Data Processing Addendum

This Data Processing Addendum (“DPA”) applies when LazySEM processes personal data on behalf of a customer as part of providing the LazySEM service.

LazySEM is operated by Got Reach s.r.o., a company registered in the Czech Republic.

This DPA forms part of the LazySEM Terms of Service and applies only to the extent LazySEM processes personal data as a processor on behalf of a customer acting as a controller.

1. Roles of the parties

For customer-submitted content and data processed through the LazySEM service:

• the customer is the controller
• LazySEM is the processor

For account management, billing, service administration, security, and direct communications with users, LazySEM may act as an independent controller. That processing is described in the LazySEM Privacy Policy.

2. Scope of processing

LazySEM processes customer personal data only as needed to provide, secure, maintain, and support the service.

Customer personal data may be processed when customers use features such as:

• SEO briefing generation
• keyword clustering
• content similarity analysis
• URL and site monitoring
• page snapshots and on-page analysis
• Google Analytics and Google Search Console integrations
• AI-assisted insights and content workflows

3. Customer instructions

LazySEM will process customer personal data only:

• according to the customer’s use of the service
• according to the Terms of Service, Privacy Policy, and this DPA
• as needed to provide requested product features
• as required by applicable law

The customer is responsible for ensuring that it has the necessary rights, notices, and legal basis to submit or connect personal data to LazySEM.

4. Categories of personal data

Customer personal data processed by LazySEM may include:

• names or other personal data included in customer-submitted text
• URLs and page content submitted or monitored by the customer
• keywords and content inputs that may contain personal data
• analytics and search performance data from connected Google Analytics or Google Search Console properties
• free-text notes, prompts, or briefing inputs entered by users
• generated outputs that may reflect customer-submitted personal data

LazySEM does not intentionally request sensitive personal data for SEO workflow features.

5. Categories of data subjects

Customer personal data may relate to:

• customer employees, contractors, or users
• individuals referenced in customer-submitted content
• individuals whose data may appear on URLs or pages monitored by the customer
• website visitors or users reflected in aggregated analytics or search performance data connected by the customer

6. Nature and purpose of processing

LazySEM processes customer personal data to:

• generate SEO briefs and content recommendations
• cluster and analyze keywords
• compare content similarity
• monitor URLs and page changes
• analyze page snapshots and metadata
• retrieve and process connected GA4 or Search Console metrics
• generate AI-assisted insights and outputs
• secure, troubleshoot, and maintain the service

Processing may include storing, retrieving, analyzing, transmitting, generating, displaying, logging, and deleting data as necessary to provide the service.

7. Subprocessors

LazySEM uses third-party providers to help provide, operate, secure, and support the service.

Current subprocessors and third-party providers are listed at: /subprocessors

LazySEM may update its subprocessor list from time to time. Customers should review the Subprocessors page for the current list.

8. International processing

LazySEM and its subprocessors may process data in multiple countries, including countries outside the European Economic Area.

Where required, LazySEM will rely on appropriate transfer mechanisms or subprocessors’ applicable data transfer safeguards.

More information about providers and processing locations is available on the Subprocessors page.

9. Security measures

LazySEM uses technical and organizational measures designed to protect customer personal data, including:

• HTTPS (TLS) encryption for public traffic
• managed infrastructure with encryption at rest
• restricted production access
• role-based administrative controls within the application
• managed database backups
• encrypted storage of connected Google OAuth tokens
• logging and diagnostic tools for security, reliability, and troubleshooting

More information is available on the LazySEM Security page: /security

10. Confidentiality

LazySEM limits access to customer personal data to authorized personnel who need access to operate, maintain, secure, or support the service.

LazySEM requires personnel with access to customer data to handle it confidentially.

11. Personal data breach

If LazySEM confirms a security incident affecting customer personal data, LazySEM will take reasonable steps to investigate, contain, and remediate the incident.

Where required by law or contract, LazySEM will notify affected customers without undue delay after becoming aware of a confirmed personal data breach.

12. Assistance with data subject requests

To the extent reasonably possible, LazySEM will assist customers with requests from data subjects relating to customer personal data processed through the service.

Customers may contact LazySEM support for assistance with access, correction, deletion, or export requests where supported by the service and applicable law.

13. Return and deletion of customer personal data

Upon account deletion or termination, LazySEM will take reasonable steps to delete or de-identify customer personal data, subject to legal, tax, accounting, security, fraud prevention, dispute resolution, backup, and technical limitations. Some data may remain in backups, logs, or third-party systems for a limited period before being deleted or overwritten according to applicable retention processes.

Some records may be retained where required by law or necessary for billing, accounting, tax, security, fraud prevention, or dispute resolution.

14. Audits and information requests

Upon reasonable written request, LazySEM may provide information necessary to demonstrate its compliance with this DPA, subject to confidentiality, security, and protection of other customers’ data.

LazySEM does not provide unrestricted access to production systems or environments.

15. Customer responsibilities

The customer is responsible for:

• ensuring it has the right to submit or connect personal data to LazySEM
• configuring and using the service appropriately
• managing access for its users
• avoiding unnecessary sensitive personal data in free-text fields
• complying with applicable privacy and data protection laws

16. Order of precedence

If there is a conflict between this DPA and the Terms of Service regarding processing of customer personal data, this DPA will control to the extent of the conflict.

Annex 1: Processing details

Annex 2: Security measures

LazySEM’s current security measures include:

• HTTPS (TLS) encryption in transit
• provider-managed encryption at rest
• restricted production access
• role-based application permissions
• managed database backups
• encrypted storage of connected Google OAuth tokens
• security and activity logging
• diagnostic monitoring for application reliability

LazySEM may update these measures as the service evolves.

Annex 3: Subprocessors

LazySEM’s current list of subprocessors and third-party providers is available at: /subprocessors