Data Processing Agreement

1. Scope and parties

This Data Processing Agreement (“DPA”) is between the Customer and Outer Cite Pty Ltd (ACN 649 728 101, ABN 42 649 728 101), trading as Outercite. It is incorporated into the Terms of Service or any master agreement between us (the “Agreement”) and applies to Customer Personal Data we process in providing the Services. It takes effect when you accept the Agreement. If you need a countersigned copy, email legal@outercite.com.

2. Definitions

“Data Protection Laws”: all laws on personal data that apply to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”), and the California Consumer Privacy Act as amended (“CCPA”).
“Customer Personal Data”: personal data in Customer Content that we process on the Customer’s behalf.
“Sub-processor”: a third party we engage that processes Customer Personal Data.
“Controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the GDPR. Other capitalised terms have the meanings given in the Agreement.

3. Roles

The Customer is the controller of Customer Personal Data and Outercite is its processor. Where the Customer is an Agency Customer acting for its own clients, the Customer is a processor for those clients and Outercite is its sub-processor; the Customer is responsible for passing on to its clients any notices this DPA gives it.

Outercite is a controller, not a processor, of account, billing, usage and marketing data about the Customer’s own users, which is handled under our Privacy Policy.

The Customer is responsible for having a lawful basis for the processing, for giving any notices and obtaining any consents required (including from visitors to its website when it installs our tracking pixel or Cloudflare Worker), and for the accuracy of Customer Personal Data.

4. Processing on instructions

We process Customer Personal Data only on the Customer’s documented instructions, which are the Agreement, this DPA, and the Customer’s configuration and use of the Services, unless the law requires otherwise; in that case we will tell the Customer first unless the law forbids it. We will tell the Customer if we believe an instruction breaks Data Protection Laws. We do not sell Customer Personal Data or use it to train AI models.

5. Confidentiality of personnel

Everyone we authorise to process Customer Personal Data is bound by confidentiality obligations and has access only as far as their role needs.

6. Security

We maintain the technical and organisational measures in Annex 2, which are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. We may update them, but not in a way that materially lowers the overall level of protection.

7. Sub-processors

The Customer authorises the Sub-processors listed on our Sub-processors page.
We impose data-protection terms on each Sub-processor that are no less protective than this DPA, and we remain responsible for its performance.
We will update that page, and email the Customer’s primary contact, at least 14 days before a new Sub-processor starts processing Customer Personal Data. The Customer may object in writing on reasonable data-protection grounds within that period. We will then try in good faith to offer an alternative; if we cannot, the Customer may end the affected Services and we will refund prepaid fees for the unused period.

8. Assistance with data subject rights

Taking into account the nature of the processing, we will help the Customer, through the Services or otherwise, to respond to requests from data subjects to exercise their rights. If we receive such a request directly, we will pass it to the Customer and not respond ourselves, except to say who to contact. We will also give reasonable help with data protection impact assessments and consultations with regulators, at the Customer’s cost where the help goes beyond what the Services provide.

9. Personal data breaches

We will notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of a personal data breach affecting Customer Personal Data. The notice will describe, as far as we know at the time, what happened, the data and data subjects affected, the likely consequences, and what we are doing about it, and we will add information as it becomes available. We will take reasonable steps to contain the breach and to help the Customer meet its own notification duties, including under the Australian Notifiable Data Breaches scheme. A notice is not an admission of fault.

10. International transfers

Customer Personal Data is stored in Sydney, Australia, and processed by us and our Sub-processors in the other countries shown on the Sub-processors page, including the United States and China. To the extent the GDPR, UK GDPR or Swiss FADP applies:

For transfers from the EEA, the parties agree to the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or, where the Customer is a processor, Module Three (processor to processor), which are incorporated by reference. Clause 7 (docking) applies; in Clause 9, Option 2 (general authorisation) applies with the notice period in Section 7 of this DPA; in Clause 11 the optional language does not apply; in Clauses 17 and 18 the law and courts of Ireland apply. Annexes I and II of the clauses are completed by Annex 1 and Annex 2 of this DPA.
For transfers from the UK, the International Data Transfer Addendum issued by the Information Commissioner applies, with the Standard Contractual Clauses above as the Approved EU SCCs. Neither party may end the Addendum under its Section 19.
For transfers from Switzerland, the Standard Contractual Clauses apply with references to the GDPR read as references to the FADP and the competent authority being the Federal Data Protection and Information Commissioner.

We flow equivalent obligations down to Sub-processors that receive Customer Personal Data outside the country it came from.

11. Return and deletion

The Customer can export its data from the Services at any time and may ask for an export for 30 days after the Agreement ends. Within 90 days after the Agreement ends we will delete or anonymise Customer Personal Data, except copies that the law requires us to keep and copies in backups, which are overwritten within 35 days and kept confidential until then.

12. Audits and information

On request we will provide the information reasonably needed to show compliance with this DPA, including our current security questionnaire response and any third-party certifications or reports we hold. If that is not enough to meet the Customer’s obligations under Data Protection Laws, or a regulator requires it, the Customer may audit us, or appoint an independent auditor bound by confidentiality, once in any 12-month period, on at least 30 days’ notice, during business hours, and at its own cost. Audits will not give access to other customers’ data.

13. Australian Privacy Act

Where the Privacy Act 1988 (Cth) applies, we will handle Customer Personal Data in line with the APPs as if we were bound by them, take reasonable steps under APP 8 before disclosing it overseas, and not use or disclose it other than to provide the Services.

14. California (CCPA / CPRA)

Where the CCPA applies, Outercite is a service provider. We will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Services, or combine it with personal information from other sources except as the CCPA allows. We will comply with the CCPA, provide the same level of privacy protection it requires, and tell the Customer if we can no longer meet these obligations.

15. Liability and precedence

Each party’s liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. If this DPA conflicts with the Agreement, this DPA prevails on data protection; if it conflicts with the Standard Contractual Clauses, the clauses prevail.

16. Term

This DPA lasts as long as we process Customer Personal Data under the Agreement. We may update it to reflect changes in law or the Services, with notice under the Agreement’s change terms, but not in a way that materially lowers the protection it gives.

Annex 1: Details of processing

Data exporter: the Customer, as identified in its Account or order form. Role: controller (or processor, for an Agency Customer).
Data importer: Outer Cite Pty Ltd, Perth, Western Australia; privacy@outercite.com. Role: processor (or sub-processor).
Subject matter and purpose: providing the Services: monitoring how AI engines cite the Customer’s business, producing recommendations, forecasts and reports, measuring AI-referred visits, and support.
Nature of processing: collection, storage, analysis, transmission to AI providers, display, export and deletion.
Categories of data subjects: the Customer’s users and invited collaborators; individuals named in Customer Content or in AI answers about the Customer (such as staff or practitioners); visitors to the Customer’s website, where it enables visit measurement; the Customer’s end clients’ contacts, for Agency Customers.
Categories of personal data: names, business contact details and roles; content of prompts, uploaded materials and notes; AI answers that name individuals; for website visits, page URL and title, referrer, browser user agent, a random session identifier, screen size, device type, UTM tags and country (no IP address is stored); data from connected Google accounts.
Special categories: none intended. The Customer must not submit them.
Frequency: continuous, for the term of the Agreement.
Retention: for the term, then as in Section 11.
Sub-processor transfers: as listed in Annex 3, for the purposes shown there.
Competent supervisory authority: the authority determined under Clause 13 of the Standard Contractual Clauses.

Annex 2: Security measures

Encryption: TLS 1.2 or higher in transit, including between our Sydney and United States servers over a private WireGuard tunnel; full-disk encryption at rest; API keys, OAuth tokens and wallet keys additionally encrypted at the application layer.
Network: internal services are not exposed to the public internet; the public edge terminates TLS with managed certificates.
Access: least-privilege access to production, key-based SSH from allow-listed addresses, and access reviews on role change or exit. In the app, agency, workspace and user scopes are enforced in the data layer.
Resilience: PostgreSQL 16 with automated daily backups kept for 35 days; monitoring and alerting on errors, latency and queues.
Development: type-checking and static analysis on every merge; automated dependency vulnerability scanning; pre-deploy checks on migrations and services.
Incident response: triage within one hour of detection and notice under Section 9.
Data minimisation: visitor IP addresses are not stored; account and billing data are not sent to AI providers.

More detail is on our Security page. We are not yet certified against SOC 2 or ISO 27001.

Annex 3: Sub-processors

The current list, with each provider’s purpose, data and location, is on our Sub-processors page, which forms part of this Annex.