Data Processing Agreement (DPA)

Version 1.0 · Last updated: 22 June 2026 · Compliant with Article 28 GDPR

This Data Processing Agreement ("DPA") forms an integral part of the Terms of Use and governs, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR"), the processing of personal data carried out by Rank Press on behalf of the user of the service. In the event of a conflict with the Terms of Use on the matter of personal data processing, this DPA prevails.

1. Roles of the parties

Controller: the user (the person or entity operating the WordPress site connected to the service). The user determines the purposes and means of the processing they trigger through the agents.
Processor: Permis Online SRL (trading as Rank Press), a company incorporated under Belgian law, company/VAT number BE 0762.894.409, Rue du Congo 64, 6890 Ochamps, Belgium, contact@rankpress.com. Rank Press processes data only on the documented instructions of the user, the use of the service constituting those instructions.

For the data of the Rank Press account itself (site URL, administrator email where applicable, billing data), Rank Press acts as controller; that processing is described in the privacy policy.

2. Description of the processing

Item	Detail
Nature and purpose	Provision of the AI agents: content generation and optimization (Atlas), assistance with recovering abandoned carts and failed WooCommerce payments (Aria), brand authority structuring for AI answer engines (Vera).
Categories of data subjects	Depending on the user's usage: their customers and prospects (in particular for Aria), their site visitors, and their own administrators.
Categories of data	Data entered into, or present in, the site and transmitted to the service for processing: content, product metadata, order identifiers and aggregated metrics, visibility data. Card numbers never transit through Rank Press (payment re-capture happens directly through the user's gateway, on the WordPress side).
Duration	For the duration of the use of the service, then deletion or return in accordance with Article 7 below.

The service does not intentionally process any special categories of data (Article 9 GDPR). The user undertakes not to submit such data through the agents.

3. Rank Press obligations (Article 28.3)

Documented instructions: Rank Press processes data only on the user's instructions, unless required by law, in which case it informs the user unless legally prohibited.
Confidentiality: persons authorized to process the data are bound by a duty of confidentiality.
Security (Article 32): Rank Press implements appropriate technical and organizational measures (see Article 8).
Assistance: Rank Press assists the user, as far as possible, in responding to data subject rights requests and in meeting its security, breach-notification and impact-assessment obligations (Articles 32 to 36).
Breach notification: Rank Press notifies the user without undue delay after becoming aware of a data breach affecting the processing carried out on its behalf.
Deletion or return: at the end of the service, Rank Press deletes or returns the data, in accordance with Article 7.
Audit and information: Rank Press makes available to the user the information needed to demonstrate compliance and allows for reasonable audits.

4. Sub-processors

The user grants Rank Press a general authorization to engage the sub-processors listed in Article 6 to provide the service. Rank Press imposes on each sub-processor data protection obligations equivalent to those of this DPA, and remains liable to the user for the performance of those sub-processors' obligations.

Rank Press informs the user of any addition or replacement of a sub-processor by updating this list. The user may object to a change on legitimate data protection grounds by writing to contact@rankpress.com; failing a resolution, the user may terminate the service.

5. International transfers

Some sub-processors (in particular the AI, payment and infrastructure providers) process data outside the European Economic Area (EEA), in particular in the United States. These transfers are framed by the Standard Contractual Clauses adopted by the European Commission (Article 46 GDPR), supplemented where applicable by the EU-US Data Privacy Framework where the provider is certified, together with additional technical measures (encryption in transit, minimization of the data transmitted).

Rank Press is not a "fully hosted in Europe" service. Content sent to the agents is processed by specialized providers, several of them outside the EU, under the framework described above. Your data is never resold.

6. List of sub-processors

Sub-processor	Purpose	Processing location	Transfer safeguard
Kinsta (Google Cloud infrastructure)	Hosting of the Rank Press service	Google Cloud data centers (region configured for the service)	SCCs, outside the EU where applicable
Cloudflare, Inc.	Content delivery, security and anti-abuse protection	United States and global network	SCCs
Anthropic, PBC	AI content generation and analysis (Claude)	United States	SCCs
OpenAI, L.L.C.	Semantic embeddings (anti-cannibalization, internal linking)	United States	SCCs
Google LLC	Generative AI and images (Gemini), Search Console data, measurement	United States	SCCs
Stripe, Inc. / Stripe Payments Europe, Ltd	Payment and subscription processing	Ireland (EU) and United States	SCCs, outside the EU where applicable
Brevo (Sendinblue SAS)	Transactional and support emails	France (EU)	No transfer outside the EU
DataForSEO	Ranking (SERP) and keyword data	United States	SCCs
Meta Platforms, Inc.	Install conversion measurement (Conversions API)	United States	SCCs

SCCs: European Commission Standard Contractual Clauses. This list is kept up to date; any provider that is no longer used is removed, any addition is reflected here with the update date shown above.

7. Duration, deletion and return

This DPA applies for as long as Rank Press processes data on behalf of the user. When the service ends (deactivation, uninstallation or termination), the user keeps on their own site the content already produced and published. Data held on the service side is deleted or returned upon request, subject to retention periods imposed by law (in particular accounting and tax). The procedures for exercising rights are set out in the privacy policy.

8. Security measures (Article 32)

Encryption of communications in transit (HTTPS/TLS) between the site, the service and the sub-processors.
Authentication of site-server exchanges via signatures and technical tokens; isolation by account and by site.
Minimization: only the data needed for a given request is transmitted to the service and the sub-processors.
Human validation of the agents' sensitive actions and logging of executed actions.
Organizational measures: access restricted to authorized persons bound by confidentiality.

The user remains responsible for the security of their own WordPress site, their backups and their administrators' access rights.

9. Contact

For any question regarding this DPA, the exercise of rights or data protection: contact@rankpress.com (Permis Online SRL, Rue du Congo 64, 6890 Ochamps, Belgium). You also have the right to lodge a complaint with the Belgian Data Protection Authority (APD/GBA).