each subprocessor's obligations and will impose data-protection terms on each subprocessor that are no less protective than those in this DPA.

Where Personal Data subject to the GDPR or UK GDPR is transferred from the EEA, the UK, or Switzerland to a third country that has not received an adequacy decision, the parties incorporate by reference the European Commission's Standard Contractual Clauses (Module Two: Controller-to-Processor) and the UK International Data Transfer Addendum, as applicable, which take precedence over any conflicting term of this DPA with respect to those transfers.

The optional clauses of the SCCs are addressed as follows: Clause 7 (docking) — included; Clause 9(a) — option 2 (general written authorization) with a 30-day notice period as described under "Subprocessors"; Clause 11(a) — independent dispute resolution body not selected; Clause 17 — Irish law; Clause 18 — Irish courts. The Annexes to the SCCs correspond to the categories of data, the technical and organizational measures, and the subprocessor list set out in this DPA.

Processor will make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA, including the security documentation published by its subprocessors. On reasonable advance written notice and no more than once per twelve-month period (except where required by a regulator), the Controller may audit Processor's compliance, either by reviewing that documentation and written answers to reasonable security questionnaires (preferred method), or by an audit conducted by the Controller or an independent auditor selected by mutual agreement, at the Controller's expense and during normal business hours, subject to reasonable confidentiality and security requirements.

On termination of the Agreement, Processor will, at the Controller's choice, return or securely delete all Personal Data processed on behalf of the Controller, and will delete existing copies, within thirty (30) days, unless retention is required by applicable law. Where Personal Data is retained under such legal requirements, Processor will continue to protect it in accordance with this DPA for as long as it is retained.

Access controls. Access to Personal Data is limited to personnel who need it to deliver the services. Unique accounts, strong passwords, and two-factor authentication on service accounts where available. Access is revoked promptly when it is no longer needed.

Encryption. TLS for all data in transit. Encryption at rest as provided by our hosting and database providers.

Infrastructure. Hosting on managed providers (Vercel for the application, Neon for the database) that maintain their own security programs, DDoS protection, and automated patching.

Devices. Devices used to access Personal Data are kept up to date, locked with a password or biometric screen lock, and use full-disk encryption.

Personnel. Personnel and contractors with access to Personal Data are bound by written confidentiality obligations.

Vendor management. Due diligence on subprocessors before engagement. Data-protection terms with each subprocessor.

Incident response. Security incidents are assessed and contained promptly, and the Controller is notified as described under "Processor obligations".

Business continuity. Database backups and point-in-time recovery provided by our database provider.