[ LEGAL ]

Data Processing Addendum

Last updated: June 18, 2026

This Data Processing Addendum ("DPA") forms part of, and supplements, our Terms of Service and Privacy Policy. It applies where CommandSEO processes personal data on your behalf and you are subject to the EU/UK GDPR or a comparable law. By using the service, you agree to this DPA.

1. Roles

For data you bring into the service (your account, your sites, and the Google data you connect), you are the Controller and CommandSEO is the Processor. CommandSEO is operated by Dick-Jay Bustamante, a sole proprietor based in Antipolo City, Philippines.

2. Processing details

Subject matter & duration — processing for as long as your account is active, then deletion per Section 8.
Purpose — to provide the service: analyze your sites, generate SEO plans, and verify pages, on your instructions.
Data subjects — you and your team, and end users of your sites whose data appears in connected Google Search Console / Analytics.
Data categories — account details; site content and analysis; Search Console / Analytics metrics you connect; usage data. We do not require special-category data.

3. Our instructions

We process personal data only on your documented instructions (including via the product and these terms), except where law requires otherwise. We will tell you if we believe an instruction breaches data-protection law.

4. Confidentiality

Anyone we authorize to process your personal data is bound by confidentiality and only accesses data as needed to provide or support the service.

5. Security

We apply appropriate technical and organizational measures, including:

Encryption in transit (TLS) and OAuth tokens encrypted at rest (AES-256-GCM).
Per-tenant isolation so accounts cannot access each other's data.
Per-user authentication and hashed passwords.
EU hosting with regular backups.

6. Sub-processors

You authorize us to use the sub-processors listed at commandseo.app/sub-processors, each bound to data-protection obligations consistent with this DPA. We'll update that list before adding or replacing a sub-processor; customers under this DPA can request advance notice by emailing support@commandseo.app.

7. Data subject rights & breach notice

We'll help you respond to data-subject requests (access, correction, deletion, etc.) — including tools to export or delete data.
We'll notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you need to meet your own obligations.

8. Deletion & return

On account closure or your request, we delete the personal data we hold for you within 30 days (backups cycle out shortly after), except where law requires retention. You can export your data before closing your account. You can also disconnect a Google connection or revoke access at Google at any time.

9. International transfers

Primary data is hosted in the EU. Where a sub-processor processes data outside the EU, we rely on an appropriate transfer mechanism (such as the EU-US Data Privacy Framework or Standard Contractual Clauses), as noted on the sub-processors page.

10. Audits

On reasonable written request (and no more than once a year, unless required by a regulator), we'll provide the information needed to demonstrate compliance with this DPA.

11. Liability & governing law

Liability under this DPA is subject to the limitations in our Terms of Service. This DPA is governed by the same law and jurisdiction as those Terms.

12. Contact

Data-protection questions or requests: support@commandseo.app.