Data Processing Addendum (DPA)

1. Roles of the Parties

Fastrank acts as a Data Processor, while the customer acts as a Data Controller. The Controller defines the purpose and means of processing; Fastrank processes data only on documented instructions.

2. Scope of Processing

Personal data processed may include:

• Store URLs and performance metrics
• Business contact details
• Technical logs and analytics
• Support and communication history

Processing is strictly limited to audit delivery, optimization services, reporting, and support.

3. Security Measures

Fastrank applies industry-standard technical and organizational measures including:

• Encryption of data in transit and at rest
• Strict access controls
• Routine security audits
• Data minimization and retention controls

4. Subprocessors

Fastrank may engage subprocessors such as:

• Stripe (billing and payments)
• Cloud service providers (DigitalOcean / similar)
• Crisp (customer messaging)
• Analytics and audit tooling partners

All subprocessors operate under GDPR-compliant agreements.

5. Data Subject Rights

Fastrank supports the Controller in fulfilling obligations regarding:

• Access and export of data
• Rectification and updates
• Deletion and restriction requests
• Data portability

6. Data Breach Notification

In case of a confirmed breach affecting customer data, Fastrank will notify the Controller without undue delay and provide actionable information for compliance and remediation.

7. International Data Transfers

Data may be transferred to the United States under approved mechanisms including Standard Contractual Clauses (SCCs).

8. Return or Deletion of Data

Upon contract termination, Fastrank will delete or return all processed personal data unless legal obligations require retention.

9. Contact Information