Data Processing Addendum (DPA)

1. Scope

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Conterity (operated by Dev99 Group) and the customer ("Controller") where Conterity processes personal data on the Controller's behalf under the EU GDPR, the UK GDPR or the CCPA. It covers the Conterity service as sold today: keyword research, article writing and checking, review and approval, export, and search performance reporting.

2. Roles and Instructions

The Controller decides what personal data enters its workspaces. Conterity acts as a Processor (and, under the CCPA, a Service Provider) and processes that data only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's use of the service. Conterity will not sell or share the Controller's personal data, or use it for any purpose other than providing the service.

Conterity acts as an independent controller only for its own account, billing and security records.

3. Personal Data Processed

• Data subjects: the Controller's users and team members, and any people named in content the Controller adds (for example in proof points, testimonials or notes).
• Categories: names, work email addresses, sign-in data, and personal data contained in website content, notes and articles. The service is not designed for special-category data, and the Controller should not add it.
• Duration: for the term of the agreement, then deletion as set out in Section 7.

4. Security Measures

Conterity keeps technical and organisational measures appropriate to the risk, including workspace isolation enforced on every request, TLS in transit, encryption at rest, AES-256-GCM encryption of connected-service tokens, role-based access, and protections on outbound requests. Details are on our Security page. Staff and contractors with access to personal data are bound by confidentiality.

5. Subprocessors

The Controller authorises Conterity to use subprocessors in the categories described in Section 5 of our Privacy Policy. Conterity binds each subprocessor to data protection terms at least as protective as this DPA and remains responsible for its subprocessors. The current list is available on request at privacy@conterity.com.

6. Assistance and Breaches

Conterity will help the Controller respond to data subject requests and with data protection impact assessments where reasonably needed, and will notify the Controller of a personal data breach affecting the Controller's data as required by applicable law.

7. Deletion and Return

The Controller can export its workspaces at any time. When the agreement ends or the Controller deletes an account or workspace, Conterity deletes the related personal data from active systems within 24 hours and from backups as they expire, unless the law requires it to be kept.

8. International Transfers

Where personal data is transferred outside the EEA or UK, Conterity uses the safeguards required by applicable data protection law.