Data Processing Agreement

Version 1.0 · last updated: 12 August 2026

This is a translation. In case of any discrepancy, the Danish version prevails.

This data processing agreement (the "Agreement") is entered into between you as the customer (the "controller") and AddonNordic ApS, company no. 46495985, Aalborg, Denmark (the "processor"), and forms an integral part of the terms of use for Geoa.

The Agreement applies automatically from the moment you start using Geoa. You do not need to request it. If you need a signed copy for your own records, email hello@geoa.app.

1. Subject matter and duration

The processor processes personal data on behalf of the controller to the extent necessary to deliver Geoa: measuring visibility in search and AI services, generating content, monitoring and reporting. Processing continues for the duration of the customer relationship and ends as described in section 9.

2. Nature, purpose and scope of processing

The nature and purpose are described in Annex A. The processor does not process personal data for its own purposes and does not sell it.

Personal data is not used to train general AI models. The processor uses third-party AI models to deliver the service; the providers are listed in Annex B.

3. Instructions

The processor processes personal data only on documented instructions from the controller, including with regard to transfers to third countries. The Agreement, the terms and the controller's use of the service's features together constitute those instructions. If the processor considers an instruction to infringe data protection law, it will inform the controller immediately.

4. Confidentiality

The processor ensures that persons authorised to process the personal data are bound by confidentiality, and that access is limited to those who need it to deliver the service.

5. Security

The processor implements appropriate technical and organisational measures under Article 32. The measures are described in Annex C.

6. Subprocessors

The controller hereby gives general prior authorisation to the subprocessors listed in Annex B. The processor imposes data protection obligations on each subprocessor equivalent to those in this Agreement and remains liable for their work as for its own.

Where the processor intends to replace or add a subprocessor, it will notify the controller 30 days in advance by email to the account's registered address. The controller may object within that period; if no agreement is reached, the controller may terminate the subscription with no further payment for the remaining period.

7. Transfers to third countries

The infrastructure (hosting and database) sits in the EU. Part of the processing nevertheless takes place with providers outside the EU/EEA — in particular the AI model call, where the text sent to the model may contain personal data.

Each individual transfer and its basis is set out in Annex B. Transfers are made either to a country covered by an adequacy decision, on the basis of the European Commission's standard contractual clauses, or to a recipient certified under the EU-U.S. Data Privacy Framework. Where the basis could not be verified, it is stated as not verified rather than presented as something else.

8. Assistance to the controller

Taking into account the nature of the processing and insofar as possible, the processor assists the controller with:

• responding to requests from data subjects for access, rectification, erasure, restriction, portability and objection,
• complying with the obligations in Articles 32-36, including security, breach notification and impact assessments.

If the processor becomes aware of a personal data breach, it will notify the controller without undue delay and no later than 48 hours after becoming aware of it, with the information needed for the controller's own notification.

9. Deletion on termination

On termination the processor deletes all personal data processed on behalf of the controller within 30 days, unless Union or Member State law requires continued storage. No shadow copies are retained. Before deletion, the controller may request the data in a commonly used, machine-readable format.

10. Documentation and audit

The processor makes available the information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by the controller or an auditor mandated by the controller. Audits are subject to reasonable notice, take place during normal business hours and must not unduly disrupt operations. The controller bears its own costs for the audit.

11. Liability and governing law

The Agreement is governed by Danish law. Disputes are settled by the Danish courts. The limitations of liability in the terms also apply to this Agreement, to the extent compatible with the GDPR.

Complaints about the processing may be directed to Datatilsynet, the Danish supervisory authority.

Annex A — description of the processing

Categories of data subjects: the controller's users (the contact person and any colleagues with access), and individuals appearing in the material the service processes — typically staff named on the controller's own website, and authors of public reviews.

Types of personal data: name, email address, work-related contact details, login credentials and usage data; company information from public registries; content from the controller's own website; and text forming part of generated articles and analyses.

Sensitive data: the service is not intended for processing special categories of personal data under Article 9 or data on criminal convictions under Article 10, and the controller must not enter such data into the service.

Processing activities: collection, storage, structuring, analysis, generation of text, disclosure to the subprocessors listed in Annex B, and deletion.

Annex B — subprocessors

The list below is wired directly to the codebase and covered by automated tests. It therefore cannot fall behind what the platform actually does — if an integration is removed or added, the tests fail until the list is corrected.

The Basis column states what the transfer rests on and links to the provider's own data processing agreement where one is publicly available.

Annex C — technical and organisational measures

• Encryption: all traffic over HTTPS with HSTS; data encrypted at rest (AES-256) at the database provider.
• Access control: Row Level Security at database level so an account can only reach its own data; secrets stay server-side and are never exposed in the browser; API keys are issued per installation and can be revoked individually.
• Separation: customer data is logically separated per account.
• Change control: every change must pass an automated test suite and a smoke test against production before it ships; a failing test blocks the deploy.
• Monitoring: error and uptime monitoring with alerting so failures are detected and fixed.
• Deletion: account deletion removes all associated data within 30 days.
• Personnel: access is limited to what is necessary and subject to confidentiality.

See the Trust Center for the continuously updated description of security and operations.

---

AddonNordic ApS · CVR 46495985 · Aalborg, Danmark · addonnordic.dk