1. Parties and scope
This Data Processing Agreement (“DPA”) forms part of the Terms of Service or other agreement (the “Agreement”) between the customer identified in the account or Order Form (“Customer”) and Fiftify Inc., 1111B S Governors Ave STE 23190, Dover, DE 19904, United States (“Fiftify”). It applies where Fiftify processes personal data on Customer’s behalf in providing the Askority Service, in particular personal data contained in connected analytics properties, in Customer Data and in the identities of Customer’s Authorised Users. Where Customer acts as a controller, Fiftify is the processor; where Customer acts as a processor for its own client, Fiftify is a subprocessor. “Data Protection Law” means the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the CCPA/CPRA and other applicable privacy laws; terms not defined here have the meaning given in those laws or in the Agreement.
2. Details of processing (Annex I)
Subject matter: provision of the Askority Service. Duration: the term of the Agreement plus the deletion period below. Nature and purpose: collection, storage, analysis and reporting of AI visibility, web analytics and site audit data on Customer’s instructions. Categories of data subjects: Customer’s Authorised Users; visitors to Customer’s websites whose pseudonymous analytics data is connected; individuals whose personal data appears in public web content or AI-generated responses that Fiftify processes as part of the Service. Categories of personal data: names and work emails of Authorised Users; pseudonymous identifiers, session, conversion and referral data; business contact data appearing in public content. No special categories of personal data are intended to be processed, and Customer must not intentionally provide special categories of personal data through the Service unless expressly agreed in writing by the parties.
3. Customer instructions
Fiftify processes personal data only on Customer’s documented instructions, which are the Agreement, this DPA, Customer’s configuration of the Service and any further written instructions agreed by the parties, unless required to do otherwise by law, in which case Fiftify will inform Customer before processing unless the law prohibits it. Fiftify will inform Customer if it believes an instruction infringes Data Protection Law. Customer is responsible for the lawfulness of the personal data it provides and connects, including notices and consents required for analytics data.
4. Confidentiality and personnel
Fiftify ensures that persons authorised to process personal data are bound by confidentiality obligations and receive appropriate data protection training, and limits access to personnel who need it to perform the Service.
5. Security measures (Annex II)
Fiftify implements appropriate technical and organisational measures, including: encryption of data in transit (TLS) and at rest; role-based access control with least privilege and multi-factor authentication for administrative access; logical segregation of Customer Data; logging and monitoring of access; regular backups with tested restoration; vulnerability management and patching; secure development practices and code review; incident response procedures; and vendor due diligence for subprocessors. Fiftify may update these measures provided the overall level of protection is not reduced.
6. Subprocessors (Annex III)
Customer authorises Fiftify to engage the subprocessors listed on the Subprocessors page at askority.com/legal/subprocessors, which forms Annex III to this DPA. Fiftify will give Customer at least 30 days’ notice by email before adding or replacing a subprocessor. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period. Fiftify imposes data protection obligations on subprocessors that are no less protective than this DPA and remains responsible for its subprocessors’ compliance with the applicable data protection obligations to the extent required by Data Protection Law.
7. Assistance to Customer
Taking into account the nature of the processing, Fiftify will assist Customer with appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights of access, rectification, erasure, restriction, objection and data portability, and in meeting Customer’s obligations regarding security of processing, notification of personal data breaches, data protection impact assessments and prior consultation with supervisory authorities. Fiftify will forward to Customer without undue delay any data subject request it receives that relates to Customer’s personal data, and will not respond except as instructed by Customer or required by law.
8. Personal data breach
Fiftify will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer’s personal data, and will use reasonable efforts to provide the initial notification as soon as practicable and, where feasible, within 24 hours. Fiftify will provide the information reasonably available to help Customer meet its own notification obligations, including the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences and the measures taken or proposed, and will supplement the notification as further information becomes available.
9. International transfers
Fiftify processes personal data in the United States and the European Union. Where Fiftify transfers personal data protected by the GDPR to a third country that is not recognised as providing an adequate level of protection, the parties rely on the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “SCCs”), completed with Annex I (section 2), Annex II (section 5) and Annex III (section 6) of this DPA and incorporated by reference. Module Two applies where Customer is a controller and Fiftify is a processor; Module Three applies where Customer is a processor and Fiftify is a subprocessor. Clause 7 (Docking Clause) applies, and Clause 9, Option 2 (general authorisation) applies, subject to the notice and objection procedure in section 6 of this DPA. The governing law and competent courts for the SCCs are determined in accordance with Clauses 17 and 18 of the SCCs.
For restricted transfers subject to the UK GDPR, the SCCs are supplemented by the UK International Data Transfer Addendum issued by the Information Commissioner. For transfers subject to the Swiss FADP, the SCCs apply with the adaptations required under the Swiss Federal Act on Data Protection. The parties will complete and maintain any transfer risk assessment, data protection test or supplementary measures required by applicable Data Protection Law.
10. Audits
Fiftify will make available the information necessary to demonstrate compliance with this DPA, including summaries of security assessments and, when available, third-party audit reports. Where that information is not sufficient, Customer may conduct an audit, no more than once a year unless required by a supervisory authority or following a breach, on 30 days’ notice, during business hours, in a manner that does not unreasonably disrupt Fiftify’s operations, and subject to confidentiality.
11. Return and deletion
At the end of the Service, Customer may export personal data during the 30-day read-only period. Within 90 days after that period Fiftify deletes personal data from active production systems, unless retention is required by law, and certifies deletion on request. Personal data may remain in encrypted backups until those backups are overwritten in accordance with Fiftify’s backup retention schedule, after which it is securely deleted.
12. US state privacy laws
To the extent the CCPA/CPRA or another US state privacy law applies, Fiftify acts as a service provider or contractor (or processor) and will comply with its obligations under those laws and provide the same level of privacy protection they require of service providers or contractors. Fiftify will not sell or share Customer’s personal data; will not retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes specified in the Agreement; and will not combine it with personal information received from another person or entity or collected from its own interaction with an individual, except as permitted by applicable law. Fiftify will notify Customer if it determines that it can no longer meet its obligations under applicable US privacy laws, and Customer may take reasonable steps to stop and remediate unauthorised use.
13. Liability and precedence
Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement, except where Data Protection Law does not permit such limits. In case of conflict, this DPA prevails over the Agreement regarding the processing of personal data, and the SCCs prevail over this DPA. This DPA lasts as long as Fiftify processes personal data on Customer’s behalf.
14. Contact
Data protection questions and notices: [email protected]
Fiftify Inc.
1111B S Governors Ave STE 23190, Dover, DE 19904, United States