Effective date: 9 August 2026

This Data Processing Agreement (“DPA“) forms part of the agreement between:

Customer

The individual or legal entity purchasing or using RankBIT Services and acting as controller or processor in relation to Customer Personal Data (“Customer“);

and

Processor

RankBIT / BRAHMABIT SRL
VAT / CUI: RO39662046
Email: office@brahmabit.ro
Website: rankbit.ai

(“RankBIT” or “Processor“).

Together referred to as the “Parties“.

1. PURPOSE

This DPA governs the processing of personal data by RankBIT on behalf of Customer in connection with the RankBIT Services.

The DPA is intended to satisfy applicable requirements including Article 28 GDPR.

Article 28 requires processing performed on behalf of a controller to be governed by a binding contract establishing, among other things, the subject matter, duration, nature and purpose of processing, types of personal data, categories of data subjects and respective obligations. (EUR-Lex)

2. DEFINITIONS

For this DPA:

“Applicable Data Protection Law” means GDPR and other data-protection laws applicable to the Processing.

“Controller”, “Processor“, “Data Subject“, “Personal Data“, “Personal Data Breach“, “Processing” and “Supervisory Authority” have the meanings assigned under GDPR where GDPR applies.

“Customer Personal Data” means Personal Data processed by RankBIT on behalf of Customer in connection with the Services.

“Services” means the RankBIT services purchased or activated by Customer.

“Subprocessor” means a processor engaged by RankBIT to process Customer Personal Data on behalf of Customer.

3. ROLES OF THE PARTIES

Where Customer determines the purposes and means of Processing Customer Personal Data:

• Customer is the Controller;
• RankBIT is the Processor.

Where Customer itself acts as processor for another controller:

• Customer is the Processor;
• RankBIT acts as Customer’s Subprocessor.

The EDPB’s controller/processor guidance emphasizes that these roles depend upon the parties’ actual functions concerning purposes and means of processing. (European Data Protection Board)

4. RANKBIT AS INDEPENDENT CONTROLLER

This DPA does not apply to Personal Data for which BRAHMABIT SRL independently determines the purposes and means of processing.

This may include information processed for:

• Account administration;
• billing;
• tax;
• financial records;
• RankBIT security;
• fraud prevention;
• contractual administration;
• RankBIT’s own legal compliance.

Such data is governed by RankBIT’s Privacy Policy.

5. CUSTOMER INSTRUCTIONS

RankBIT shall process Customer Personal Data only on documented instructions from Customer unless processing is required by applicable Union or Member State law.

Article 28 specifically requires processors to process personal data only on documented controller instructions, including instructions concerning international transfers, unless otherwise required by law. (EUR-Lex)

The Agreement, this DPA, configuration of the Services and Customer’s use of the Platform constitute documented instructions.

Additional instructions must be:

• lawful;
• documented;
• reasonably related to the Services.

6. UNLAWFUL INSTRUCTIONS

If RankBIT reasonably considers that a Customer instruction infringes Applicable Data Protection Law, RankBIT may inform Customer and may suspend execution of that instruction until the matter has been clarified.

7. DETAILS OF PROCESSING

The details of Processing are described in Annex I.

They include:

• subject matter;
• nature;
• purpose;
• duration;
• categories of Personal Data;
• categories of Data Subjects.

8. CONFIDENTIALITY

RankBIT shall ensure that persons authorized to process Customer Personal Data:

• are subject to appropriate confidentiality obligations;
• receive access only where reasonably necessary;
• process Customer Personal Data only as authorized.

Article 28 expressly requires persons authorized to process Personal Data to have committed themselves to confidentiality or be subject to an appropriate statutory confidentiality obligation. (EUR-Lex)

9. SECURITY

RankBIT shall implement appropriate technical and organizational measures designed to protect Customer Personal Data against:

• accidental destruction;
• unlawful destruction;
• loss;
• unauthorized alteration;
• unauthorized disclosure;
• unauthorized access.

GDPR Article 32 requires a level of security appropriate to risk and identifies measures such as encryption or pseudonymization where appropriate, confidentiality/integrity/availability/resilience, restoration capabilities and regular testing. (EUR-Lex)

Additional security measures are described in Annex II.

10. SECURITY MANAGEMENT

RankBIT may maintain measures including, as appropriate:

• access controls;
• least-privilege permissions;
• authentication controls;
• encryption in transit;
• encryption at rest where appropriate;
• password protection;
• system logging;
• infrastructure monitoring;
• secure backups;
• vulnerability management;
• patch management;
• incident response;
• network protection;
• confidentiality obligations.

Security measures may evolve as technology and risk change.

RankBIT may replace measures with materially equivalent or stronger measures during the Agreement.

11. CUSTOMER SECURITY RESPONSIBILITIES

Customer remains responsible for:

• controlling Customer users;
• managing access to Customer Accounts;
• protecting passwords;
• securing Customer devices;
• using appropriate Account permissions;
• disabling former employees or contractors;
• configuring RankBIT appropriately;
• ensuring Customer Personal Data is lawfully collected.

Customer should not provide RankBIT with Personal Data unnecessary for the Services.

12. SPECIAL CATEGORY DATA

RankBIT is not intended by default for storing large volumes of:

• health information;
• biometric data;
• genetic data;
• sexual-life information;
• religious information;
• political-opinion information;
• other special-category Personal Data.

Customer shall not intentionally provide special-category Personal Data unless:

1. it is necessary for an agreed Service;
2. Customer has an appropriate lawful basis;
3. RankBIT has agreed to the relevant processing where necessary;
4. appropriate safeguards are implemented.

13. CRIMINAL-OFFENCE DATA

Customer shall not intentionally submit Personal Data relating to criminal convictions or offences unless the Processing has been specifically agreed and is lawful.

14. SUBPROCESSORS

Customer provides general written authorization for RankBIT to engage Subprocessors where necessary to provide the Services.

Article 28 permits general written authorization provided the processor informs the controller about intended additions or replacements and gives the controller an opportunity to object. (EUR-Lex)

15. SUBPROCESSOR LIST

RankBIT will maintain a current list of material Subprocessors at:

[SUBPROCESSOR URL]

or make the list available on request.

The list may specify:

• Subprocessor;
• service/function;
• processing location;
• relevant processing purpose.

16. NEW SUBPROCESSORS

RankBIT may provide notice of a new or replacement material Subprocessor by:

• email;
• Platform notice;
• Subprocessor webpage;
• another reasonable electronic mechanism.

Customer may submit a reasonable data-protection objection within 30 days of notification.

17. OBJECTION TO SUBPROCESSOR

An objection must be based on legitimate data-protection grounds.

The Parties will attempt in good faith to resolve the objection.

Possible solutions may include:

• changing configuration;
• avoiding the relevant Subprocessor where commercially and technically feasible;
• adopting additional safeguards.

If no reasonable solution is available, either Party may terminate the affected portion of the Services in accordance with the Agreement.

18. SUBPROCESSOR OBLIGATIONS

RankBIT shall impose data-protection obligations on Subprocessors that are no less protective in substance than the relevant obligations required under Article 28 for the Processing delegated to that Subprocessor.

If a Subprocessor fails to fulfil its applicable data-protection obligations, RankBIT remains responsible to Customer for performance of the Subprocessor’s applicable obligations to the extent provided by law and contract.

EDPB guidance has emphasized the importance of processor oversight over subprocessor chains. (European Data Protection Board)

19. DATA SUBJECT REQUESTS

Taking into account the nature of the Processing, RankBIT shall reasonably assist Customer through appropriate technical and organizational measures with responding to requests concerning:

• access;
• rectification;
• erasure;
• restriction;
• portability;
• objection;
• other applicable Data Subject rights.

Article 28 specifically requires processors to assist controllers with fulfillment of Data Subject rights insofar as possible given the nature of processing. (EUR-Lex)

20. REQUESTS RECEIVED DIRECTLY BY RANKBIT

If RankBIT receives a Data Subject request relating specifically to Customer Personal Data, RankBIT may direct the individual to Customer unless RankBIT is legally required to respond directly.

Where appropriate, RankBIT will notify Customer of the request.

21. PERSONAL DATA BREACH

RankBIT shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

This reflects the processor notification requirement under Article 33(2) GDPR. (EUR-Lex)

22. BREACH INFORMATION

To the extent reasonably available, RankBIT’s notification may include:

• nature of the incident;
• affected systems;
• categories of affected information;
• approximate number of affected records, where known;
• approximate categories or number of Data Subjects, where known;
• likely consequences;
• containment actions;
• remediation actions;
• relevant contact information.

Information may be provided in phases where not immediately available.

23. REGULATORY NOTIFICATION

Customer remains responsible for determining whether notification must be made to:

• a Supervisory Authority;
• affected Data Subjects;
• another third party;

unless Applicable Data Protection Law assigns the responsibility otherwise.

Under GDPR, a Controller may have up to 72 hours from awareness to notify the competent supervisory authority where the statutory notification threshold is met. (EUR-Lex)

24. ASSISTANCE WITH GDPR COMPLIANCE

Taking into account the nature of Processing and information available to RankBIT, RankBIT shall provide reasonable assistance concerning applicable obligations relating to:

• security;
• Personal Data Breaches;
• Data Protection Impact Assessments;
• prior consultation with supervisory authorities.

These assistance obligations are among those expressly contemplated by Article 28 GDPR. (EUR-Lex)

25. DATA PROTECTION IMPACT ASSESSMENTS

Where Customer reasonably determines that a DPIA concerning use of RankBIT is legally required, RankBIT shall provide information reasonably available to it concerning the Processing and security measures.

Customer remains responsible for performing its own DPIA as Controller.

26. REGULATORY COOPERATION

RankBIT will cooperate with competent Supervisory Authorities where legally required in relation to Processing governed by this DPA.

27. AUDITS

RankBIT shall make available information reasonably necessary to demonstrate compliance with its Article 28 obligations.

Where reasonably necessary and legally required, Customer may conduct or commission an appropriate audit concerning the Processing.

28. AUDIT CONDITIONS

Except following a significant Personal Data Breach or where a Supervisory Authority requires otherwise, audits should:

• occur no more than once annually;
• be requested with reasonable advance notice;
• occur during normal business hours;
• avoid unreasonable disruption;
• protect the confidentiality of other customers;
• be subject to appropriate security and confidentiality restrictions.

RankBIT may satisfy reasonable audit requests through relevant existing security documentation where appropriate.

29. AUDIT COSTS

Each Party generally bears its own audit-related costs.

Where Customer requests an unusually extensive audit beyond standard compliance assistance, RankBIT may charge reasonable costs if agreed in advance.

30. INTERNATIONAL TRANSFERS

RankBIT shall not knowingly transfer Customer Personal Data to a third country except in accordance with Applicable Data Protection Law and Customer instructions represented by the Services and this DPA.

GDPR Chapter V requires applicable safeguards for international transfers. (EUR-Lex)

31. ADEQUACY DECISIONS

Where Personal Data is transferred to a jurisdiction covered by an applicable European Commission adequacy decision, that adequacy decision may constitute the applicable transfer mechanism.

32. STANDARD CONTRACTUAL CLAUSES

Where Customer Personal Data subject to GDPR is transferred to a recipient in a third country without an applicable adequacy decision and Standard Contractual Clauses are appropriate, the Parties agree that the applicable module of the European Commission Standard Contractual Clauses adopted under Decision (EU) 2021/914 may apply. (EUR-Lex)

Depending upon the Parties’ roles, this may include:

• Module Two: Controller to Processor;
• Module Three: Processor to Processor.

33. TRANSFER SAFEGUARDS

Where required, RankBIT may implement supplementary technical, contractual or organizational safeguards appropriate to the transfer.

34. DATA LOCATION

RankBIT may utilize infrastructure located in:

• the European Economic Area;
• jurisdictions with an adequacy decision;
• other jurisdictions subject to appropriate safeguards.

Specific material Subprocessor locations should be disclosed through the Subprocessor list.

35. DATA RETURN

Following expiration or termination of the Services, Customer may export Customer Personal Data where export functionality is available.

36. DELETION

Upon termination or expiry of the Services, RankBIT shall, subject to applicable legal obligations:

• delete Customer Personal Data; or
• return Customer Personal Data and subsequently delete remaining copies,

as applicable to the Services and Customer instructions.

Article 28 requires the processor, at the Controller’s choice, to delete or return Personal Data after the end of the provision of processing services unless applicable law requires continued storage.

37. BACKUPS AFTER TERMINATION

Customer Personal Data may remain in protected backups for a limited period after deletion from live systems.

Such backup information will remain protected and will not ordinarily be processed except for:

• restoration;
• disaster recovery;
• security;
• legally required purposes.

It will be deleted through normal backup rotation.

38. LEGAL RETENTION

RankBIT may retain information where required by applicable law.

Where Customer Personal Data must be retained due to such a legal obligation, RankBIT will continue protecting that data and will limit Processing to the legally required purpose.

39. CUSTOMER OBLIGATIONS

Customer represents and warrants that:

• it has authority to provide Customer Personal Data to RankBIT;
• its Processing instructions are lawful;
• Customer Personal Data has been collected lawfully;
• appropriate notices have been provided;
• necessary consents have been obtained where applicable;
• RankBIT’s Processing in accordance with Customer instructions does not violate Applicable Data Protection Law.

40. DATA MINIMIZATION

Customer shall make reasonable efforts to ensure that Customer Personal Data provided to RankBIT is:

• adequate;
• relevant;
• limited to what is necessary for the intended Processing.

41. ACCURACY

Customer is responsible for the accuracy of Customer Personal Data provided to RankBIT.

RankBIT will provide functionality or reasonable assistance for correction where relevant to the Services.

42. GOVERNMENT REQUESTS

If RankBIT receives a legally binding request from a public authority concerning Customer Personal Data, RankBIT may:

• assess the request;
• challenge it where appropriate and legally available;
• disclose only information legally required;
• notify Customer where legally permitted.

43. LIABILITY

Liability arising under this DPA is subject to the liability provisions contained in the underlying RankBIT Agreement or Terms and Conditions, except to the extent Applicable Data Protection Law requires otherwise.

44. PRECEDENCE

If there is a conflict involving protection of Customer Personal Data:

1. applicable mandatory data-protection law;
2. applicable Standard Contractual Clauses;
3. this DPA;
4. the main Services Agreement or Terms;

shall apply in that order to the extent of the relevant conflict.

45. DURATION

This DPA becomes effective when RankBIT begins Processing Customer Personal Data and continues for as long as RankBIT processes Customer Personal Data on behalf of Customer.

Provisions that by their nature survive termination will remain applicable.

46. GOVERNING LAW

Unless mandatory data-protection law or applicable Standard Contractual Clauses require otherwise, this DPA is governed by the governing-law provisions of the underlying RankBIT Agreement.

ANNEX I

DETAILS OF PROCESSING

A. Subject Matter

Provision of RankBIT’s AI visibility, website analysis, optimization, monitoring, analytics, reporting and related Services.

B. Duration

For the duration of the Customer’s use of the Services plus applicable deletion, backup and legal-retention periods.

C. Nature of Processing

Processing may include:

• collection;
• receipt;
• transmission;
• storage;
• organization;
• retrieval;
• analysis;
• scanning;
• comparison;
• structuring;
• hosting;
• generation;
• modification;
• deletion;
• reporting;
• integration processing.

D. Purpose

Processing Customer Personal Data where necessary to:

• operate RankBIT;
• analyze connected websites;
• provide reports;
• perform scans;
• provide AI visibility monitoring;
• provide technical analysis;
• support integrations;
• implement Customer-requested optimization;
• provide support;
• secure the Services.

E. Categories of Data Subjects

Depending on Customer configuration:

• Customer personnel;
• Customer administrators;
• Customer employees;
• Customer contractors;
• Customer website users;
• Customer contacts;
• business representatives;
• Customer end customers where information is inadvertently or necessarily contained in connected data.

RankBIT does not require Customer to upload unrelated customer databases merely to provide standard AI visibility monitoring.

F. Categories of Personal Data

Potential categories include:

• name;
• business contact information;
• email;
• phone;
• IP address;
• Account identifiers;
• user IDs;
• website information;
• technical identifiers;
• business-profile information;
• publicly available contact information;
• user-generated content;
• integration data;
• technical logs.

G. Special Categories

No special-category Personal Data is intended for standard Processing.

H. Frequency

Continuous, periodic, recurring or on-demand depending on Customer configuration and Subscription.

ANNEX II

TECHNICAL AND ORGANIZATIONAL MEASURES

RankBIT will maintain measures appropriate to the applicable risk.

These may include the following.

1. Access control

• individual user Accounts;
• authorization controls;
• role-based access;
• least-privilege principles;
• Account lifecycle management.

2. Authentication

• password security controls;
• strong password requirements where applicable;
• multi-factor authentication where supported or appropriate;
• restricted administrative access.

3. Encryption

• TLS/HTTPS for supported data in transit;
• encryption of appropriate sensitive data at rest;
• secure storage of credentials and tokens.

4. Infrastructure security

• firewall controls;
• secured cloud/server environments;
• restricted administrative interfaces;
• infrastructure monitoring.

5. Application security

• secure development practices;
• dependency updates;
• vulnerability remediation;
• code review where appropriate;
• environment separation where appropriate.

6. Data minimization

• collection limited to necessary information;
• access limited according to role;
• avoidance of unnecessary sensitive data.

7. Logging

Appropriate logging may cover:

• authentication;
• administrative operations;
• errors;
• security events;
• system activity.

8. Backup and recovery

Where applicable:

• scheduled backups;
• protected backup storage;
• restoration procedures;
• recovery testing.

9. Availability

Measures designed to support:

• redundancy where appropriate;
• restoration;
• monitoring;
• incident handling.

10. Incident management

RankBIT maintains procedures designed to:

• identify;
• investigate;
• contain;
• remediate;
• document;

relevant security incidents.

11. Personnel

Persons with access to Customer Personal Data are subject to appropriate:

• confidentiality;
• authorization;
• access restrictions.

12. Vendor management

Material providers processing Customer Personal Data may be subject to:

• security assessment;
• contractual privacy obligations;
• appropriate data-processing agreements;
• international transfer safeguards where applicable.

ANNEX III

APPROVED SUBPROCESSORS

I recommend maintaining this as a separate live webpage, rather than hardcoding it permanently inside the DPA.

Use this format: