Data processing agreement

1. Scope and roles

• You, the agency that holds the workspace, are the controller of the personal data you put into, or connect to, the service. This covers your clients' data, their contacts and your team.
• Regenious ("we") is the processor. We handle that data only to provide the service to you.
• For our own account data (who signs up, billing, security logs) we are a controller. The privacy policy covers that part.
• The terms apply to this agreement as written. If the two disagree about personal data, this agreement wins.

2. What we process

• Purpose: SEO and local marketing dashboards, reports, alerts and website monitoring for your clients, as you set them up.
• Kinds of data:
  • client and contact names, emails and phone numbers
  • business addresses
  • search and analytics figures imported from the Google, Bing and Business Profile accounts you connect, including search queries and page addresses
  • Business Profile reviews (reviewer name and text, as published on Google), the posts on the profile (as published on Google), and the replies and posts your team publishes, with their photos
  • report recipients' emails
  • your team members' names, emails and activity logs
  • files you upload
• People concerned:
  • your team
  • your clients and their staff
  • report recipients
  • people who reviewed your clients on Google
  Visitors of your clients' websites appear only as aggregated, anonymous figures from Google Analytics.
• Special categories: none are needed. Please don't upload them.
• Duration: while your workspace exists, then until deletion as in section 10.

3. We act on your instructions

We process the data only to run the service as you use and configure it, and as you instruct us in writing (for example through support). We don't process it for anything else. We don't sell it, use it for advertising, or use it to train AI models. If we think an instruction breaks data protection law, we will tell you. If the law ever requires us to process data in another way, we will tell you first, unless the law forbids that.

Your clients stay yours. We never contact your clients for our own purposes, share your client list with another agency or anyone else, or use it for our own sales or marketing. The only emails your clients get from the service are the ones your team sets up, such as reports, portal sign-in links and requests to connect their accounts.

4. Confidentiality

Only staff who need it to run the service, give support or keep it secure can access your data. They are bound by confidentiality. Every access by our staff to an agency's account is recorded in an audit log.

5. Security measures

• HTTPS for all traffic.
• Connection tokens and other secrets are encrypted at rest (AES-256-GCM, rotatable keys). Passwords are hashed.
• Two-factor authentication. Our own staff must use it.
• Your password is asked again before dangerous actions.
• Sessions are bound to the device.
• Every query is limited to the agency that owns the data, and members can be restricted to the clients assigned to them.
• Files are kept in private storage and opened only through short-lived signed links.
• Google Search Console, Google Analytics and Bing are connected read-only. On Business Profile we publish only the review replies and posts your team writes and chooses to publish, and change or remove them only when your team edits or deletes them; we never change listing details.
• Daily backups are encrypted before they leave the server, and restores are tested.
• Monitoring, error tracking and a security review of the code and its dependencies.

We may improve these measures over time, but never lower the overall level of protection.

6. Sub-processors

You allow us to use the sub-processors below. Each is bound by a written contract with data protection duties at least as strict as these. We remain responsible for them.

Google Search Console, Google Analytics, Bing Webmaster Tools and Google Business Profile are not sub-processors. They are your own accounts, which you connect so that we can read data from them.

Changes: we will tell workspace owners by email at least 30 days before a new sub-processor starts, and update this page. If you object on reasonable data protection grounds and we can't resolve it, you may cancel. We will refund any prepaid period you can no longer use.

7. International transfers

Some sub-processors are outside your country (see the table). Where your law requires it, transfers are covered by appropriate safeguards, such as the European Commission's Standard Contractual Clauses, or the equivalent mechanism of your country. On request we will provide the relevant terms.

The AI provider receives only aggregated report figures, and only from agencies that use AI summaries. If you don't want that, don't add AI summaries to your reports.

8. Helping you with requests

When a person asks you to see, correct, export or delete their data, the service lets you do most of it yourself:

• edit or delete clients, contacts and team members
• disconnect integrations
• export all workspace data as a ZIP
• delete the workspace

For anything else we will help within a reasonable time. If a person contacts us directly about your data, we will send them to you. We also help with data protection impact assessments and with questions from a supervisory authority, as far as they concern our processing.

9. Personal data breaches

If we become aware of a breach affecting your data, we will notify the workspace owner by email without undue delay, and in any case within 48 hours. We will tell you:

• what happened
• what data and how many people are likely affected
• what we are doing about it
• who to contact

We will keep you updated, and help you meet your own duty to notify authorities or the people concerned.

10. Deletion and return

• You can export all workspace data at any time (Data & account → Export all data).
• A deleted workspace can be restored for 30 days. After that its data, files and connection tokens are permanently deleted.
• Copies in our encrypted backups disappear as the backups expire, within a further 30 days.
• Invoices may be kept longer where tax law requires it.

See the data deletion page for the steps.

11. Information and audits

On request we will give you the information you reasonably need to show that this agreement is followed, such as answers to a security questionnaire or a description of our measures. If that isn't enough, or an authority requires it, you may carry out an audit, or have an independent auditor bound by confidentiality do it:

• at most once a year
• with 30 days' notice
• during business hours
• at your cost
• without access to other customers' data

12. Your responsibilities

• You have a lawful basis for the data you put into the service, and the right to connect your clients' accounts.
• You give the people concerned any information the law requires.
• You keep your team's access appropriate. That means roles, assigned clients, and removing people who leave.

13. Term, liability and precedence

This agreement lasts as long as we process data for you. Liability under it is subject to the limits in the terms of service, as far as the law allows. If we change it, we will announce changes that reduce your protection 30 days in advance. The "last updated" date above shows the current version.

14. Contact

Data protection questions, a countersigned copy, or the transfer terms: email privacy@regenious.com.