Data Processing Agreement

Roles and instructions

For tenant content processed solely to provide the configured service, the business tenant generally acts as controller and AstraSEO as processor. AstraSEO processes data only on documented instructions, including product configuration and lawful support requests, unless EU or Member State law requires otherwise.

Confidentiality and security

• Role-based and tenant-scoped access controls.
• Encrypted provider credentials and transport encryption.
• Audit logging, signed webhook verification and incident controls.
• Backups, recovery procedures and least-privilege operational access.
• Regular review of technical and organizational measures appropriate to risk.

Subprocessors

AstraSEO may use subprocessors subject to data-protection obligations. The tenant receives the change and objection rights agreed in the executed DPA. Customer-selected integrations are treated according to their respective roles.

Assistance

Taking account of the nature of processing, AstraSEO provides reasonable assistance with data-subject requests, security obligations, impact assessments and supervisory-authority consultations. Extraordinary assistance may be charged where legally and contractually permitted.

Incidents

AstraSEO will notify the tenant without undue delay after becoming aware of a personal-data breach affecting tenant data and provide available information needed for the tenant’s obligations.

Return and deletion

At termination, tenant data is returned or deleted according to export functionality, retention settings, backups, legal holds and statutory obligations. Data retained solely for legal duties is isolated from ordinary use.

International transfers and audit

Restricted transfers use an applicable lawful mechanism. Audit rights are satisfied first through current documentation, certifications and written responses; proportionate on-site audits may be arranged under confidentiality, security and cost conditions in the signed DPA.