Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (DPA) forms part of the Maverank Terms of Service. It applies when Maverank processes personal data on Customer's behalf in connection with the service (Customer Personal Data). Customer is the controller and Maverank is the processor, except where applicable data-protection law assigns a different role.

The subject matter is the provision of the AI-visibility platform. Processing lasts for the subscription term and the deletion period described in the Privacy Policy. Its nature and purpose are to host, analyse and report on Customer's projects, prompts, tracked domains, collaborators and reports; provide support; secure and improve the service; and comply with documented instructions and legal obligations.

• Data subjects: Customer's users, workspace members, client viewers and any individuals whose personal data Customer includes in project content or support requests.
• Data categories: account and contact details; authentication, usage and technical data; project content such as domains, prompts, competitor information, notes and reports; and support communications.

2. Customer instructions and responsibilities

Maverank will process Customer Personal Data only on Customer's documented instructions, including this DPA and the Customer's use of the service, unless law requires otherwise. If law requires processing, Maverank will inform Customer before doing so unless the law prohibits that notice. If Maverank reasonably believes an instruction infringes applicable data-protection law, it will notify Customer without undue delay and may suspend the affected processing until the issue is resolved.

Customer is responsible for the accuracy, quality and lawfulness of Customer Personal Data, for establishing a lawful basis for processing, and for providing any notices and obtaining any permissions needed to use the service. Customer will not instruct Maverank to process data in breach of applicable law.

3. Confidentiality and security

Maverank ensures that people authorised to process Customer Personal Data are subject to confidentiality obligations. Maverank will implement appropriate technical and organisational measures designed to protect Customer Personal Data, taking account of the nature, scope, context and purposes of processing and the risks to individuals' rights and freedoms.

Those measures include access controls, authentication, encryption in transit where supported, environment separation, backups and operational processes intended to preserve confidentiality, integrity, availability and resilience. No security measure eliminates all risk; Customer remains responsible for configuring access in its workspace and protecting its credentials and API keys.

4. Subprocessors

Customer gives Maverank general authorisation to use subprocessors to provide the service. Maverank will impose written data-protection obligations on a subprocessor that are substantially equivalent to those in this DPA and remains responsible for its subprocessor's performance of those obligations.

Current categories of subprocessors include infrastructure and object storage providers, payment processing, email delivery, AI platforms used to run Customer's tracked prompts, diagnostic and performance monitoring, bot prevention, analytics (where consented), and referral attribution (where enabled). The Privacy Policy identifies the principal providers. Maverank may add or replace subprocessors for legitimate operational reasons and will make the updated list available through the Privacy Policy or another reasonable notice channel.

Customer may object to a new subprocessor on reasonable data-protection grounds by writing to [email protected] within 14 days of notice. The parties will work in good faith on a reasonable solution. If none is available and the objection prevents Maverank from providing the affected service, Customer may terminate the affected service and receive a pro-rated refund of prepaid unused fees for that affected service.

5. International transfers

Maverank may process Customer Personal Data outside the EEA only where a valid transfer mechanism under applicable data-protection law is in place, including an adequacy decision, Standard Contractual Clauses, or another recognised safeguard. Customer authorises those transfers to the extent necessary to provide the service.

6. Assistance and incident notification

Taking account of the nature of processing, Maverank will provide reasonable assistance through the standard service and available information to help Customer respond to requests from data subjects, data-protection impact assessments, prior consultations and other obligations under Articles 32 to 36 of the GDPR. Maverank may charge reasonable fees for assistance requiring material work beyond the standard service, except to the extent the assistance is required because of Maverank's breach of this DPA.

Maverank will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data and will provide information reasonably available to Maverank to help Customer meet its notification obligations. Maverank does not make notifications to regulators or data subjects on Customer's behalf unless required by law.

7. Deletion, return and audits

At Customer's choice, Maverank will return or delete all Customer Personal Data after the services end and delete existing copies, unless applicable law requires storage. Customer may make that choice by contacting [email protected] before the deletion period in the Privacy Policy ends. Maverank may retain data only to the extent required by law, and may retain de-identified service data that no longer identifies Customer, its users or Customer Personal Data.

Once per 12-month period, Customer may request information reasonably necessary to demonstrate Maverank's compliance with this DPA. If that information is insufficient, Customer may conduct an audit during normal business hours on at least 30 days' written notice, no more than once annually, without unreasonable disruption and subject to reasonable confidentiality and security controls. Customer is responsible for its auditor's fees and expenses. Maverank will address any confirmed material non-compliance in accordance with this DPA.

8. Priority and liability

If this DPA conflicts with the Terms of Service as to processing Customer Personal Data, this DPA controls. The Terms of Service, including its limitations of liability, govern claims under this DPA to the maximum extent permitted by applicable law.

9. Contact

For data-processing questions or to exercise a right under this DPA, contact Volcanic Labs at [email protected]. Volcanic Labs is located at Plaza de Galicia, Local 7, 38612, Santa Cruz de Tenerife, Spain.