Data Processing Agreement

Template, version 19 June 2026. This is a draft for review by qualified legal counsel before use. It is provided to help B2B customers meet Art. 28 GDPR and is not legal advice.

This Data Processing Agreement ("DPA") forms part of the Terms between GOLDENWING Creative Studios e.U. ("Processor", "we") and the customer ("Controller", "you") and governs the processing of personal data by SEOWing on the Controller's behalf under Art. 28 GDPR.

1. Subject matter and duration

The Processor processes personal data only to provide the SEOWing service as described in the Terms. The DPA runs for as long as the Processor processes personal data on the Controller's behalf.

2. Nature and purpose of processing

SEOWing runs on the Controller's own WordPress installation. Processing on our infrastructure is limited to license validation, software updates, billing, and any feature the Controller actively enables (see the Sub-processor list). The purpose is to operate the licensed plugin and its server-side services.

3. Types of personal data and categories of data subjects

Types: account and billing data of the Controller; license keys and active domains; and, only where the Controller enables the relevant feature, the URLs, keywords or content the Controller submits. SEOWing does not, by design, transmit the Controller's site visitor content to us. Data subjects: the Controller's authorised users and billing contacts.

4. Obligations of the Processor

We will: (a) process personal data only on documented instructions from the Controller, including the Terms and this DPA; (b) ensure persons authorised to process are bound by confidentiality; (c) implement appropriate technical and organisational measures (Section 7); (d) assist the Controller with data subject requests and with Art. 32 to 36 obligations, taking into account the nature of processing; (e) at the Controller's choice, delete or return personal data at the end of the service and delete existing copies unless storage is legally required.

5. Sub-processors

The Controller provides general authorisation for the Processor to engage the sub-processors listed at seowing.io/subprocessors. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we inform the Controller of intended changes so the Controller may object.

6. International transfers

Where personal data is transferred outside the EU/EEA, the transfer is covered by an adequacy decision or by EU Standard Contractual Clauses with supplementary measures as appropriate.

7. Technical and organisational measures (TOMs)

Measures include: encryption in transit (TLS); access controls and least-privilege access to the license and billing systems; hardened, regularly updated servers; logging and monitoring; segregation of customer license records; and backup and restore procedures. SEOWing exposes no customer site-visitor data to us by design.

8. Personal data breaches

We notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information the Controller reasonably needs to meet its own notification duties.

9. Audits

We make available the information necessary to demonstrate compliance with Art. 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates, subject to reasonable notice and confidentiality.

10. Deletion and return

On termination, we delete or return the Controller's personal data per Section 4(e). License records may be retained where required for legal, accounting or anti-abuse purposes, for no longer than necessary.

11. Liability and governing law

Liability is governed by the Terms, including the liability cap stated there. This DPA is governed by Austrian law; place of jurisdiction is Vienna, to the extent permitted by law.

12. How to put this in place

To execute a DPA for your account, email privacy@seowing.io with your company details. We will counter-sign. See also the Sub-processor list and the Privacy Policy.