Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of service between UpgradIQ, Inc., a Delaware company (“Surfil,” the “Processor”) and the customer who accepted those Terms (the “Customer,” the “Controller”). It applies whenever Surfil processes personal data on the Customer’s behalf and the GDPR, the UK GDPR, the Swiss FADP or a US state privacy law (such as the CCPA as amended by the CPRA) applies to that data. It takes effect when the Customer accepts the Terms and applies for as long as Surfil processes Customer Data; no signature is needed.

1. Definitions

“Personal data,” “processing,” “controller,” “processor,” “data subject” and “personal data breach” have the meaning given in the GDPR. “Customer Data” means the personal data Surfil processes on the Customer’s behalf under the Terms, as described in section 3 of this Addendum.

2. Roles of the parties

For Customer Data, the Customer is the controller and Surfil is the processor. For account, billing and sign-in data about the Customer’s own users, and for our website, Surfil is an independent controller, as described in our Privacy policy; this DPA does not apply to any of that data.

3. Scope and purpose

• Subject matter: providing Surfil’s website checks, analytics, reports and recommendations to the Customer.
• Duration: for as long as the Customer has an account, plus the deletion period in section 11.
• Nature and purpose: collecting, storing, aggregating and displaying the data in the categories below, only to provide the Services the Customer asked for.
• Data subjects: visitors to the Customer’s website, and the people whose data sits in the Customer’s connected accounts.

Categories of data

• Surfil Pixel data: page views, sources and AI referrals, real-user speed, conversions (form submits and tagged clicks), JS errors and 404s, with page paths cut at the query string, and a visitor hash made with a salt that rotates daily and is discarded. The Pixel sets no cookies and stores no name, email address or IP address (the IP address is read only to make the daily hash and is never stored), so it is designed not to be personal data, but it is covered by this DPA in case a court or regulator treats it as personal data under any law.
• Connected account data: read-only Google Search Console and Analytics figures (monthly and daily totals, and page-level rows for 28-day windows), and revenue figures read with a restricted read-only Stripe key, which may relate to the Customer’s own customers in aggregate.
• Public website content: the public pages of the Customer’s website, read daily.

The Customer must not send special categories of personal data or data of children to Surfil.

4. Processing on instructions

Surfil processes Customer Data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use of the product’s settings. If Surfil believes an instruction breaks data protection law, it will tell the Customer and may pause that instruction. The Customer is responsible for having a lawful basis for the processing and for informing its visitors that it uses the Surfil Pixel.

5. Confidentiality

Everyone at Surfil with access to Customer Data is bound by a duty of confidentiality and has access only as far as their role needs.

6. Security measures

Surfil maintains the measures described on our security page, including:

• encryption in transit (TLS) and at rest;
• connected-account secrets such as Stripe keys stored encrypted in a vault;
• row-level security on every database table and role-based access for staff, checked on every request;
• SSRF protection on the crawler that reads public pages;
• rate limiting on public endpoints and on sign-in attempts;
• a cookieless Pixel, with raw events deleted after 7 days;
• error monitoring with personal data scrubbed before it is stored;
• database backups and an incident response process in place.

7. Subprocessors

The Customer gives general authorization for Surfil to use the subprocessors listed on our subprocessors page. Surfil binds each one to data protection terms no less protective than this DPA and remains responsible for their performance. Surfil updates that page before a new subprocessor starts handling Customer Data. The Customer may object on reasonable data protection grounds within 30 days of the update by emailing hello@surfil.com; if the parties cannot resolve it, the Customer may cancel the affected Services and receive a pro rata refund of prepaid fees for the unused period of the current subscription term.

8. Assistance

Taking into account the nature of the processing, Surfil will help the Customer, at no extra charge for reasonable requests, to: respond to data subject requests (access, correction, deletion, portability, objection); meet its security, breach-notification and impact-assessment obligations; and consult a regulator where required. If a data subject contacts Surfil directly about Customer Data, Surfil will refer them to the Customer.

9. Personal data breaches

Surfil will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Data, with the information it then has and updates as it learns more.

10. International transfers

Surfil is established in the United States. Where Customer Data is transferred out of the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by European Commission Decision 2021/914 apply, as follows: Module Two (controller to processor) between the Customer as exporter and Surfil as importer, and Module Three (processor to processor) for onward transfers to subprocessors. Clause 7 (docking) applies; in Clause 9 Option 2 (general authorization) applies with the 30-day notice in section 7; the optional wording in Clause 11 does not apply; the governing law (Clause 17) and forum (Clause 18) are those of Ireland; the competent supervisory authority is the one for the Customer’s establishment. Annex I is sections 2 and 3 of this DPA, and Annex II is section 6. For the UK, the UK International Data Transfer Addendum applies on the same terms; for Switzerland, the clauses apply with references to the GDPR read as references to the Swiss FADP. If a transfer mechanism is invalidated, the parties will agree a replacement in good faith.

11. Deletion and return

When the Customer disconnects Google or Stripe, the stored credentials and the figures read with them are deleted. Raw Pixel events are deleted 7 days after collection. When the Customer asks us to delete the account, or the Terms end, Surfil deletes Customer Data from its systems, and from backups as they roll off, unless the law requires it to keep some. Before then the Customer can export its data at any time from the account settings page.

12. Audits

Surfil will give the Customer the information needed to show it follows this DPA and will allow and contribute to audits, including inspections, by the Customer or an auditor it appoints. The Customer must give 30 days notice, the audit must be during business hours, protect other customers’ data and Surfil’s confidential information, and not happen more than once a year unless a breach or a regulator requires it. Surfil may first respond with written answers or security documents.

13. Liability

Each party’s liability under this DPA is subject to the limits in the Terms, except where the law or the Standard Contractual Clauses say otherwise. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Data; if it conflicts with the Standard Contractual Clauses, those Clauses prevail over both of them.

14. US state privacy laws

Where a US state privacy law applies to Customer Data, Surfil acts as the Customer’s service provider or processor and:

• processes Customer Data only for the business purposes in section 3;
• does not sell or share Customer Data, as those words are defined in the CCPA, and does not use it for targeted advertising;
• does not retain, use or disclose Customer Data outside the direct business relationship with the Customer, or combine it with data from other sources, except as the law permits for a service provider;
• complies with the obligations that apply to it and gives the same level of protection the law requires;
• notifies the Customer if it can no longer meet those obligations.

The Customer may take reasonable steps to stop and remediate unauthorized use of Customer Data.

15. Contact

Data protection questions and requests: hello@surfil.com. Operated by UpgradIQ, Inc., a Delaware company.