Data processing addendum

1. About this addendum

This addendum (“DPA”) forms part of the Terms of service between you, the customer, and Ndovu SEOLabs Ltd (“NdovuSEOLabs”, “we”, “us”), a company registered in Kenya (KRA PIN P052302099E) and based in Nairobi. It applies when we process personal data on your behalf in providing the service (“customer personal data”), and it follows the Kenya Data Protection Act, 2019 and its regulations (“the Act”). If this DPA and the terms conflict about personal data, this DPA applies.

2. Roles

You are the data controller of customer personal data and we are your data processor. You decide why and how it is processed by choosing the features and settings you use. You are responsible for having a lawful basis for the data you send us, giving the notices the Act requires (for example a privacy notice and, where needed, consent on your website), and answering requests from the people concerned.

3. Processing only on your instructions

We process customer personal data only to provide, secure and support the service, as described in Annex 1, and on your documented instructions. Your use of the service, its settings and these terms are your instructions. We will tell you if we believe an instruction breaks the Act. We do not sell customer personal data, use it for advertising or use it to train AI models.

4. Confidentiality

Everyone we authorise to handle customer personal data is bound by confidentiality and may access it only as far as their work requires.

5. Security

We keep in place the technical and organisational measures in Annex 2, appropriate to the risk, and we may improve them over time without lowering the overall level of protection.

6. Personal data breaches

If we become aware of a breach of security affecting customer personal data, we will tell you without undue delay and in any event within 48 hours, as section 43 of the Act requires of a processor. We will give you the information you reasonably need to assess the breach and meet your own duty to notify the Data Commissioner and the people affected, and we will take reasonable steps to contain it and limit its effects.

7. Subprocessors

You authorise us to use the subprocessors listed in Annex 3. We will hold each one to data protection obligations at least as protective as this DPA, and we remain responsible for their work. We will tell account owners by email at least 14 days before adding or replacing a subprocessor. If you object on reasonable data protection grounds and we cannot address your concern, you may cancel the affected service and receive a pro-rata refund of the unused period.

8. Transfers outside Kenya

Customer personal data is hosted in the European Union and may be processed by the subprocessors in Annex 3 in the countries listed there. We transfer it only as sections 48 to 50 of the Act allow, to subprocessors that give appropriate safeguards for its security and protection under our contracts with them. On request we will give you the information you need to show these safeguards to the Data Commissioner.

9. Helping you meet your obligations

Taking into account what the service does and the information available to us, we will help you respond to requests from the people concerned (to access, correct, delete or object), and with your duties on security, breach notification and data protection impact assessments. Much of this you can do yourself in the service, for example by changing retention settings or deleting data.

10. Deletion and return

You can delete customer personal data in the service at any time, and set how long crawler data is kept for each website. When your account is deleted, customer personal data is erased after a 14-day waiting period, and removed from backups as they are overwritten. You can export your data before then. We keep data longer only where the law requires it.

11. Information and audits

We will make available the information reasonably needed to show compliance with this DPA, including answers to reasonable security questionnaires once a year. Where the Act or a regulator requires an audit, we will allow one, at your cost, with reasonable notice, during business hours and under confidentiality, no more than once a year unless there has been a breach. We do not currently hold ISO 27001 or SOC 2 certification.

12. Liability

Each party’s liability under this DPA is subject to the limits in the Terms of service, except where the Act does not allow it to be limited.

13. Term, law and changes

This DPA lasts as long as we process customer personal data for you. It is governed by the laws of Kenya, and disputes are decided by the courts of Kenya sitting in Nairobi. We may update it to reflect changes in the law or the service; changes that reduce your protection will be notified at least 14 days in advance.

14. Acceptance

This DPA applies automatically when you accept the Terms of service; no signature is needed. If you need a signed copy for your records, email support@ndovuseolabs.com.

Annex 1: Details of processing

Subject matter	Providing the NdovuSEOLabs service to you.
Duration	While you use the service, then until deletion as described in section 10.
Nature and purpose	Collecting, storing, organising, analysing and displaying data to show which search engines, AI crawlers and other bots visit your websites, how your traffic behaves, and to produce reports, alerts and AI answers you ask for.
People concerned	Visitors to your websites; your workspace members; your contacts named in alert channels.
Personal data	IP addresses, user agents, requested URLs, timestamps and response details from server or CDN logs; optional categorical browser signals (no form contents or keystrokes); names and email addresses of workspace members and alert contacts.
Special categories	None intended. Do not send sensitive personal data to the service.
Retention	As set in the Privacy policy: raw requests 7 days by default (up to 30), per-page daily totals 90 days by default (up to 400).

Annex 2: Security measures

• Hosting: data stored in the European Union with providers that encrypt data at rest.
• Encryption: HTTPS (TLS) for all traffic; tokens for connected accounts encrypted again by the application.
• Separation: every request is checked against the workspace it belongs to, and each workspace sees only its own data.
• Access: production access limited to the people who need it, behind two-step sign-in; support actions in our operator console need a reason and are recorded in an audit log.
• Data endpoints: data sent by the WordPress plugin or CDNs is authenticated with per-site tokens and signatures and rate-limited.
• Accounts: hashed passwords, email verification, optional two-step sign-in, bot protection on sign-up and sign-in, and rate limits on sign-in and email.
• Crawler safety: site audits refuse private and internal network addresses.
• Monitoring: error tracking, a public status page and automatic outage alerts to our team.
• Backups: automated database backups by the database provider.
• Incident response: we contain the problem, investigate it and notify you as section 6 describes.

Annex 3: Subprocessors

Subprocessor	What for	Location
Cloudflare, Inc.	Hosting, network and security	European Union and global network
PlanetScale, Inc.	Database	European Union (Germany)
Resend, Inc.	Sending service and alert emails	United States
OpenRouter, Inc. and the AI model providers it routes to	Answering the Ndovu assistant and AI visibility checks you run	United States and others
DataForSEO	Market data for the keywords, domains and pages you look up (no customer personal data is needed)	Outside Kenya