Rankbird
1Roles
This DPA applies whenever Rankbird processes personal data on the Client’s behalf in the context of the Service. The Client is the controller and Rankbird the processor (Art. 4 GDPR). For personal data Rankbird processes for its own purposes, such as account management, billing and security, Rankbird is the controller; see our Privacy Policy.
2Nature, purpose and duration
Rankbird processes personal data only as needed to provide the Service, including analysing the Client’s store, generating and publishing content, reporting on performance, the optional Google integrations and AI-visibility monitoring. Processing lasts for the term of the agreement plus the retention periods below.
3Data subjects and personal data
- Data subjects: the Client’s users of the Service and, where made available via the Client’s store or connected services, visitors to the Client’s store.
- Personal data: name, email, role and language of users; connection credentials; technical identifiers; aggregated analytics; and any personal data the Client includes in prompts, briefs or templates.
Rankbird does not process special categories of personal data (Art. 9 GDPR). The Client must not supply such data via the Service.
4Instructions
Rankbird processes personal data only on the Client’s documented instructions, including on international transfers, unless EU or Dutch law requires otherwise. These instructions are set out in the Terms, this DPA and the Client’s configuration in the Service. Rankbird informs the Client if it believes an instruction breaches the GDPR.
5Confidentiality and security
Persons authorised by Rankbird to process personal data are bound by confidentiality. Rankbird takes appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- encryption in transit and at rest, with connection credentials stored encrypted;
- access restricted to what is strictly necessary, with multi-factor authentication where available;
- secured cloud infrastructure in the EU;
- logging and monitoring of production systems;
- regular backups; and
- a procedure for handling security incidents.
A more detailed description of these measures is available to Clients on request.
6Sub-processors
The Client authorises Rankbird to engage sub-processors to deliver the Service. The categories are listed on Sub-processors; the current list with names is available to Clients on request at support@rankbird.com. Rankbird informs Clients in advance of adding or replacing a sub-processor. The Client may object on reasonable grounds within 30 days; the parties then seek an alternative in good faith or, failing that, the Client may terminate the affected part of the Service. Rankbird imposes equivalent data-protection obligations on each sub-processor and remains liable for them.
7International transfers
For transfers outside the EEA, Rankbird relies on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses (Decision 2021/914), with additional safeguards where required.
8Data-subject rights
Rankbird assists the Client, as far as reasonably possible, in responding to data-subject requests. Requests Rankbird receives directly are forwarded to the Client without undue delay.
9Data breaches
Rankbird informs the Client without undue delay, and in any case within 72 hours of becoming aware, of a breach involving the Client’s personal data, with the information the Client needs under Art. 33(3) GDPR.
10Audits and information
Rankbird makes available the information needed to demonstrate compliance with this DPA. On reasonable written notice, at most once every 12 months and at the Client’s expense, the Client may have Rankbird’s processing audited by a mutually agreed independent auditor bound by confidentiality.
11Return and deletion
At the end of the agreement, Rankbird returns the personal data processed on the Client’s behalf at the Client’s request. Deletion is not automatic: Rankbird deletes this personal data, including Google-derived data and stored credentials, within 30 days of a verified deletion request from the Client to support@rankbird.com, unless EU or Dutch law requires storage. Copies in backups are overwritten in the normal backup cycle and stay protected until then.
12Liability
Liability under this DPA is subject to the limitations in the Terms & Conditions, without limiting a party’s liability for its own obligations under data-protection law.
13Term and precedence
This DPA applies as long as Rankbird processes personal data on the Client’s behalf. For data-protection matters, this DPA prevails over the Terms & Conditions.