Data Processing Agreement

In providing the Ranki service we process two distinct categories of personal data, and our role differs for each.

• ▸We act as controller for your account data, billing data, and platform usage data. That processing is governed by our Privacy Policy, not by this DPA.
• ▸We act as processor for personal data contained in the content we generate and publish on your instruction, and for the website visitor data captured by the Ranki tracking script on your site (form submissions and phone link clicks). This DPA governs that processing.

Where this DPA conflicts with the Terms of Use in respect of processing carried out on your behalf, this DPA prevails.

• ▸Subject matter: provision of automated SEO content generation, publishing, ranking analysis, and enquiry tracking through the Ranki platform.
• ▸Duration: for the term of your subscription, plus the retention periods set out in clause 10 of the Privacy Policy.
• ▸Nature of processing: collection, storage, structuring, generation, transmission to your connected platforms, analysis, retrieval, and deletion.
• ▸Purpose: delivering the service you have subscribed to, and no other purpose.

Data subjects: your personnel who use the platform, and visitors to your website who submit an enquiry form or click a tracked telephone link.

Categories of personal data:

• ▸Identifiers submitted through your website forms (typically name, email address, telephone number, and any free-text message content the visitor chooses to provide).
• ▸Technical data associated with a tracked enquiry: page URL, form type, timestamp, and the telephone number clicked.
• ▸Any personal data you choose to include in your content brief, brand configuration, or uploaded photo library.

We do not require, request, or intentionally process special categories of personal data as defined in Article 9 of the GDPR. You must not submit special category data through the content brief or photo library. Any personal data appearing in generated content is derived from the inputs you supply, not independently collected by us.

• ▸We process personal data only on your documented instructions, including with regard to international transfers, unless required to do otherwise by Australian law. Where such a legal requirement applies, we will inform you before processing unless the law prohibits it.
• ▸We ensure that personnel authorised to process personal data are bound by confidentiality obligations.
• ▸We implement the technical and organisational measures described in clause 8 of the Privacy Policy, including encryption in transit and at rest, role-based access control, and least-privilege access.
• ▸We assist you, taking into account the nature of processing, in responding to requests from data subjects exercising their rights.
• ▸We assist you in meeting your obligations in relation to security, breach notification, data protection impact assessments, and prior consultation with a supervisory authority.
• ▸At your choice, we delete or return all personal data at the end of the provision of services, and delete existing copies unless a legal retention obligation applies.
• ▸We make available the information necessary to demonstrate compliance with these obligations and allow for audits as set out in clause 7.

If we form the view that an instruction from you infringes applicable data protection law, we will tell you promptly and may suspend the affected processing until the instruction is withdrawn or confirmed.

You give general written authorisation for us to engage sub-processors. The current list is maintained in clause 5 of the Privacy Policy, which describes each sub-processor by function, location, and the data shared with it. A named list is available on request at privacy@ranki.com.au.

Each sub-processor is bound by written terms imposing data protection obligations no less protective than those in this DPA. We remain fully liable to you for the performance of each sub-processor’s obligations.

We will give you at least 30 days’ notice by email before adding or replacing a sub-processor that processes personal data on your behalf. If you reasonably object on data protection grounds within that period, we will work with you in good faith to find an alternative. If none is available, you may terminate the affected part of the service without penalty and receive a pro-rata refund of prepaid fees.

Personal data processed under this DPA is stored and processed in Australia and the United States. Where you are established in the EU, EEA, or UK, transfers are made under the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), which are incorporated into this DPA by reference and completed as follows: the data exporter is you, the data importer is Theme Press Pty Ltd, the governing law is that of Ireland, the forum is the courts of Ireland, and Annexes I, II, and III are populated by clauses 2, 3, 4, and 5 of this DPA together with clauses 5 and 8 of the Privacy Policy.

For transfers subject to UK law, the UK International Data Transfer Addendum to the Standard Contractual Clauses applies, with Tables 1 to 4 completed by reference to the same clauses. For transfers subject to Swiss law, references to the GDPR are read as references to the Swiss Federal Act on Data Protection and the competent authority is the Federal Data Protection and Information Commissioner.

On written request, and no more than once in any twelve month period unless required by a supervisory authority or following a personal data breach, we will provide the information reasonably necessary to demonstrate compliance with this DPA. This includes a description of our security measures, our sub-processor list, and responses to a reasonable security questionnaire.

Where that information is not sufficient, you may request an audit. Audits must be conducted during business hours, with at least 30 days’ written notice, in a manner that does not disrupt our operations or compromise the confidentiality of other customers’ data, and at your cost. We may require the auditor to sign a confidentiality undertaking.

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and we aim to do so within 72 hours. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information. Where we cannot provide all of that at once, we will provide it in phases without undue delay.

Notifying the relevant supervisory authority and affected data subjects, where the law requires it of you as controller, remains your responsibility. We will provide reasonable assistance.

If we receive a request from a data subject relating to personal data we process on your behalf, we will not respond to it directly except to acknowledge receipt and to direct the individual to you, unless you have instructed us otherwise or the law requires us to respond. We will forward the request to you without undue delay.

Enquiry and call tracking data captured on your website is available to you in the Ranki dashboard at any time, so you can action access, correction, and deletion requests yourself. Where you need our help to locate, export, or delete specific records, email privacy@ranki.com.au and we will assist at no charge.

• ▸You are responsible for establishing a lawful basis for the collection of personal data through your website, including any consent required for the Ranki tracking script under the ePrivacy Directive or equivalent law.
• ▸You must maintain a privacy notice on your website that discloses the collection of enquiry and call tracking data and identifies Ranki as a processor.
• ▸You must ensure your instructions to us, including your content brief and brand configuration, comply with applicable data protection law.
• ▸You must not submit special category data, payment card data, government identifiers, or health information to the platform.

You may export your data at any time from the Ranki dashboard. On termination, you may request full deletion or a complete export by emailing privacy@ranki.com.au within 30 days of your cancellation date. After that period we delete personal data in accordance with the retention schedule in clause 10 of the Privacy Policy, except where a legal retention obligation requires us to keep it, in which case we isolate it and cease all other processing.

Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Use, except where those limitations are not permitted by applicable data protection law.

This DPA is governed by the laws of New South Wales, Australia, except that clause 6 and the Standard Contractual Clauses incorporated by it are governed by the law specified in those clauses. Nothing in this clause deprives a data subject of the protection of mandatory law in their country of residence.

For any matter arising under this DPA, including sub-processor objections, audit requests, and breach notifications: