Skip to content
Get in touch

This document is being finalised. Contact support with any question.

SEO-AI Data Processing Agreement (Template)

This template sets out how PineSeed processes personal data for a business customer of SEO-AI. Ask for a signed copy through Contact support.

This agreement is between:

  • Customer: [customer name and address] ("Customer"); and
  • PineSeed Pty Ltd, Queensland, Australia ("PineSeed").

It forms part of the SEO-AI Terms of Service. If the two conflict about personal data, this agreement applies.

"Data protection law" means the privacy and data protection laws that apply to the personal data, including the Privacy Act 1988 (Cth), and the GDPR and the UK GDPR where they apply. "Personal data" has the meaning in that law. "Customer Data" means personal data that PineSeed processes for the Customer through SEO-AI.

1. Roles

The Customer is the controller of Customer Data. PineSeed is the processor. If the Customer is itself a processor for its own client, PineSeed is a sub-processor.

PineSeed is the controller of its own account, billing and security data. That data is covered by the Privacy Policy.

2. Subject matter and details

  • Subject matter: providing SEO-AI to the Customer.
  • Duration: while the Customer uses SEO-AI, and until deletion under section 10.
  • Nature and purpose: storing, analysing and using the data to research, write, score and publish articles, to track search performance, to run site health crawls and to submit business listings.
  • Types of personal data: member identity (id, email, display name); team member details; names, addresses and phone numbers of businesses and contacts in submission projects; writing samples, stories and quotes; author and reviewer profiles; photos; connection credentials; search performance data.
  • People concerned: the Customer's team members, authors and reviewers, the Customer's clients and their staff, and people named in content.

3. Instructions

PineSeed will process Customer Data only on the Customer's documented instructions. The Terms of Service, this agreement, and the Customer's use of the product's settings are those instructions. PineSeed may also process Customer Data where the law requires it, and will tell the Customer first unless the law forbids that.

PineSeed will tell the Customer if it believes an instruction breaks data protection law.

4. Confidentiality

PineSeed will make sure that everyone who can access Customer Data is bound by a duty of confidentiality, and has access only as needed to provide the service.

5. Security

PineSeed will keep appropriate technical and organisational measures to protect Customer Data. These include:

  • encryption of WordPress application passwords and Google and Microsoft tokens;
  • role-based access to workspaces;
  • a security and billing audit log;
  • removal of EXIF data from uploaded photos;
  • separation of workspaces from each other;
  • limits on who at PineSeed can reach production data;
  • regular updates to software;
  • a process to detect, record and respond to security incidents.

6. Sub-processors

The Customer agrees that PineSeed may use the sub-processors listed in SUB-PROCESSORS.md. That list says what each does, what data it gets, and where it is.

PineSeed will give the Customer at least 30 days' notice before adding or replacing a sub-processor that receives Customer Data. The notice goes to the Customer's workspace owner by email. The Customer may object on reasonable data protection grounds by writing to us through the Contact support button in SEO-AI within that time. The parties will talk in good faith. If they cannot agree, the Customer may cancel the affected service before the change takes effect.

PineSeed will have a written contract with each sub-processor that gives protection no less strict than this agreement. PineSeed remains responsible to the Customer for its sub-processors.

7. Help with rights requests

PineSeed will give the Customer reasonable help to answer requests from people to access, correct, erase, restrict, port or object to the use of their data. If a person contacts PineSeed directly about Customer Data, PineSeed will pass the request to the Customer and will not reply to it unless the Customer asks.

8. Help with compliance

PineSeed will give the Customer reasonable help with security duties, data protection impact assessments and consultations with regulators, taking into account the nature of the processing and what PineSeed knows.

9. Personal data breaches

PineSeed will tell the Customer without undue delay, and within 72 hours, after it becomes aware of a personal data breach affecting Customer Data. The notice will say, as far as known:

  • what happened and when;
  • the kinds of data and the number of people affected;
  • the likely effects;
  • what PineSeed has done and will do.

PineSeed will give updates as it learns more. PineSeed will help the Customer meet its own duty to notify regulators and people, including under the Notifiable Data Breaches scheme in Australia and Articles 33 and 34 of the GDPR.

10. Return and deletion

The Customer can export its content and delete its workspace at any time. When the workspace owner deletes a workspace, PineSeed deletes it and everything in it at once. Other data is removed on the schedule in DATA-RETENTION.md.

When the Customer's agreement ends, PineSeed will delete the Customer Data within 30 days after the Customer asks, unless the law requires PineSeed to keep it. De-identified billing records and the billing and security audit log may be kept for 7 years where the law requires it. PineSeed will keep that data confidential and protected, and use it only for that reason.

11. Audits

PineSeed will give the Customer the information it reasonably needs to show PineSeed is following this agreement. If that is not enough, the Customer may audit PineSeed on reasonable notice, no more than once a year unless a breach has happened or a regulator requires more. The audit must be in business hours, must not interfere with the service, and must respect the confidentiality of other customers. The Customer bears its own costs and the reasonable costs of PineSeed.

12. International transfers

PineSeed and its sub-processors are in Australia and other countries, including the United States. Where Customer Data from the EU, the EEA, the UK or Switzerland is sent to a country without an adequacy decision, the parties agree to the following, which apply as written in this agreement:

  • the standard contractual clauses approved by the European Commission (Decision 2021/914), Module Two (controller to processor), or Module Three if the Customer is a processor;
  • for UK transfers, the UK International Data Transfer Addendum;
  • for Swiss transfers, the clauses as adapted for Swiss law.

For the clauses, the Customer is the data exporter and PineSeed is the data importer. Clause 7 (docking) applies. The option in Clause 11 is not used. The annexes are completed by sections 2, 5 and 6 of this agreement.

PineSeed will also make sure its sub-processors use a lawful transfer mechanism.

13. Liability

Each party's liability under this agreement is subject to the limits in the Terms of Service, to the extent the law allows. Nothing limits liability that cannot be limited by law, or the rights of a person under the standard contractual clauses.

14. General

This agreement lasts as long as PineSeed processes Customer Data. It is governed by the law of Queensland, Australia, except that the standard contractual clauses are governed as stated in section 12.

Signed for the Customer:

Name: ____________________ Title: ____________________ Date: ____________________

Signed for PineSeed Pty Ltd:

Name: ____________________ Title: ____________________ Date: ____________________

Contact for notices: the Contact support button in SEO-AI