Data Processing Addendum

1. Scope and relationship of the parties

In plain terms: this draft describes processing on customer instructions by ATLIO INFORMATION TECHNOLOGY L.L.C S.O.C. The customer may be a controller or a processor acting for its own client; roles depend on the activity. Our own account, billing and marketing processing is described in the Privacy Policy. Our parent company is ATLIO LIMITED, registered in New Zealand. Parent ownership does not itself mean that the parent receives or processes customer data.

This Data Processing Addendum (“DPA”) is proposed between ATLIO INFORMATION TECHNOLOGY L.L.C S.O.C (“SearchChamp”, “Processor”) and the customer accepting the applicable service agreement (“Customer”). For the clauses below, references to the Controller include a Customer acting as processor with authority from its controller; SearchChamp then acts as subprocessor. This draft does not transfer historical contracts or assert a processing role for ATLIO LIMITED solely because it is the parent.

This DPA applies where SearchChamp processes personal data on behalf of the Controller in the course of providing the SearchChamp platform. It supplements the Terms of Service and, in the event of a conflict, this DPA takes precedence on data-protection matters. It does not apply to the processing SearchChamp carries out as a controller in its own right, such as account registration, billing, and marketing, which is described in our Privacy Policy.

This DPA is designed to meet the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), the corresponding provisions of the UK GDPR, the New Zealand Privacy Act 2020, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and any other applicable data-protection laws.

2. Processing details

2.1 Subject matter and purpose

SearchChamp processes personal data for the sole purpose of providing the SearchChamp platform services as described in the Terms of Service, including AI-assisted keyword research, content generation, site auditing, AI visibility tracking, link outreach, publishing to connected platforms, and related analytics and notifications.

2.2 Nature of processing

Collection, storage, organisation, analysis, retrieval, disclosure by transmission to the sub-processors engaged under section 5, and deletion of personal data submitted by the Controller or generated through the Controller’s use of the platform.

2.3 Types of personal data

• Account and team data: names, email addresses, and account identifiers of the Controller’s users.
• Website content and metadata submitted by the Controller for processing by AI agents.
• Integration data the Controller authorises the platform to read from connected services, such as Google Search Console, Google Analytics 4, Google Ads, and Google Tag Manager, which may contain personal data.
• Outreach contact data: names, email addresses, and domains of link-building prospects the Controller adds or instructs the platform to find, together with outreach messages and delivery signals such as bounces and replies.
• Usage and interaction data generated through use of the platform.
• IP addresses and device identifiers collected via server logs.

2.4 Categories of data subjects

• The Controller’s employees and team members who access the platform.
• End users and visitors of the Controller’s connected websites, where their data is incidentally processed during site audits, analytics reads, or AI agent tasks.
• Outreach prospects and other recipients of messages the Controller sends through the platform.
• Where the Controller uses the platform to provide services to its own clients: personnel and end users of those clients whose websites the Controller connects.

2.5 Duration of processing

SearchChamp processes personal data for the duration of the active subscription and for such further periods as required by applicable law or as specified in our data-retention schedules (see our Privacy Policy), and in accordance with section 11 of this DPA.

3. Controller obligations

The Controller agrees to:

• Ensure that it has a lawful basis for providing personal data to SearchChamp for processing;
• Comply with all applicable data-protection laws in relation to the personal data it submits to the Service, and ensure that its documented instructions to SearchChamp comply with those laws;
• Provide adequate privacy notices to data subjects whose data will be processed through the Service;
• Obtain any necessary consents from data subjects before submitting their data to the Service;
• Notify SearchChamp promptly if it receives a data-subject request relating to data processed by SearchChamp on its behalf.

4. Processor obligations

SearchChamp agrees to:

• Process personal data only on documented instructions from the Controller, including with regard to international transfers, unless required to do so by applicable law; in that case, SearchChamp will inform the Controller of the legal requirement before processing, unless the law prohibits it;
• Inform the Controller without undue delay if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law;
• Ensure that persons authorised to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality;
• Implement and maintain appropriate technical and organisational security measures as described in section 6;
• Not engage sub-processors without prior general or specific written authorisation of the Controller, subject to section 5 of this DPA;
• Assist the Controller in responding to data-subject rights requests, taking into account the nature of the processing;
• Assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR, including security of processing, breach notification, data protection impact assessments, and prior consultation with supervisory authorities, taking into account the nature of the processing and the information available to SearchChamp;
• Make available to the Controller information reasonably necessary to demonstrate compliance with the obligations set out in Article 28 GDPR, and allow for and contribute to audits as described in section 10;
• Notify the Controller without undue delay after becoming aware of a personal data breach involving data processed on behalf of the Controller;
• Delete or return all personal data to the Controller at the end of the service relationship, in accordance with section 11.

5. Sub-processors

The Controller provides general written authorisation for SearchChamp to engage the sub-processors listed at /legal/sub-processors that process personal data on the Controller’s behalf. SearchChamp will:

• Notify the Controller at least 14 days before adding or replacing a sub-processor by a durable notice to the Controller’s contractual contact as well as updating the page; contractual notices do not depend on marketing opt-in;
• Impose data-protection obligations on sub-processors that are at least equivalent to those set out in this DPA;
• Remain fully liable to the Controller for the performance of sub-processors’ obligations.

The Controller may object to a new sub-processor within 14 days of notice by emailing security@searchchamp.com. If the parties cannot reach agreement within 30 days, the Controller may terminate the relevant services. If the objection cannot be resolved before the new processing, the affected processing must not proceed on the objected-to basis. The Controller may terminate the affected service with any refund required for the unused prepaid period; this right is not deferred merely because a billing period is still running.

6. Security measures

SearchChamp maintains the following technical and organisational measures:

• Encryption at rest: AWS-managed encryption is configured for the RDS database and backups and for reviewed object-storage services used for personal data processed on the Controller’s behalf.
• Encryption in transit: public web and API endpoints use HTTPS; service-to-service transport controls are applied according to the AWS service and connection path.
• Access control: role-based application access and workspace-scoped authorization checks are used. Production database network access is restricted through private administrative paths.
• Network isolation: database tiers are deployed in private subnets without direct public ingress.
• Audit logging: authentication, workspace, administrative, and service events are recorded across category-specific stores. Production CloudWatch log groups have a 90-day minimum-retention control; audit records may be retained longer.
• Vulnerability management: automated dependency vulnerability scanning, security review as part of the development process, and a responsible disclosure channel (security@searchchamp.com).
• Incident response: a documented personal-data-breach runbook supports the notification commitment in section 9, with operating evidence reviewed through the readiness programme.

A full description of security controls and their current evidence boundaries is maintained at /legal/security.

7. Data subject rights

SearchChamp will assist the Controller in fulfilling data subject rights requests within the timeframes required by applicable law. Where a data subject contacts SearchChamp directly, SearchChamp will forward the request to the Controller and, where technically feasible, provide the Controller with tools to facilitate compliance, such as the in-app data export and account deletion functions.

The Controller remains the primary party responsible for responding to data subjects.

8. International data transfers

Our primary regional AWS application infrastructure is hosted in Ireland (eu-west-1). Our operating team accesses customer data from the United Arab Emirates. Delivery networks, connected services and other providers can process information in other countries. Primary hosting in Ireland is not a promise that all data, backups, logs or support processing stays there.

Before a restricted transfer, the parties must identify the exporter and importer, processing roles, destination, applicable law and valid mechanism, including completed SCC annexes, any required UK instrument and supplementary measures. Published provider standard terms can incorporate a DPA, but are not evidence that the correct account or all transfer legs are covered.

The recipient list records source-identified services and outstanding account and location verification. This draft does not certify executed SCCs, a completed transfer assessment, or a New Zealand group transfer. Contact security@searchchamp.com for the applicable documentation; unsupported assurances must be resolved before the affected processing relies on this DPA.

9. Personal data breach notification

SearchChamp will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Controller data. The notification will include, to the extent available:

• A description of the nature of the breach, including the categories and approximate number of data subjects and records affected;
• The name and contact details of the data protection point of contact;
• A description of the likely consequences of the breach;
• A description of the measures taken or proposed to address the breach.

Where information is not immediately available, SearchChamp may provide it in phases. The Controller is responsible for any notifications to supervisory authorities and data subjects required by applicable law.

10. Audit rights

SearchChamp will provide the Controller with all information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Controller or a mandated auditor.

For routine audits, please give 30 days’ notice and agree a proportionate scope, confidentiality and security arrangements. Appropriate documentation may help satisfy an audit by agreement, but is not a unilateral substitute for mandatory inspection rights. These arrangements must not delay an urgent incident investigation, a competent authority request or another non-excludable right. Costs and scheduling must not make those rights ineffective.

11. Deletion and return of data

At the end of the service, the Controller may choose return or deletion of personal data processed on its behalf, followed by deletion of remaining copies unless applicable law requires storage. We will agree a documented completion schedule and provide an accurate record of completed actions and any remaining data, purpose, access restrictions and retention period. A request can be made at security@searchchamp.com; available in-app exports do not limit this right.

Account closure alone is not proof of erasure. The assessment includes related job data, optional mailbox material, subprocessors and backups. Legally retained records must be isolated and protected from unrelated use; backups must follow their documented expiry and deletion must be reapplied after any restore. The Privacy Policy distinguishes configured controls and targets from verified deletion. An unverified purge must not be represented as a completed deletion certificate.

12. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service. Nothing in this DPA limits a party’s liability to data subjects or supervisory authorities under applicable data-protection law.

13. Contact and execution

This draft is not effective. Its prospective effective version and applicable customer cohort must be recorded with the service agreement. For customers requiring a countersigned DPA, please contact: