Data Processing Addendum

"Applicable Data Protection Law" means privacy or data-protection law that applies to the relevant processing. "Customer Personal Data" means personal data processed by RELAVANZ on Customer's behalf under the Services. "Subprocessor" means a third party engaged by RELAVANZ to process Customer Personal Data on RELAVANZ's behalf.

Customer determines the purposes and means of processing Customer Personal Data to the extent it acts as a controller or business. RELAVANZ processes Customer Personal Data as Customer's processor or service provider to provide, secure, support, and operate the Services and as otherwise documented in the agreement.

RELAVANZ may act independently for limited processing necessary for its own security, fraud prevention, billing, legal compliance, service administration, and other purposes described in the Privacy Policy, to the extent permitted by law.

Customer instructs RELAVANZ to process Customer Personal Data as needed to provide the Services, including Customer-configured Site analysis, AI, Article, Local, Commerce, Backlinks, integration, validation, monitoring, and support workflows. Additional documented instructions may be provided through product configuration, approved requests, or written agreement.

If RELAVANZ believes an instruction violates Applicable Data Protection Law, RELAVANZ may notify Customer and suspend the affected processing where legally appropriate.

• Customer is responsible for having the rights, permissions, notices, consents, and lawful basis needed to provide Customer Personal Data and instruct the processing.
• Customer must use appropriate permissions and avoid connecting Sites/accounts it is not authorized to control.
• Customer must not submit regulated or highly sensitive data to a feature that is not designed and contractually approved for that data.
• Customer is responsible for responding to its own end users where Customer is the controller or business, with RELAVANZ assistance as described below.

RELAVANZ will limit access to Customer Personal Data to personnel and service providers who need access for authorized purposes and who are subject to appropriate confidentiality obligations.

RELAVANZ maintains technical and organizational measures designed to protect Customer Personal Data in light of the nature of the Services and risks involved. Current architecture includes authenticated Workspace boundaries, tenant scoping, row-level security, server-side secret handling, capability gating, signed service communications, and controlled integration credentials.

RELAVANZ does not represent that it holds a particular certification or audit report unless that certification or report is separately verified and made available. Additional security information may be provided under appropriate confidentiality terms where available.

Customer generally authorizes RELAVANZ to use the Subprocessors identified on the Subprocessor List for the Services. RELAVANZ will impose appropriate data-protection obligations on Subprocessors based on the services they provide.

RELAVANZ may update the Subprocessor List as providers change. Where the governing agreement or Applicable Data Protection Law requires advance notice or an objection process, RELAVANZ will provide that process in the manner applicable to the relationship.

Taking into account the nature of the processing, RELAVANZ will provide reasonable assistance through available product capabilities and support processes to help Customer respond to requests to access, correct, delete, restrict, or export Customer Personal Data where required.

If RELAVANZ receives a request directly concerning Customer-controlled data, RELAVANZ may direct the requester to Customer unless law requires RELAVANZ to respond directly.

Where legally permitted, RELAVANZ may notify Customer of a binding governmental or legal request for Customer Personal Data and may review the request for validity and scope. RELAVANZ will disclose only information required by law and will not promise a challenge process beyond what RELAVANZ can reasonably support.

RELAVANZ will notify Customer without undue delay after becoming aware of a security incident affecting Customer Personal Data when notification is required by Applicable Data Protection Law or a separate written agreement. Information may be provided in phases as facts become available.

This public DPA does not promise a fixed contractual notification period such as 24, 48, or 72 hours unless a separate agreement expressly provides one.

Taking into account the nature of processing and information available to RELAVANZ, RELAVANZ will provide reasonable assistance with legally required security, data-subject, breach-notification, impact-assessment, and prior-consultation obligations relating to the Services.

Upon termination or a valid deletion instruction, RELAVANZ will delete, de-identify, or return Customer Personal Data as required by Applicable Data Protection Law and the applicable product/retention process, except where continued retention is legally required or permitted.

Site Archive is not a deletion instruction. Integration disconnect stops future use of the credential/connection but does not necessarily remove historical observations already stored in RELAVANZ.

RELAVANZ will make available information reasonably necessary to demonstrate compliance with applicable processor obligations, subject to confidentiality, security, proportionality, and protection of other customers. Where legally required and other information is insufficient, the parties may agree on an appropriately scoped audit process.

Customer Personal Data may be processed in the United States and other locations where RELAVANZ or its Subprocessors operate. Where Applicable Data Protection Law requires a transfer mechanism, the parties will use the legally available mechanism applicable to their roles, such as approved contractual clauses or another lawful transfer safeguard.

Mandatory official transfer clauses control to the extent they require a different result from this DPA.

Where RELAVANZ acts as a service provider or processor under an applicable U.S. state privacy law, RELAVANZ will process Customer Personal Data for the specified business purposes and documented Customer instructions, subject to legally required restrictions on use, disclosure, combining, subcontracting, and assistance with consumer rights.

If this DPA conflicts with the agreement regarding processing of Customer Personal Data, this DPA controls for that processing to the extent of the conflict. A separately negotiated DPA or mandatory transfer clause may supersede this public DPA where it expressly applies.

• Subject matter: operation, support, security, and customer-configured use of RELAVANZ.
• Duration: the term of the Services plus applicable retention/deletion periods.
• Purposes: Site analysis, customer workflows, account/Workspace administration, AI/content generation, integrations, monitoring/validation, Local/Commerce/Backlinks features, support, and security.
• Data subjects: Customer users, Customer contacts, Site/business contacts included in Customer-controlled data, review-request recipients where configured, and other individuals represented in Customer Content.
• Data categories: account/contact information, Customer Content, Site/business data, integration/provider observations, usage/security metadata, and other categories Customer submits to supported features.
• Sensitive data: not intended unless a feature and written agreement specifically support it. Customers should not submit regulated health, biometric, children's, secret credential, or full payment-card data to ordinary RELAVANZ features.

• authentication and authorization controls;
• Workspace/Site tenant scoping and row-level security;
• least-privilege capability and integration checks;
• server-side credential and secret handling;
• signed internal-service requests and service-account boundaries;
• logging, monitoring, abuse controls, and retry/fencing protections;
• secure-development, code review, and release verification processes;
• data-deletion, credential-revocation, and retention processes appropriate to the data source.

DPA and privacy questions may be sent to hello@relavanz.com.