Data Processing Addendum

1. Scope

This Data Processing Addendum ("Addendum") applies where you use Harbor to process personal data that you are responsible for — most commonly when you install the Harbor tracking snippet on your own website, connect your own analytics or search data, or submit content containing personal data for processing.

This Addendum forms part of the Terms of Service between you and Kraft Agency Limited, trading as Harbor and Harbor SEO ("Harbor," "we," "us"), a company registered in Ireland under company registration (CRO) number 681636, VAT number IE3733031EH, with its registered office at Unit 2A, Deerpark Business Centre, Deerpark Industrial Estate, Oranmore, Co. Galway, H91 H9T8, Ireland.

It is written in plain English on purpose. Where it uses terms defined in the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") — controller, processor, personal data, processing, data subject, supervisory authority — those terms have their GDPR meanings.

2. Roles of the Parties

For personal data you put into Harbor, or that Harbor collects for you:

• You are the controller. You decide what personal data is collected, why, and for how long.
• Harbor is the processor. We process that personal data only to provide the Service to you.

Separately, Harbor is a controller in its own right for the data it needs to run its business — your account details, billing records, support conversations, and product analytics. That processing is described in our Privacy Policy and is not governed by this Addendum.

2.1 The Harbor Tracking Snippet

If you install the Harbor tracking snippet on your website, Harbor processes the following on your behalf about your website's visitors:

• Page URL: the address of the page the visitor viewed
• Referrer: the page or source the visitor arrived from
• utm_source: and other campaign parameters present in the URL
• Connection metadata: such as IP address and user agent

This data is used to attribute traffic and AI-assistant referrals to your site and to report on that traffic back to you. You remain the controller of it.

3. Subject Matter, Duration, Nature and Purpose

• Subject matter: the provision of Harbor's AI-powered SEO content generation, publishing, and search performance reporting service.
• Duration: for as long as your subscription or account is active, plus the deletion period set out in section 10.
• Nature of processing: collection, storage, retrieval, organisation, analysis, transmission to sub-processors, and deletion, by automated means.
• Purpose: generating and publishing content you request, attributing and reporting on traffic to sites you connect, and providing the features of the Service you use.
• Types of personal data: website visitor identifiers and connection metadata (page URL, referrer, campaign parameters, IP address, user agent); any personal data contained in content, prompts, or URLs you submit; contact details of your own end users if you choose to include them.
• Categories of data subjects: visitors to websites you operate, and any individuals referenced in content you submit.

You must not submit special category data (Article 9 GDPR), criminal offence data, or children's data to the Service.

4. Processing on Documented Instructions

Harbor processes personal data only on your documented instructions, including for international transfers. Your instructions are: this Addendum, the Terms of Service, and the actions you take in the product (for example, generating an article, connecting a site, or installing the snippet).

We will not process the personal data you control for our own purposes, sell it, or use it to train general-purpose AI models.

If we are required by EU or Member State law to process personal data beyond your instructions, we will inform you before doing so unless that law prohibits the notification on important grounds of public interest. If we consider an instruction to infringe data protection law, we will tell you.

5. Confidentiality of Personnel

Access to personal data processed under this Addendum is limited to personnel who need it to provide or support the Service.

Everyone with such access is bound by a written confidentiality obligation or an appropriate statutory duty of confidence, and receives guidance on handling personal data.

6. Security Measures (Article 32)

Taking account of the state of the art, the costs of implementation, and the nature and risk of the processing, Harbor implements appropriate technical and organisational measures, including:

• Encryption in transit: all traffic to and from the Service, and between the Service and its sub-processors, is encrypted using TLS
• Encryption at rest: data stored by our infrastructure providers is encrypted at rest
• Access controls: authenticated, role-based access to production systems, with administrative access restricted to named individuals
• Least privilege: personnel and services are granted the minimum access needed for their function, and access is removed when no longer required
• Segregation: customer data is logically separated so that one customer's data is not exposed to another
• Resilience: managed, backed-up infrastructure with the ability to restore availability after an incident
• Monitoring: logging of access and system events, and review of those logs when investigating incidents

We review these measures periodically and may update them, provided the level of security is not reduced.

7. Sub-processors

You give Harbor general written authorisation to engage sub-processors to process personal data on your behalf. The current list is published at /subprocessors.

We will give you at least 30 days' notice before adding or replacing a sub-processor, by updating that page and, where the change is material, by email to the account owner. If you object on reasonable data protection grounds within the notice period, we will work with you in good faith to find an alternative; if none is available, you may terminate the affected part of the Service.

Each sub-processor is engaged under a written contract imposing data protection obligations no less protective than those in this Addendum. Harbor remains fully liable to you for the performance of its sub-processors' obligations.

8. Assistance to the Customer

8.1 Data Subject Requests

Taking into account the nature of the processing, Harbor will assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to requests to exercise data subject rights — access, rectification, erasure, restriction, portability, and objection.

If a data subject contacts Harbor directly about personal data you control, we will not respond to the substance of the request. We will forward it to you promptly and direct the individual to you as controller.

8.2 Articles 32 to 36

Harbor will assist you, taking into account the nature of the processing and the information available to us, in complying with your obligations regarding security of processing (Article 32), personal data breach notification and communication (Articles 33 and 34), data protection impact assessments (Article 35), and prior consultation with a supervisory authority (Article 36).

9. Personal Data Breaches

Harbor will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf.

Our notification will describe, to the extent known at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. We will provide further information as our investigation progresses.

Notifying you of a breach is not an acknowledgement of fault or liability. Reporting the breach to a supervisory authority or to affected individuals, where required, remains your responsibility as controller.

10. Deletion or Return on Termination

On termination or expiry of your subscription, and at your choice, Harbor will delete or return the personal data processed on your behalf.

• You may export your content and data from the product before your account closes.
• If you do not ask for return within 30 days of termination, we will delete the personal data processed on your behalf.
• Deletion propagates to routine backups in the ordinary course of our backup cycle.

We may retain personal data where EU or Member State law requires storage, in which case we will continue to protect it under this Addendum and process it only for that purpose.

11. Audits and Information Rights

Harbor will make available to you the information necessary to demonstrate compliance with the obligations in Article 28 GDPR, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

In practice, we will first respond to reasonable written information requests and provide the security documentation and sub-processor information we hold. Where that is not sufficient, an on-site or remote audit may be carried out no more than once in any twelve-month period (or following a personal data breach), on at least 30 days' written notice, during business hours, without unreasonable disruption to our operations, and subject to confidentiality.

The auditor must not be a competitor of Harbor. You bear your own costs and the reasonable costs of our participation.

12. International Transfers

Some sub-processors listed at /subprocessors process personal data outside the European Economic Area, primarily in the United States.

Where personal data is transferred outside the EEA, Harbor relies on the Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-US Data Privacy Framework, together with any additional safeguards required. The Standard Contractual Clauses are incorporated into this Addendum by reference and apply with you as data exporter and Harbor (or the relevant sub-processor) as data importer.

Details of the transfer mechanism relied on for a particular sub-processor are available on request at hamish@harborseo.ai.

13. Your Responsibilities as Controller

You are responsible for the lawfulness of the data you ask Harbor to process. In particular, before installing the Harbor tracking snippet on your website:

• Provide notice to your visitors. You must tell your website's visitors, in your own privacy notice, that the snippet collects page URL, referrer, campaign parameters, and connection metadata such as IP address and user agent, and that Harbor processes this on your behalf.
• Obtain consent where it is required. Where applicable law requires consent for the storage of or access to information on a visitor's device, or for this analytics processing, you must obtain valid consent before the snippet loads — typically through your consent management platform.
• List Harbor in your cookie and privacy policy. Harbor should appear in your own cookie table and list of processors or recipients.
• Honour visitor choices. You must ensure the snippet does not run for visitors who have declined, and that objections and erasure requests reach us so we can act on them.
• Have a lawful basis for any other personal data you submit to the Service, and keep your own records of processing.

Harbor does not have a relationship with your website's visitors and cannot give them notice or collect consent on your behalf.

14. Signed Copies and Contact

This Addendum applies automatically to every customer who uses Harbor to process personal data — no signature is required for it to take effect.

If your organisation needs a countersigned copy for its own records or procurement process, request one at hamish@harborseo.ai and we will return an executed version.