Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Master Subscription Agreement or Terms of Service (the “Agreement”) by and between MarketingHero Limited (dba SEOPulse), a company incorporated in Hong Kong (“Company”, “SEOPulse”, “Processor”, “we”, or “us”), and the customer entity identified in the executed Order Form or Agreement (“Customer” or “Controller”). This DPA governs the Processing of Customer Personal Data in connection with the Services.

This DPA prevails over any conflicting or inconsistent terms of the Agreement regarding data privacy and protection, but does not otherwise modify or amend the Agreement.

1. Definitions

1.1 In this DPA:

a) “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing”, and “Supervisory Authority” have the meanings given to them under applicable Data Protection Law. “Data Subject” includes “Consumer” as defined under U.S. Privacy Laws.

b) “Customer Personal Data” means Personal Data Processed by Company as a Processor on behalf of Customer (or a Third-Party Controller for whom Customer acts as a Processor) in providing the Services.

c) “Data Protection Law” means all applicable international, regional, national, and state data privacy and data protection laws and regulations governing the Processing of Customer Personal Data under the Agreement, including, as applicable: (i) The Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”); (ii) Asian Data Protection Laws, including Singapore’s PDPA, Japan’s APPI, South Korea’s PIPA, Malaysia’s PDPA 2010, the Philippines Data Privacy Act, and Thailand’s PDPA; (iii) European Data Protection Laws, including the EU GDPR, UK GDPR, Swiss FADP, and e-Privacy Directive 2002/58/EC; (iv) U.S. Privacy Laws, including the CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, TDPSA, OCPA, and applicable state privacy statutes; and (v) Privacy frameworks in Australia (Privacy Act 1988) and New Zealand (Privacy Act 2020).

d) “Data Subject Rights” means Data Subjects’ statutory rights to information, access, rectification, erasure, restriction, data portability, objection, consent withdrawal, and human review under applicable Data Protection Law.

e) “EU-U.S. Data Privacy Framework” means the adequacy decision laid down in Commission Implementing Decision EU 2023/1795 and UK Extension thereto.

f) “International Data Transfer” means any disclosure or transfer of Customer Personal Data to an entity or data center located outside the jurisdiction of origin.

g) “Processor” means “Processor,” “Service Provider,” or “Contractor” as defined under applicable Data Protection Law.

h) “SCCs” means the Standard Contractual Clauses annexed to EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as updated or replaced.

i) “Selling” and “Sharing” have the meanings assigned under U.S. Privacy Laws (including the CCPA).

j) “Services” means the SaaS-based search engine and Large Language Model (LLM) visibility analytics platform provided by SEOPulse under the Agreement.

k) “Subprocessor” means any third-party Processor engaged by Company to Process Customer Personal Data.

l) “Third-Party Controller” means a Controller for which Customer acts as a Processor.

2. Scope and Roles of the Parties

2.1 Scope: This DPA applies to Company’s Processing of Customer Personal Data on behalf of Customer in delivering the Services.

2.2 Roles: Customer is a Controller (or Business) and appoints SEOPulse as a Processor (or Service Provider) to Process Customer Personal Data solely on Customer’s behalf. Customer is responsible for fulfilling all obligations and obtaining all consents required of Controllers under Data Protection Law.

2.3 Third-Party Controllers: If Customer acts as a Processor on behalf of a Third-Party Controller, Customer represents that it has full authority to issue instructions and exercise rights under this DPA on behalf of such Third-Party Controller, serving as the sole point of contact for Company.

2.4 Service Telemetry & Operational Data: Customer acknowledges that Company may Process Personal Data relating to the operation, technical performance, and usage of the Services for its own legitimate business purposes, including: (a) account management, authentication, billing, and technical support; (b) tracking usage, telemetry, error reporting, and security indicators; and (c) analyzing aggregated, de-identified model query performance metrics.

2.5 Consideration: The Parties agree that the disclosure of Customer Personal Data to Company under the Agreement does not form part of any monetary or valuable consideration exchanged between the Parties.

3. Processing Instructions & CCPA Restrictions

3.1 Documented Instructions: Company shall Process Customer Personal Data strictly to provide the Services and in accordance with Customer’s documented instructions as set forth in this DPA, the Agreement, and applicable Order Forms.

3.2 Additional Instructions: Customer may issue reasonable additional instructions to ensure compliance with Data Protection Law. Company may charge a reasonable, cost-based fee to implement non-standard instructions.

3.3 Data Processing Restrictions: Company is strictly prohibited from: (i) Selling or Sharing Customer Personal Data; (ii) retaining, using, or disclosing Customer Personal Data for any purpose other than for the specific business purposes documented in Customer’s instructions; (iii) retaining, using, or disclosing Customer Personal Data outside the direct business relationship; and (iv) combining Customer Personal Data with personal data received from or on behalf of third parties, except as permitted under Data Protection Law.

3.4 Compliance Certification: Company certifies that it understands and will comply with all processing restrictions set forth in this DPA.

3.5 Unlawful Instructions: Company shall promptly inform Customer if, in its opinion, an instruction from Customer infringes applicable Data Protection Law.

3.6 Special Categories of Data: Customer shall not submit, upload, or instruct Company to Process any sensitive or special categories of personal data (e.g., health, biometric, genetic, or political data) into the Services. If Company becomes aware that Customer Personal Data received contains special categories of personal data, Company shall promptly notify Customer, cease Processing such data to the extent practicable, and cooperate with Customer to remediate the transfer. Company has no affirmative operational duty to actively monitor or screen Customer prompt inputs for sensitive data, and Customer shall reimburse Company for reasonable operational costs directly incurred in remediating Customer’s inadvertent submission of special categories of data.

4. Personnel and Confidentiality

Company shall ensure that all employees, contractors, and authorized personnel empowered to Process Customer Personal Data are bound by strict, enforceable contractual or statutory confidentiality obligations.

5. Technical & Organizational Measures (TOMs) & Breaches

5.1 Technical & Organizational Measures: Company will implement and maintain appropriate technical, administrative, and physical security safeguards designed to ensure a level of security appropriate to the risk of processing Customer Personal Data, adhering to industry standard frameworks as detailed in Annex II.

5.2 Customer Acknowledgment: Customer acknowledges that the security measures set forth in Annex II provide an appropriate level of protection relative to the risks of Customer’s intended processing.

5.3 Personal Data Breach Notification: Company shall notify Customer without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of an actual Personal Data Breach affecting Customer Personal Data. The notification will describe the nature of the incident, affected data categories, and mitigation measures taken.

6. Subprocessing

6.1 Authorization: Customer grants Company general authorization to engage Subprocessors. Company’s current list of approved Subprocessors is set forth in Annex III.

6.2 Subprocessor Agreements: Company shall enter into written contracts with each Subprocessor imposing data protection obligations no less protective than those established in this DPA.

6.3 Notice of Subprocessor Changes & Deeming Provision: Company shall notify Customer prior to authorizing any new Subprocessor. Customer may object to a new Subprocessor based on reasonable grounds relating to an actual or potential violation of Data Protection Law by providing written notice detailing such grounds within thirty (30) days following Company’s notification. Where applicable Data Protection Law requires specific authorization of Subprocessors, Company shall provide sufficient information about the proposed Subprocessor; provided, however, that if Customer does not object in writing within thirty (30) days of receiving such notice, Customer shall be conclusively deemed to have provided written approval.

7. Assistance and Audits

7.1 Assistance: Taking into account the nature of processing and available information, Company shall assist Customer with fulfilling Data Subject Rights requests, conducting Data Protection Impact Assessments (DPIAs), and consulting Supervisory Authorities (including the Hong Kong PCPD). Company may charge a reasonable fee for assistance unless the assistance arises from Company’s fault.

7.2 Audits: Upon reasonable written request (no more than once per 12-month period), Company shall provide information necessary to demonstrate compliance with this DPA. If necessary to satisfy regulatory mandates, Customer may conduct a remote or on-site audit of relevant facilities, performed during normal business hours by a mutually agreed independent auditor under strict confidentiality duties. If the Parties cannot agree on an auditor within thirty (30) days of Customer’s written audit request, Customer may appoint a reputable, internationally recognized information security audit firm, provided such firm is not a direct commercial competitor of Company and executes Company’s standard non-disclosure agreement.

7.3 Audit Costs: Company and Customer shall each bear their own internal costs related to an audit under this Section 7. If an audit is conducted by an independent auditor, Customer shall bear the fees of such auditor unless the audit reveals a material breach of this DPA by Company.

8. International Data Transfers & Regional Compliance

8.1 Global Transfer Approvals: Customer authorizes Company to perform International Data Transfers of Customer Personal Data to cloud infrastructure and sub-processors located in Hong Kong, the European Union, the United States, Singapore, Japan, or other third countries, provided appropriate transfer mechanisms are maintained.

8.2 Hong Kong PDPO Compliance: Company shall handle Customer Personal Data in accordance with the Data Protection Principles (DPPs) of the Hong Kong PDPO, ensuring data is not held longer than necessary and applying reasonable security measures against unauthorized access.

8.3 Asian Data Law Provisions: To the extent Customer Personal Data is subject to Asian Data Protection Laws (e.g., Singapore PDPA, Japan APPI, South Korea PIPA), Company shall comply with applicable cross-border transfer requirements.

8.4 EU/UK Transfer Mechanisms (SCCs): To the extent a transfer of Customer Personal Data constitutes an International Data Transfer from the EEA, UK, or Switzerland, the applicable Module of the Standard Contractual Clauses (SCCs) annexed to EU Commission Implementing Decision (EU) 2021/914 is incorporated herein by reference, selected as follows: (i) Module 2 (Controller-to-Processor) applies where Customer as Controller transfers data to Company as Processor; (ii) Module 3 (Processor-to-Processor) applies where Customer acts as Processor on behalf of a Third-Party Controller and transfers data to Company; (iii) Module 4 (Processor-to-Controller) applies where Company as Processor transfers data back to Customer as Controller. Option 1 (Clause 17) governing law is the law of Ireland (for EU) or the UK, and Annex I and II to the SCCs correspond to Annex I and II to this DPA.

9. Termination and Data Return or Deletion

9.1 Term: This DPA terminates automatically upon the expiration or termination of the Agreement.

9.2 Data Return or Deletion: Within thirty (30) days following termination of the Agreement, Customer may request the return of Customer Personal Data. Company shall delete Customer Personal Data from production systems within thirty (30) days of termination or receipt of Customer’s deletion instructions. Backup copies shall be securely overwritten in the ordinary course of the backup cycle, and no later than ninety (90) days following termination. During the period between termination and backup purge, Company shall ensure that Customer Personal Data contained in backup media is isolated from active systems, access-restricted, and not used for any other purpose.

9.3 Liability: Each Party’s aggregate liability arising out of or relating to this DPA (including under the SCCs and Annexes) shall be subject to the limitations and exclusions of liability set forth in the Agreement. Nothing in this DPA limits either Party’s liability to the extent such limitation is prohibited by mandatory provisions of applicable Data Protection Law.

10. Data Protection Officer and Representative

10.1 Data Protection Officer: Company has designated a privacy contact reachable at [email protected] to handle data protection inquiries. Where applicable Data Protection Law requires formal designation of a Data Protection Officer, Company shall fulfill such requirement in accordance with its legal obligations.

10.2 EU and UK Representative: Where required under Article 27 of the EU GDPR or UK GDPR, Company shall appoint and maintain a representative established in the relevant jurisdiction. Company shall proactively notify Customer of the appointed representative’s name, jurisdiction, and contact details, and shall promptly notify Customer of any change to such appointment.

Annex I: Description of Processing & Transfers

A. LIST OF PARTIES

Data Importer / Processor: MarketingHero Limited (dba SEOPulse), Unit 2904-05, 29/F, Universal Trade Centre, No.3 Arbuthnot Road, Central, Hong Kong. Contact: [email protected]. Role: Processor (and Data Exporter only on return transfers under SCC Module 4).

Data Exporter / Controller: Customer entity identified in the Agreement / Order Form. Role: Controller (or Processor on behalf of Third-Party Controller).

B. DESCRIPTION OF TRANSFER & PROCESSING

Categories of Data Subjects: Employees, contractors, and authorized personnel of Customer; individuals named or referenced in prompt sets or search outputs; website visitors.

Categories of Personal Data: User profile data (name, work email, organization, job title); prompt set configuration data; LLM search result data stored in workspace; customer support communications; technical access logs and IP addresses.

Sensitive / Special Categories of Data: None.

Frequency of Transfer: Continuous basis during the term of the Agreement.

Nature and Purpose of Processing: Collection, hosting, and execution of prompt sets configured by Customer against selected AI systems and LLM providers; presentation of search visibility and citation results in Customer’s dashboards; transmission of prompt content to third-party AI inference engines (including, without limitation, ChatGPT, Gemini, Google AI Overviews, Google AI Mode, Perplexity, DeepSeek, Qwen, Kimi, and Ernie, as updated from time to time); technical support; and processing operational telemetry to maintain platform security.

Retention Periods: Retained during active account term; production deletion within 30 days of termination; backup purge within 90 days; Sentry logs retained 30–90 days.

Annex II: Technical and Organizational Measures (TOMs)

Data Encryption: All web traffic and platform API endpoints are encrypted in transit using HTTPS/TLS 1.2 or higher. Database backups and static storage buckets are encrypted at rest using industry-standard managed encryption algorithms.

Access Controls & Authentication: Access to production systems and databases is strictly restricted to authorized engineering and support staff based on least-privilege principles and role-based access control (RBAC). SSO and mandatory Multi-Factor Authentication (MFA) are enforced for administrative systems.

Cloud Infrastructure & Physical Security: Primary infrastructure is hosted in tier-3 certified cloud data centers (Google Cloud Platform in Frankfurt/USA) featuring 24/7 physical security, biometric access, and environmental controls.

Backups & Incident Recovery: Daily automated encrypted backups are conducted. System architecture supports rapid failover with a target recovery time objective (RTO) of within 4 hours.

Vulnerability Management & Monitoring: Automated dependency monitoring is active to identify software vulnerabilities. Continuous logging and intrusion detection tools monitor platform infrastructure.

Annex III: List of Subprocessors

Customer explicitly authorizes Company to engage the following Subprocessors in delivering the Services: