Data Processing Addendum

1. Definitions

• Customer / Controller: The entity that subscribes to AIClicks services and determines the purposes and means of processing personal data.
• AIClicks / Processor: The entity that processes personal data on behalf of the Controller in connection with the services.
• Personal Data: Any information relating to an identified or identifiable natural person, as defined under GDPR Article 4(1) or equivalent applicable law.
• Processing: Any operation performed on personal data, including collection, storage, retrieval, use, disclosure, and deletion, as defined under GDPR Article 4(2).
• Sub-processor: Any third party engaged by AIClicks to process personal data on behalf of the Controller.

2. Subject Matter and Duration

This DPA applies to AIClicks' processing of personal data in the course of providing URL intelligence services: website security scanning, monitoring and alerting, domain management, and associated reporting. This DPA takes effect on the date the Customer's service agreement (including an order form referencing this DPA) becomes effective, and remains in effect for the duration of the services plus the data retention periods described in our Privacy Policy.

3. Nature and Purpose of Processing

AIClicks processes personal data solely for the following purposes: (a) executing customer-requested website scans and generating reports; (b) operating continuous domain monitoring and delivering alerts; (c) authenticating users and enforcing scan quotas; (d) sending transactional communications; (e) preventing abuse and ensuring platform security. Processing occurs on AIClicks' hosted infrastructure (VPS) and involves automated analysis of publicly accessible website content plus customer-provided account data.

4. Types of Personal Data

• Account identifiers: Email address, hashed password, signup date, plan tier.
• Scan inputs: URLs submitted by the Customer (which may embed personal data in query parameters).
• Technical data: Browser and device type, approximate country, session duration, hashed IP addresses (SHA-256; raw IPs are never stored).
• Payment metadata: Stripe customer ID and subscription status (no card numbers).
• Data subjects: The Customer's authorized users and, incidentally, individuals whose publicly accessible website content is scanned at the Customer's request.

5. Obligations of the Processor

• Process personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by law — in which case AIClicks will inform the Controller before processing unless prohibited.
• Ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Not sell, share for cross-context behavioral advertising, or use personal data for AIClicks' own independent purposes.
• At the Controller's direction, delete or return all personal data to the Controller after the end of the provision of services, and delete existing copies unless retention is required by law.
• Maintain records of processing activities as required by GDPR Article 30(2).

6. Sub-processors

AIClicks engages the following categories of sub-processors: (a) infrastructure hosting provider (compute and storage); (b) Stripe, Inc. for payment processing (PCI DSS Level 1); (c) Google Analytics 4 with IP anonymisation for product analytics; (d) transactional email provider for account notifications. AIClicks will inform the Controller of any intended changes to sub-processors at least 14 days in advance, giving the Controller the opportunity to object on reasonable grounds. Each sub-processor is bound by data protection obligations no less protective than those in this DPA.

7. Data Subject Rights Assistance

Taking into account the nature of the processing, AIClicks will assist the Controller by appropriate technical and organizational measures, insofar as possible, in fulfilling the Controller's obligations to respond to data subject requests (access, rectification, erasure, portability, objection). Data subjects may contact [email protected]; AIClicks will forward any Controller-directed requests received directly and respond within 30 days.

8. Security Measures

• Encryption of data in transit (TLS 1.3) and at rest on production storage.
• Passwords hashed with bcrypt; IP addresses hashed (SHA-256) before storage.
• Restricted production access with authentication and audit logging.
• Regular dependency patching and vulnerability monitoring.
• Backups with tested restore procedures; retention windows per our Privacy Policy (24 hours for anonymous scans, 7 days free, 90 days Pro, up to 12 months configurable for enterprise).

9. Personal Data Breach Notification

AIClicks will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Controller's data. The notification will describe the nature of the breach, the categories and approximate number of data subjects concerned, likely consequences, and measures taken or proposed to address the breach. AIClicks will cooperate with the Controller in meeting the Controller's own notification obligations to supervisory authorities and data subjects.

10. Audits

AIClicks will make available to the Controller all information necessary to demonstrate compliance with this DPA. Enterprise customers may, upon 30 days' written notice and no more than once per 12-month period, conduct (or engage an independent auditor under confidentiality to conduct) an audit of AIClicks' relevant processing operations, during normal business hours and without unreasonably disrupting operations.

11. International Transfers

Personal data is processed on infrastructure located in the EU/EEA. Where a sub-processor transfers data outside the EEA, AIClicks relies on an adequacy decision or Standard Contractual Clauses (2021/914) with supplementary measures as needed. A list of transfer mechanisms is available on request at [email protected].

12. Liability

Each party's liability arising out of or related to this DPA is subject to the limitation of liability provisions of the underlying service agreement. Nothing in this DPA limits liability where prohibited by applicable data protection law. The aggregate liability cap in the service agreement applies to claims under this DPA.

13. Term and Termination

This DPA terminates upon termination or expiry of the service agreement. Within 30 days of termination, AIClicks will delete or return all personal data processed under this DPA, except where retention is required by law. Sections 5, 8, 9, 10, and 12 survive termination for as long as AIClicks retains any personal data of the Controller.

14. Contact

For DPA execution requests, data protection enquiries, or sub-processor information: [email protected]