This Data Processing Agreement (“DPA”) is part of the Terms of Service between Tapio Kauranen, Rua da Trindade 31, 4000-220 Porto, Portugal (“we”, the processor) and each business customer of Susanna Dashboard (“you”, the controller).
It applies automatically when a business customer accepts the Terms, so it doesn’t need a separate signature. If you need a signed copy for your records, write to privacy@susannadashboard.com.
1. Definitions
Words such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meaning they have in the EU General Data Protection Regulation 2016/679 (GDPR).
- Data protection law means the GDPR, the national laws that complete it (in Portugal, Law No. 58/2019) and, where it applies, the UK GDPR.
- Customer personal data means the personal data we process on your behalf when we provide the Service, described in Annex 1.
- Subprocessor means another processor that we engage to process customer personal data.
- The Service has the meaning it has in the Terms.
2. Roles and scope
You are the controller of the customer personal data. If you use the Service for your own clients, for example as an agency, you may be a processor for them; then we are your subprocessor, and you confirm that your clients have authorized you to use us.
We are the processor. This DPA doesn’t cover the personal data that we process as a controller, such as your account, sign-in and billing details. That is described in our Privacy Policy.
3. Your instructions
- We process customer personal data only on your documented instructions, also when it comes to transfers outside the EU and the EEA, unless EU or member state law requires us to process it. In that case we tell you before processing, unless that law forbids it.
- Your instructions are these Terms and this DPA, and the choices you make in the Service: for example connecting a site, sharing a report, sending reports or alerts, and deleting data. Other instructions must be agreed in writing.
- We tell you immediately if, in our opinion, an instruction breaks data protection law.
- You are responsible for the lawfulness of the processing: that you have a legal basis for it, that you inform the data subjects as needed, and that your instructions follow data protection law.
4. Confidentiality
Everyone we authorize to process customer personal data is bound to keep it confidential, by contract or by law.
5. Security
We take the technical and organizational measures required by Article 32 of the GDPR, described in Annex 2. They take into account the state of the art, the costs, and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of people. We may improve and change the measures, as long as the overall level of protection doesn’t go down.
6. Subprocessors
- You give us a general authorization to use subprocessors. Those we use now are listed on the Subprocessors page.
- We tell you at least 30 days before we add or replace a subprocessor, by updating that page and by email to the account owner.
- You can object to the change on reasonable grounds of data protection within those 30 days by writing to privacy@susannadashboard.com. If we can’t solve your objection, you may end the use of the part of the Service concerned, and we refund the part of a prepaid fee that covers the time after that.
- We give every subprocessor, by written contract, the same data protection obligations as in this DPA. We remain responsible to you for the work of our subprocessors.
7. Transfers outside the EU and the EEA
We transfer customer personal data outside the EU and the EEA, or allow a subprocessor to do so, only with the safeguards required by Chapter V of the GDPR: a decision of the European Commission that the country protects personal data adequately (such as the EU–U.S. Data Privacy Framework for certified companies), or the Standard Contractual Clauses of the European Commission, with additional measures where needed.
8. Requests from data subjects
- Taking into account the nature of the processing, we help you with appropriate technical and organizational measures to answer requests of data subjects who use their rights under the GDPR. Much of this you can do in the Service yourself: you can find, export and delete data, remove sites and delete your account.
- If a data subject contacts us directly about customer personal data, we forward the request to you without undue delay, and we don’t answer it ourselves, except to tell them that we have forwarded it.
9. Personal data breaches
- We tell you without undue delay, and at the latest within 48 hours of becoming aware of it, about a personal data breach that concerns customer personal data.
- We tell you what we know: what happened, the categories and the approximate number of the data subjects and records concerned, the likely consequences, and what we have done or plan to do. We give you more information as we learn it.
- We take reasonable steps to contain the breach and reduce its harm. Telling the supervisory authority and the data subjects is your responsibility as the controller, and we help you with it.
10. Other help
Taking into account the nature of the processing and the information we have, we help you with your obligations under Articles 32 to 36 of the GDPR: security, breach notifications, data protection impact assessments and prior consultations with a supervisory authority. If the help you need goes beyond what the Service and this DPA cover, we may charge a reasonable fee for it, agreed in advance.
11. Audits
- We give you the information you need to show that we follow this DPA, for example by answering reasonable security questionnaires.
- If that information isn’t enough, you may audit our processing of customer personal data yourself, or through an independent auditor bound by confidentiality, at most once a year, unless a supervisory authority requires an audit or there has been a personal data breach. Tell us at least 30 days in advance. The audit takes place during business hours, at your own cost, without disturbing the Service, and without access to the data of our other customers.
12. At the end of the processing
When you delete data, remove a site or delete your account, and when the agreement ends, we delete the customer personal data concerned: from the Service at once, and from our backups within 30 days, unless the law requires us to keep it. Before that you can export your data with the features of the Service. We confirm the deletion in writing if you ask.
13. Liability and order of precedence
- The limitations of liability in the Terms apply to this DPA, as far as Article 82 of the GDPR allows.
- In matters of data protection, this DPA comes before the Terms. Where Standard Contractual Clauses apply, they come before this DPA.
14. Duration
This DPA applies for as long as we process customer personal data for you.
Annex 1: Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing Susanna Dashboard: reports on Google Search Console data. |
| Duration | The duration of the agreement, and the time it takes to delete the data afterwards (section 12). |
| Nature of the processing | Fetching from Google’s API, storing, organizing, analyzing, showing, sharing as you instruct, sending by email as you set up, backing up and deleting. |
| Purpose | To provide the Service to you under the Terms. |
| Categories of data subjects | People whose personal data appears in the Search Console data of your sites, for example people whose name is searched for; the people you send reports and alerts to, or share reports with; people you mention in your notes or tags. |
| Types of personal data | Search queries and page addresses that contain personal data, such as names; email addresses of recipients; names and other details in notes, tags, lists and report texts; images you upload. |
| Special categories of data | Not intended. A search query can sometimes reveal such data. Google hides rare queries that could identify the person searching, and you should not add special categories of data to your reports. |
| Frequency | Continuous, for as long as the sites are connected. |
| Retention | As set out in the Terms and in your plan, and section 12 of this DPA. |
Annex 2: Technical and organizational measures
Hosting and backups
- The Service runs on servers of a professional hosting provider in the European Union.
- The database is backed up continuously, with a full copy every day, to a separate provider in the European Union. Backups are kept for 30 days, and a backup is restored and checked automatically every day.
- The server is set up from code, so it can be rebuilt quickly.
Encryption
- All connections to the Service are encrypted with TLS (HTTPS), and browsers are told to use only encrypted connections (HSTS).
- Google’s refresh tokens are stored encrypted with AES-256-GCM, with the keys kept apart from the database; the short-lived access tokens expire within an hour.
- The backup storage is encrypted at rest by its provider.
Access control
- Production systems can be accessed only by authorized people, with personal SSH keys. Password logins are not allowed.
- The firewall lets in only the connections the Service needs (web and SSH).
- The Service runs as a user without administrator rights.
- Each user can see only the sites they have connected; this is checked on every request and covered by automated tests.
Application security
- Access to Google is read-only, and only the permissions the Service needs are asked for.
- The sign-in uses Google’s OAuth with the protections of “state” and PKCE. The session cookie can’t be read by scripts and is sent only over encrypted connections.
- Uploaded images are checked by their content, and SVG images are kept from running scripts.
- The application doesn’t store IP addresses.
Operations
- Security updates of the operating system are installed automatically.
- The Service, the data synchronization and the backups are monitored, and failures raise alerts.
- Changes are tested automatically before they are released.
- Personal data breaches are handled and reported as section 9 describes.
People
- Everyone with access to customer personal data is bound to confidentiality.
Annex 3: Subprocessors
The subprocessors we use are listed on the Subprocessors page, together with what they do, the data they process and where.