Data Processing Agreement

Version 2026-11-12.

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you, the customer, as controller, and DiverzityStudios s.r.o., Staré Grunty 3546/7A
841 04 Bratislava, IČO 57735271, as processor, under Article 28 of the GDPR. It applies whenever DiverzitySEO processes personal data contained in your website on your behalf.

1. Subject matter, nature and purpose

The processor processes the content of the customer’s website (pages, posts, titles, metadata, and, if connected, aggregated Search Console data) to provide DiverzitySEO: audits, suggested and applied fixes, generated articles and AI answer checks. Processing consists of receiving that content from the customer’s site, passing it to the AI sub-processor, returning the result, and keeping usage records and audit summaries.

2. Categories of data and data subjects

Personal data that happens to appear in website content, such as names of authors, staff, customers or other people mentioned, and their contact details if published. Data subjects are the people mentioned on or authoring the customer’s website. The service is not designed for special categories of data (Art. 9 GDPR); the customer should not publish such data where the plugin can read it.

3. Duration

For the term of the contract. Content is passed through for each task and not kept by the processor beyond the result and the audit summaries shown in the service, which are deleted within 90 days after the contract ends unless the law requires longer retention.

4. Processor obligations

The processor will:

1. process personal data only on the customer’s documented instructions, which are these terms and the customer’s use of the plugin, unless EU or Slovak law requires otherwise (in which case it informs the customer first, unless the law forbids that);
2. ensure that people authorised to process the data are bound to confidentiality;
3. take the security measures in section 6 (Art. 32 GDPR);
4. engage sub-processors only as described in section 5;
5. help the customer, as far as it reasonably can, to answer data subjects’ requests and to meet its obligations under Articles 32 to 36 GDPR;
6. notify the customer of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it, with the information available;
7. at the end of the contract, delete the personal data it holds for the customer, unless the law requires storage;
8. make available the information needed to demonstrate compliance with Article 28 and allow for reasonable audits, on at least 30 days’ notice, at the customer’s cost, no more than once a year unless a breach has occurred.

5. Sub-processors

The customer authorises the following sub-processors:

• Anthropic, PBC, USA: AI processing of website content. Under Anthropic’s commercial terms, API inputs and outputs are not used to train its models.
• WebSupport s.r.o., Slovakia: hosting of the control panel through which requests pass.

The processor imposes data protection obligations on each sub-processor equivalent to this DPA and remains responsible for them. It will announce any new or replaced sub-processor on this page and by e-mail at least 30 days in advance; the customer may object on reasonable grounds and, if no solution is found, end the contract and receive a refund of prepaid amounts for the remaining period.

6. Security measures

• All connections are encrypted (HTTPS/TLS).
• Site keys are stored only as cryptographic hashes; the Anthropic API key never leaves the control panel.
• Access to the control panel is limited to authorised staff with individual accounts.
• Per-site rate limits and the ability to pause a site immediately.
• Changes the plugin makes to a website are logged and reversible.
• Regular updates of the server software and the plugin.

7. International transfers

Transfers to Anthropic in the USA rely on the EU–US Data Privacy Framework where Anthropic is certified, or otherwise on the Standard Contractual Clauses (Commission Decision (EU) 2021/914), which are incorporated by reference.

8. Your own API key

If the customer runs the plugin with its own Anthropic API key (Lifetime licence), website content is sent from the customer’s site directly to Anthropic under the customer’s own agreement with Anthropic; the processor is not involved in that processing.

9. Precedence

If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.