Договір про обробку даних

Version of publication date

Preamble

This data processing agreement (“DPA”) specifies the data protection obligations of the parties under the contract for the use of mavirank (the terms of service, “main contract”). It applies to all processing of personal data that we carry out on behalf of your organization. Where this DPA and the terms conflict, this DPA prevails on data protection matters.

Parties. The controller is the organization for which an account is created at mavirank (hereinafter “you” or “controller”). The processor is Global Solutions Systems GmbH, Bessemerstraße 51, 1st floor, 12103 Berlin, Germany (hereinafter “we” or “processor”). Whoever creates an organization or joins it as Owner confirms that they are authorized to represent the controller in data protection matters. If you yourself process the data on behalf of a third party (for instance as an agency for your clients), you are the controller towards us within the meaning of this agreement and make sure that you may engage us as a further processor.

1. Conclusion, form, precedence

1. This DPA is concluded when you accept the terms of service at registration or when creating an organization; it is part of the terms and applies per organization. The electronic form is sufficient (Art. 28(9) GDPR). Every version carries its date; the application records which version was accepted for your organization and when, and we confirm this to you in text form on request.
2. The current version is available at this address; the online version published here is authoritative. If we additionally provide a PDF version, it has the same content. If you need a signed version for your records, write to us at OFFEN-1: mavirank support address; we provide the current version as a document, you return it signed, and we countersign. The signed version has the same content as this page; deviating agreements require text form and our express consent.
3. Changes to this agreement. If we change this agreement or its Annexes 1 and 3, we publish a new version with a date, inform the Owners of your organization by e-mail at least 30 days before it takes effect and show them the new version in the application for acceptance; the acceptance is recorded with version and time. If you do not want to accept the new version, you can cancel with effect at the end of the current billing period until it takes effect; if you continue to use mavirank after it has taken effect without cancelling, the new version applies. Changes to the list of sub-processors (Annex 2) are governed by section 7.

2. Subject matter, duration, nature and purpose of processing

1. Subject matter is the operation of mavirank for your organization: fetching and checking the pages and websites you enter with our crawler (audits, recurring audits, checks through the sitemap), storing and displaying the results, providing reports (public, password-protected, on a custom domain), notification through the channels you set up, retrieving and displaying Google Search Console data through your connection, generating AI summaries, accepting and evaluating the web server logs delivered by your collector (log analysis), the REST API and the live channel in the app. Details are in Annex 1.
2. Duration is the term of the main contract. The agreement ends when the organization is deleted or the main contract is terminated; section 9 (deletion and return) applies beyond that.
3. Nature of processing: collection (fetching the pages to be audited, retrieval from Google Search Console, receipt of the logs from the collector), storage, evaluation (tests, score, comparison with the previous audit, daily statistics, comparison with the sitemap), transmission (notifications to the channels you choose, publication in reports, output through app and API, transmission of audit findings to AI providers if switched on), deletion after the retention period.
4. Purpose is exclusively the provision of the contractually agreed services for you. We do not process the data for our own purposes; statistical evaluations for operations (load, quotas) are carried out only without personal reference.

3. Types of data and categories of data subjects

The categories of personal data and the categories of data subjects are in Annex 1. Whether the addresses you enter, the audit results, reports, notification contacts, Google Search Console data and logs contain personal data is determined by you; we treat them throughout as if they could. Special categories (Art. 9 GDPR) are not subject of this agreement; you do not have pages audited or deliver logs where such data would be the subject of the processing.

4. Instructions

1. We process personal data only on your documented instructions, including with regard to transfers to a third country, unless we are required to do so by Union or Member State law; in that case we inform you of the requirement before processing, unless the law prohibits this (Art. 28(3) sentence 2 lit. a GDPR).
2. The instruction is first of all this contract. Beyond that you give instructions by using mavirank: you create, change or delete audits, websites, reports and shares, channels, notification rules, custom domains, log sources, members and roles, connect or disconnect Google Search Console, switch AI summaries on or off, and export or delete data. Each of these settings in the app or through the API is a documented instruction; we record it with its time, security-relevant operations additionally with the acting member.
3. Individual instructions outside these functions (for example a manual deletion, access or rectification in our systems) are given in text form to OFFEN-1: mavirank support address. Members of your organization with the roles Owner and Admin are authorized to give instructions; Members and Viewers are not. We may make an instruction that goes beyond the scope of services dependent on separate remuneration.
4. If we consider an instruction unlawful, we inform you without delay and may suspend its execution until you confirm or change it (Art. 28(3) sentence 3 GDPR).
5. Reports. A share is the instruction to make the shared report accessible to everyone who knows the link and, for protected reports, the password, and on that domain in the case of a custom domain. The report shows only what has been shared.
6. AI summaries. AI summaries are switched off for your organization until an Owner or Admin switches them on (default: off). While they are switched on, you instruct us to transmit, in order to generate a summary, the findings of the audit concerned or of the audits of the website concerned to the AI provider set from Annex 2, which processes them outside the EU. Only audit findings are transmitted (test results with evaluated values, including the audited address). We do not transmit Google Search Console data, logs of the log analysis, notification contacts, account and member data, or stored credentials and headers. If you switch AI summaries off, we transmit no more data of your organization to an AI provider from that time on.
7. Log analysis. By setting up a log source and running the collector you instruct us to accept the delivered logs, evaluate them and delete them according to Annex 1.3. Which logs the collector reads and in what form it delivers them (pseudonym, shortened network, parameters, error log) is determined by you through its configuration and the settings of the log source. The processing on your server, including the pseudonymization, is your own processing and not subject of this data processing.

5. Obligations of the processor

1. Confidentiality. We grant access to personal data only to persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and only as far as necessary for the service (Art. 28(3) sentence 2 lit. b GDPR). Access by platform administrators to customer data takes place with a second factor and is recorded in an audit log that we keep for two years.
2. Security. We take all measures required under Art. 32 GDPR. The technical and organizational measures implemented at the time the contract is concluded are in Annex 3. We may develop them further as long as the level of protection is not reduced, and we inform you of material changes.
3. Assistance with data subject rights. We assist you with appropriate technical and organizational measures in responding to requests of data subjects (Art. 12 to 23 GDPR) (Art. 28(3) sentence 2 lit. e GDPR). Primarily this is done through the functions of the app and the API: search, view, retrieval and deletion of audits, websites, reports, channels and log sources. In the logs of the log analysis, visitors are recorded only through a pseudonym that changes daily and whose key is on your server; we cannot find individual persons there, and the data expires according to Annex 1.3. If a request of a data subject reaches us directly, we forward it to you without answering it ourselves, as far as we can attribute it to your organization. We provide assistance beyond this within 7 days of a request in text form.
4. Assistance with Art. 32 to 36 GDPR. Taking into account the nature of the processing and the information available to us, we assist you with the security of processing, with notifying and communicating personal data breaches, with data protection impact assessments and with prior consultations (Art. 28(3) sentence 2 lit. f GDPR). The information in Annexes 1 and 3 serves as your basis for this.
5. Personal data breaches. If we become aware of a breach that concerns your data, we notify you without undue delay, at the latest 48 hours after becoming aware, at the e-mail addresses of the Owners of your organization (Art. 33(2) GDPR). As far as known, the notification contains: nature of the breach, data categories concerned and approximate number of data subjects and records, likely consequences, measures taken and proposed, contact person. We supply missing details later. We do not notify supervisory authorities or data subjects ourselves unless we are legally obliged to do so.
6. Record and contact. We keep a record of all categories of processing activities carried out on behalf (Art. 30(2) GDPR). Contact for data protection questions: info@global-solutions-systems.com. We have not appointed a data protection officer; there is no obligation to do so (Section 38(1) BDSG).
7. Place of processing. The processing locations are in Annex 2. Processing outside the EU or the EEA takes place only on your instruction (section 4 no. 6, section 8) or by the sub-processors named for this in Annex 2 with a safeguard under section 8 no. 1.
8. Separation. Your data is logically separated from that of other organizations (separation of tenants per organization in database, log store, live channel and API). Access by others is rejected.

6. Obligations of the controller

1. You are responsible for the lawfulness of the processing, in particular for being allowed to audit the pages and websites entered, have the logs of your servers evaluated, process the notification contacts and use the Google Search Console data in mavirank, and for the data subjects being informed (Art. 13, 14 GDPR). This applies especially to the visitors of your website whose requests appear in the logs of the log analysis.
2. You do not enter data whose processing by us would be unlawful, in particular no special categories (Art. 9 GDPR), no data subject to professional secrecy and no credentials for pages you are not allowed to audit.
3. You manage members, roles, API tokens, collector tokens, report shares and report passwords on your own responsibility and keep them secret. Assigning the roles Owner and Admin at the same time determines who may give us instructions.
4. You are responsible for the collector on your servers, its configuration and the key for the pseudonyms stored there. If you keep the default settings (pseudonym instead of IP address, masked parameter values, referring address without parameters), we receive no full IP addresses; if you change them, you are responsible for the delivery of the additional data.
5. You decide which reports you share and to whom you pass on link and password, and you are responsible for their content.
6. You inform us without delay if you notice errors or irregularities in the processing.

7. Sub-processors

1. You give us a general authorization to engage the sub-processors named in Annex 2 (Art. 28(2) GDPR). Only service providers that process personal data from your organization on our behalf count as sub-processors. Not included are: Paddle (independent controller for payment), Google as provider of Search Console (independent controller, source of the data), the chat and webhook services you choose (section 8 no. 2), the operators of the audited pages and your own servers.
2. With every sub-processor we conclude a contract that imposes the same data protection obligations on it as this agreement imposes on us (Art. 28(4) GDPR). If it fails to fulfil its obligations, we are liable to you for the performance of its obligations.
3. Changes (new sub-processor, replacement, new processing location) are announced by e-mail to the Owners of your organization at least 30 days before the engagement. You can object in text form within 30 days for an important data protection reason. If we cannot remedy the objection, both sides may terminate the main contract for the organization concerned as of the time of the engagement; amounts already paid for the time after that are refunded pro rata. We remedy an objection to an AI provider by AI summaries staying or being switched off for your organization (section 4 no. 6); an objection to the service for SMS and calls by you not setting up or removing such channels. After that we transmit no data of your organization to these sub-processors, and the other services remain unchanged.

8. Transfers to third countries, notification channels

1. We transfer personal data to a country outside the EU or the EEA only if you instruct us to by switching on AI summaries or choosing a notification channel, or if a sub-processor from Annex 2 processes there. In these cases we make sure that an adequacy decision of the EU Commission or standard data protection clauses (Art. 46 GDPR) are in place, and name the safeguard in Annex 2.
2. Third-party channels. If you set up a channel at a service (e-mail mailbox, Slack, Discord, Microsoft Teams, Google Chat, Telegram, ntfy, your own webhook), you instruct us to send notifications (name or address of the website or audit, event, time, score, link) to this service. The service is your recipient, not our sub-processor; your contract with it, its role and any transfer to a third country are your responsibility. We deliver SMS and calls through the service named in Annex 2.
3. Google Search Console data is used exclusively to provide it to your organization in mavirank and evaluate it for the organization. We do not pass it on to AI providers or other third parties and do not use it for our own purposes.

9. Deletion and return

1. During the term we delete data according to the periods your plan provides (audits, archived audits, daily statistics of the log analysis) or that apply as fixed periods (log lines of the log analysis, delivery log); the periods are in Annex 1. What you delete in the app (audit, website, report share, channel, custom domain, log source, member) is deleted together with its dependent data; log lines of a deleted log source can no longer be retrieved at once and expire in the log store after 30 days at the latest.
2. After the main contract ends or the organization is deleted, we delete all personal data of the organization from the running application, revoke the connection to Google Search Console at Google and delete the access token, unless Union or Member State law requires storage (in particular billing data under Section 147 AO, Section 257 HGB). Log lines of the log analysis expire 30 days after the deletion at the latest. You can retrieve the data yourself beforehand through the API, the print view of the reports and the CSV report of the log analysis (return); any handover beyond that takes place on request in text form before the deletion (Art. 28(3) sentence 2 lit. g GDPR).
3. Backups. Our backups are encrypted and are overwritten after fixed periods OFFEN-23: retention of the local and the offsite backups. A deletion only takes effect there when the respective copy expires; backups are not used to restore individual deleted data, and after a restore we promptly delete data again that had already been deleted.
4. On request we confirm the deletion in text form.

10. Evidence and audits

1. We make available to you all information necessary to demonstrate compliance with our obligations under Art. 28 GDPR (Art. 28(3) sentence 2 lit. h GDPR): this agreement with its annexes, current summaries of our security reviews, certificates and reports of our sub-processors (such as the data center operator), and on request the record under Art. 30(2) GDPR for your categories.
2. If this evidence is not sufficient in an individual case, you can request a remote audit free of charge once per calendar year: written questions, inspection of documents and, as far as necessary, of configurations by screen sharing. On-site audits including inspections are possible after at least ten working days’ notice during usual business hours, and additionally at any time for a specific reason (such as a data breach or an order of a supervisory authority); you reimburse us for the reasonable effort unless the audit reveals material breaches of this agreement. Auditors must be bound to confidentiality and must not be in competition with us. Inspections at the data center operator are governed by its audit rules.
3. We inform you without delay of orders of a supervisory authority that concern your data, as far as permitted.

11. Liability

Liability is governed by Art. 82 GDPR and the section “Liability” of the terms of service. The limitation set out there also applies to claims under this agreement, as far as Art. 82 GDPR does not preclude this.

12. Final provisions

German law applies. The final provisions of the terms of service (place of jurisdiction, severability, authoritative language version) apply accordingly. This agreement is available in German and English; the English version is a translation for your information, and in case of deviations the German version prevails.

---

Annex 1: Subject matter of processing, data categories, data subjects, retention

1.1 Services and processing

Service	What we process	Where the data comes from
Audits and websites	address of the audited page, hostname, settings (headers and credentials for HTTP authentication encrypted, timeout, expected status code), audit intervals, address of the sitemap and addresses found there; per run status code, redirect chain, response times, size, details of encryption and certificate, response headers; per test evaluated and limited values (for example title, description, headings, links, word count, up to ten e-mail addresses found in the visible text), findings, score, history. No copy of the audited page	addresses and settings entered by you; results from our crawler fetching the publicly reachable page
Reports	shares (visibility, link identifier, password as a hash only, expiry date), own branding (logo, colors, name), content as for audits and websites as far as shared	shared by you
Custom domains	domain, check value and state of the DNS verification, certificate	entered by you
Notification channels	contacts (e-mail addresses, phone numbers, chat and channel identifiers, webhook addresses, bot tokens; configuration encrypted), notification rules, delivery log (channel, event, time, result, error text), notifications in the app	entered by you; log from sending
Google Search Console	properties shared and their assignment to websites, indexing status of individual addresses, search analytics figures (queries, clicks, impressions, position, by day, country and device)	retrieved from Google through the connection of your organization
AI summaries (only if switched on)	audit findings transmitted to the AI provider; stored summary as structured text, provider, model, usage	from the audits of your organization; answer of the AI provider
Ahrefs Domain Rating, Google Web Risk	hostname of the website (Ahrefs) or audited address (Web Risk); stored value or result	from your websites and audits; answer of the service
Log analysis	log source (hostnames, settings, collector token as a hash only, time of the last contact, version of the collector); per log line time, domain, method, path (parameter values masked by default), status code, size, pseudonym of the IP address (changing daily, formed on your server), identifier of the requesting program, referring address without parameters, bot detection and its confirmation, for rejected scan requests the shortened network (can be switched off), shortened messages of the error log (can be switched off); daily statistics, top lists and result of the comparison with the sitemap	delivered by the collector on your server; statistics derived from it
API and live channel	output of the data named above to members and API tokens of your organization; live events (identifiers, status)	—

Not subject of this agreement (we are the controller ourselves for this, see the privacy policy): account and sign-in data of the members, invitations, roles, sessions, the identifier of the Google account connected to Search Console, billing and Paddle, system e-mails to accounts, server logs and rate limits of the platform, the audit log of the platform and the use of the public tools without an account.

1.2 Categories of data subjects

• Members, employees and representatives of your organization (as notification contacts, as creators of audits and shares)
• Visitors of your websites as far as their requests appear in the delivered logs (pseudonymized)
• Persons publicly named on the audited pages (for example in titles, headings, addresses or as an e-mail address in the visible text), and persons recognizable in search queries of Search Console or in paths and parameters of the logs
• Readers of your reports only produce server logs with us (our own responsibility)

1.3 Retention during the term

Data	Duration
Audits with history	by plan 30, 90, 365 or 730 days (Free, Starter, Pro, Agency)
Archived audits	by plan 30, 365, 730 or 1,825 days
Log lines of the log analysis	30 days on all plans
Daily statistics of the log analysis	by plan 30 days, 6, 12 or 24 months; immediately when the log source, website or organization is deleted
Google Search Console data	OFFEN-26: retention of the Search Console data per plan; the access token until the connection is disconnected
AI summaries	as long as the audit or website they belong to
Delivery log of notifications, notifications in the app	90 days
After a change to a smaller plan	the retention periods for audits, archived audits and daily statistics keep the higher value for 30 days (grace period)
Websites, reports and shares, channels, custom domains, log sources, stored credentials	until you delete them
Backups	OFFEN-23: retention of the local and the offsite backups

---

Annex 2: Sub-processors and processing locations

As of publication date

Company	Service	Seat / place of processing	Safeguard for third countries
OFFEN-5: hosting provider with address	data center and servers for application, database, log store of the log analysis, queues, crawlers and local backups	OFFEN-5: location of the data center	OFFEN-5: not applicable if EU
OFFEN-7: offsite backup provider	encrypted offsite backups	OFFEN-7: seat and place of processing	OFFEN-7: safeguard
OFFEN-20: sending service for notification e-mails	sending the notification e-mails (contain name or address of the website or audit, event, recipient address)	OFFEN-20: seat and place of processing	OFFEN-20: not applicable if EU
Anthropic (Claude) OFFEN-21: contracting entity with address	generating AI summaries from audit findings; default provider. Only if AI summaries are switched on	outside the EU OFFEN-21: processing locations	OFFEN-21: transfer safeguard
OpenAI OFFEN-21: contracting entity with address	as above; only if this provider is set	outside the EU OFFEN-21: processing locations	OFFEN-21: transfer safeguard
Google (Gemini) OFFEN-21: contracting entity with address	as above; only if this provider is set	outside the EU OFFEN-21: processing locations	OFFEN-21: transfer safeguard
Twilio OFFEN-22: contracting entity with address	delivery of SMS and calls (phone number, text of the notification). Only if you set up such channels (Pro and Agency plans)	OFFEN-22: place of processing	OFFEN-22: transfer safeguard

AI providers receive data of your organization only while AI summaries are switched on for it (section 4 no. 6, section 7 no. 3).

Further recipients of individual details: Google (Web Risk) receives the audited address, Ahrefs the hostname of the website, in each case without account or member data OFFEN-24: Ahrefs and Google Web Risk – contracting entities, processing locations and classification.

Not sub-processors within the meaning of this agreement: Paddle.com Market Limited (payment; independent controller, receives no audit, report or log data) · Google as provider of Search Console (independent controller, source of the data) · the sending service for system e-mails to accounts such as confirmation and invitation (our own processing) · the chat and webhook services you choose (section 8 no. 2) · the operators of the audited pages · your servers and the collector installed there.

---

Annex 3: Technical and organizational measures (Art. 32 GDPR)

As of publication date. The measures describe the state implemented at the launch of the service zu prüfen: compare the operational measures (server access, backups, restore tests, environments) with production before publication.

Confidentiality

• Physical access control: data center of the hosting provider with its access and security measures (evidence of the provider); no server room of our own.
• System access control: application logins with password hash; platform administrators additionally with a second factor; API tokens and collector tokens stored as a hash only, plain text shown once; report passwords as a hash only (argon2id); rate limits against guessing passwords, tokens and report passwords; uniform error responses that do not reveal whether an account exists.
• Data access control: roles Owner, Admin, Member, Viewer and token scopes; connection to Search Console, AI settings, custom domains and log sources for Owner and Admin only; separation of tenants by binding every query to the organization, resources of others answer “not found”; queries of the log analysis are built exclusively from validated parameters, customers send no query language, and the tenant is enforced independently when writing and when reading; public reports show only what has been shared and run on an address of their own without the cookies of the app.
• Separation: separate networks for web services, database, crawlers and log store; the log store is reachable internally only; from the internal network the crawlers reach only the database and the queue.
• Pseudonymization and encryption: IP addresses in logs of the log analysis are pseudonymized on the customer’s server already (key changing daily that never leaves the server); customer secrets (access token of Search Console, headers and credentials of the audits, channel configurations) stored encrypted; transmission exclusively over TLS; backups encrypted; secrets are masked in logs and API.

Integrity

• Input control: results of the crawlers and delivered logs are validated (permitted fields, types, lengths, time window, deduplication) and limited in size; content of audited pages is never rendered unfiltered as HTML in the interface; answers of the AI providers are taken over as structure and text only; audit log for administrator access and for security-relevant actions of members with the acting account, two years.
• Transfer control: requests to customer targets run exclusively through the crawler, which blocks private, local and metadata addresses (also after redirects and name resolution), in containers of their own with egress rules; webhook targets are checked by the same rules; AI providers receive only audit findings, no Search Console data; public tools only output evaluated results; live events contain only identifiers and status.

Availability and resilience

• Encrypted backups OFFEN-23: retention of the local and the offsite backups; rate, quantity and size limits against overload; limit on concurrent audits per organization and per target; fixed time and size limits per request.

Procedures for regular review

• Security review per development phase (code review and tests of the separation of tenants, authentication, input validation, rate limits and the protection against fetching internal addresses); automated tests of the separation of tenants and of the limits; deletion concept with automatic retention runs (Annex 1.3); record under Art. 30(2) GDPR; commitment of employees to confidentiality zu prüfen: confirm confidentiality declarations of employees; control of sub-processors through contracts under Art. 28(4) GDPR.