Data processing terms

1. Scope and parties

These terms apply when a business customer (the “Customer”) uses SAR Intelligence and SAR-SOFT (“SAR”, “we”) processes personal data on its behalf. The Customer is the controller, or a processor on behalf of its own clients (section 13), and SAR is the processor or sub-processor.

They form part of the terms of service for business customers, apply from the moment the Customer accepts those terms, and need no signature. On data protection matters they prevail over the terms of service. Terms not defined here have the meaning the GDPR (Regulation (EU) 2016/679) gives them.

2. Details of the processing

• Subject matter: providing SAR Intelligence: connecting the Customer's sources to the AI apps it authorizes, reading data when those apps ask, transmitting it to them, and carrying out the changes the Customer allowed and approved.
• Duration: for as long as the terms of service apply, and afterwards until deletion under section 9.
• Nature: retrieval, consultation, transmission, formatting of results, short-lived caching, storage of credentials, metadata, the activity history, approval details, files the Customer uploads and visual-check reference images, alteration in the sources (only when allowed and approved), and erasure.
• Purpose: solely to provide the service in line with the Customer's documented instructions.
• Categories of data: whatever the Customer's sources contain and its AI apps ask for: website analytics (reports and, where the property holds them, pseudonymous identifiers, device details, approximate location, events); search data (queries, pages, clicks); orders and customer records in WooCommerce and Magento (in Magento, names, email addresses, postal addresses, phone numbers and order history, if the Customer grants that access); WordPress content and users (names, roles, shortened email addresses) and comments; and whatever the files and images uploaded or captured contain.
• Data subjects: visitors to the Customer's websites, its shop customers, its WordPress users and commenters, people mentioned in its content, and its staff.
• Special categories: the service is not intended for them. The Customer does not let an AI app read them without a lawful basis.

3. The Customer's instructions

The Customer's documented instructions are the terms of service, these terms, its settings in the service (which sources, properties, AI apps, roles and changes are allowed) and the requests made by the AI apps it authorized, together with the approvals of its people. We process data only on those instructions, unless EU or member state law requires otherwise, in which case we tell the Customer first unless the law forbids it. If we think an instruction infringes the GDPR, we tell the Customer at once.

The AI app is a recipient the Customer chooses: by authorizing it, the Customer instructs us to transmit to it the data it asks for. Its provider (for example OpenAI or Anthropic) is not our sub-processor, and the Customer's relationship with it is governed by that provider's terms.

4. Confidentiality

Everyone with access to the Customer's data on our behalf is bound by confidentiality, by contract or by law, and has access only as far as the service or support requires.

5. Security measures

We take the technical and organisational measures Article 32 GDPR requires, including:

• encryption of connections (TLS) and of stored credentials;
• isolation of each organization, so one organization's connection never reaches another's data;
• least privilege: read-only by default, one property or site per connection, a person's approval before any change that would go live;
• role-based permissions, two-factor authentication and passkeys, and a required second factor for platform administration;
• an activity history, and technical records without the contents of requests;
• encrypted backups, including off the server, that are monitored;
• security updates, and deletion of expired tokens.

More is on the security page. We may change these measures, provided the overall level of protection is not reduced.

6. Sub-processors

The Customer gives general authorization for the sub-processors on the subprocessors page. We email account owners at least 30 days before we add or replace a sub-processor. The Customer may object within that period on reasonable data protection grounds; if no solution is found, it may terminate the affected service and receive back the proportionate amount it prepaid.

We impose on each sub-processor, by contract, data protection obligations substantially the same as these (Article 28(4) GDPR), and we remain liable to the Customer for their performance.

7. Assistance to the Customer

Taking into account the nature of the processing and the information available to us, we help the Customer respond to data subject requests (through the service's own tools, such as disconnecting and deleting, and by passing on without delay any request we receive), and with its obligations under Articles 32 to 36 GDPR: security, breach notification, data protection impact assessments (DPIAs) and prior consultation.

8. Personal data breaches

We notify the Customer without undue delay after becoming aware of a personal data breach affecting it, with the information in Article 33(3) GDPR as far as we have it, and add to it as we learn more. We take immediate steps to contain the consequences.

9. Deletion or return at the end

Data in the sources stays in the Customer's sources; we keep no copy of it. When the Customer disconnects a source or deletes the organization, the credentials are removed immediately, and the organization's other data is deleted as the privacy policy describes. Backups are replaced nightly and the most recent 14 are kept, so deleted data leaves them within 14 days.

We keep only what EU or member state law requires, and the activity history, in which a deleted user appears only as “Deleted user”, for security and for establishing or defending legal claims.

10. Information and audits

We make available to the Customer the information needed to demonstrate compliance with these terms, first through written answers and documentation. If that is not enough, we allow an audit by the Customer or by an auditor it appoints who is bound by confidentiality, on 30 days' notice, during business hours, at the Customer's cost, at most once every 12 months unless there has been a breach or a supervisory authority requires it.

11. Transfers outside the EEA

We process data in the EU where possible. We use sub-processors outside the EEA only with the safeguards of Chapter V GDPR: an adequacy decision, including the EU-US Data Privacy Framework, or Standard Contractual Clauses. Transfers to the AI app the Customer chooses are decided by the Customer.

12. Liability

Each party's liability under these terms follows the limits in the terms of service, as far as Article 82 GDPR allows.

13. When the Customer is itself a processor

If the Customer uses SAR on behalf of its own clients, for example as an agency, it confirms that the controller has authorized the processing and the use of SAR as a sub-processor. We follow only the Customer's instructions, and the Customer passes on to the controller the information it needs.

14. Contact

For data protection matters, write to [email protected].