Data Processing Addendum (DPA)

1. Parties and application

This DPA forms part of the contract between the customer as controller and Martin Kučera, Company ID 00959324, as processor where the customer sends personal data through the service and determines its purposes and means. It applies for the duration of the relevant feature.

2. Subject matter and instructions

The subject matter is processing connected WordPress-site data for enabled audits, hosted generation, support, licensing, and operational features. Documented instructions consist of the contract, customer settings, API calls, and written requests within the agreed scope.

The processor processes data only on documented instructions unless EU or Member State law requires otherwise; it will inform the customer before such processing unless the law prohibits notice. It will flag an apparently unlawful instruction and may suspend its execution.

3. Nature, purpose, data, and people

• Nature: receipt, transmission, structuring, analysis, output generation, temporary storage, security, support, deletion, and anonymisation.
• Purpose: customer-selected AI visibility, Markdown output, audit, reporting, and support functions.
• Data: public or explicitly permitted site content, URLs, metadata, technical identifiers, hashed IP, user-agent, bounded diagnostics, support messages, report-branding settings, and personal data that may appear in customer content.
• People: customer-site visitors and users, online-store customers, employees, suppliers, and others whose data the customer lawfully processes.
• Special-category and criminal-offence data are not intended for processing and must not be supplied without a prior written agreement and appropriate safeguards.

4. Processor duties

• Ensure that authorised personnel are bound by confidentiality.
• Maintain appropriate technical and organisational measures and restrict access by role and tenant.
• Taking account of the processing, assist with data-subject requests, risk assessments, incidents, and supervisory-authority consultations.
• Provide information needed to demonstrate compliance and permit a reasonable audit under this DPA.
• At termination, delete or return data at the customer’s choice unless law requires retention.

5. Security and incidents

• TLS in transit; hashed licences and tokens; encrypted secrets and temporary asynchronous payloads.
• Tenant isolation, role-based access, HMAC, timestamp validation, replay protection, rate limits, and audit trails.
• Data minimisation, zero raw LLM-input retention by default, scheduled pruning, and a verified organisation-erasure process.
• The processor will notify the customer of a personal data breach without undue delay after becoming aware of it and provide available information needed for the customer’s notification duties.

6. Subprocessors

The customer gives general written authorisation to use subprocessors. They currently comprise ACTIVE 24, s.r.o. / WebSupport s.r.o. for hosting, infrastructure, backups, and system email delivery, and Stripe to the extent it acts as a processor during future approved use of payment services. Public checkout remains disabled. No external AI provider is enabled.

The processor will impose substantially the same data protection duties on a subprocessor. It will give at least 15 days’ prior notice of an intended addition or replacement where practicable. The customer may raise a reasoned objection; if it cannot be resolved, the customer may terminate the affected feature.

7. International transfers

Data will be transferred outside the EU/EEA only on documented instructions and under a valid Chapter V GDPR mechanism, particularly an adequacy decision or Standard Contractual Clauses. On request, the processor will identify the mechanism to the extent permitted by contractual and security obligations.

8. Audit, deletion, and liability

The processor will first provide available documentation and answers. The customer may request a reasonable audit no more than annually, or following a serious incident, with at least 30 days’ notice, during business hours, without endangering other customers, and at its own cost unless a material breach is established.

Retention follows the Privacy Policy. The verified erasure process deletes operational records and anonymises necessary links; Stripe and other provider data is handled through their processes. Liability follows the main contract and applicable law without restricting duties that cannot lawfully be limited.