Subject and roles
This agreement governs the processing, by SEOLOK ("processor"), of data about visitors of the site of the customer using SEOLOK ("controller") and forms part of the Terms of Use.
Data processed
Browser notification subscriptions collected through the WordPress plugin only with the visitor's explicit permission (push endpoint, encryption keys, browser info) and aggregated Boost campaign performance data. Search Console and Core Web Vitals data are aggregated/anonymous.
Instructions
SEOLOK processes the data only on the customer's instructions given through the dashboard and to provide the service; never for its own purposes and never sold.
Security
Data is stored in the EU (Germany) over encrypted connections; access is restricted; secrets are encrypted with AES-256-GCM; staff are bound by confidentiality.
Sub-processors
The customer gives general authorisation for the sub-processors needed for the service (hosting, e-mail, AI, payments and service providers for Boost campaigns). New sub-processors are announced by e-mail beforehand; the customer may object on reasonable grounds.
Assistance and breach notification
SEOLOK assists the customer with data subject requests and notifies the customer without undue delay, at the latest within 72 hours, of a personal data breach.
End of contract
When the service ends, visitor data is deleted or returned by export at the customer's request, except records under a statutory retention duty.
International transfers
International transfers are made only with safeguards compliant with KVKK art. 9 and the GDPR (standard contracts).