This is a draft template. It has not been reviewed by a lawyer and is not an executed agreement. Download the text with the link at the bottom of the page.

## 1. Scope and roles

For the analytics data you connect to RankPilot and the workspace content you create, you are the controller and the provider is the processor. We process it only to provide the service and on your documented instructions, which include your use of the product's settings and features.

## 2. Confidentiality

People authorised to process the data are bound by confidentiality. Staff have no standing database access, and staff actions on customer data are written to the audit log.

## 3. Security

We maintain the technical and organisational measures described on the security page, each of which is tied to an automated test.

## 4. Subprocessors

You authorise the subprocessors listed on the subprocessors page. We will update the list before adding or replacing one and give notice through the changelog so you can object.

## 5. Assistance

We provide data export and deletion from the product, and will help you answer data subject requests and carry out impact assessments where the law requires it.

## 6. Deletion and return

When you delete a workspace or account, data is purged after the 30-day grace period. Before then you can export it.

## 7. Breach notification

We will tell you without undue delay after we become aware of a personal data breach affecting your data.

## 8. Audits

We will make available the information needed to show compliance and allow reasonable audits on notice.

## 9. International transfers

Transfer mechanism: pending owner and lawyer decision. See the subprocessors page for each provider's location.

## 10. Governing law

Provider: **Pending owner decision (Q17: legal entity name)**

Governing law: **Pending owner decision (Q17: governing law)**