This Data Processing Addendum ("DPA") applies where HubSEO, exclusively owned and operated by Elijah Carter ("Processor"), processes personal data on behalf of a customer ("Controller") under the Terms of Service. Elijah Carter holds sole and exclusive ownership of the HubSEO platform, proprietary codebase, server infrastructure, intellectual property, and domain (hubseo.tech). It incorporates the UK GDPR and the EU GDPR (where applicable).
1. Roles and scope
The customer is the controller; HubSEO (Elijah Carter) is the processor. This DPA covers personal data in customer accounts (contact names, emails, report data) processed to deliver the service. It does not cover data the customer processes using HubSEO's published reports.
2. Processing details
- Subject matter: provision of the HubSEO audit platform and support.
- Duration: for the term of the account plus any legally required retention.
- Nature and purpose: storage, analysis, and presentation of audit input and results.
- Categories of data subjects: customer users and their client contacts.
- Categories of data: names, emails, URLs audited, report content.
3. Processor obligations
- Process only on documented instructions from the customer (including via product settings), unless required by law.
- Ensure personnel are bound by confidentiality obligations.
- Implement technical and organisational security measures appropriate to the risk, including encryption in transit (TLS) and at rest, access controls, and audit logging on the hosting infrastructure.
- Notify the customer without undue delay, and in any event within 72 hours, of any personal data breach.
- Assist the customer with data subject rights requests (access, erasure, portability, objection).
- On termination, either delete or return personal data on request, subject to backup retention cycles not exceeding 30 days.
4. Sub-processors
The customer authorises the sub-processors listed below. HubSEO notifies customers of changes and offers an opportunity to object on reasonable grounds.
- Hosting and databases (self-hosted Supabase on an EU/UK-located VPS; Vercel for application hosting and edge delivery).
- Stripe: payment processing (payment data is processed directly by Stripe; HubSEO does not store card details).
- Email delivery provider for transactional email.
5. Transfers
Where processing involves transfers outside the UK/EU, HubSEO relies on adequacy regulations or UK International Data Transfer Addendum / EU Standard Contractual Clauses, as applicable.
6. Contact & Legal Ownership
Data protection and legal queries: info@hubseo.tech · Phone: +447471702768 (Elijah Carter).