Data Processing Addendum (DPA) — serp.cheap

Effective date: 15 June 2026

Applies when the Customer’s use of the Service involves the processing of personal data. Structured under the LGPD (with reference to the GDPR for EU customers, including SCCs where applicable). It forms part of the Terms of Service. The English text is the official version; translations are provided for convenience.

This DPA is entered into between WILLIAM BITTENCOURT MORAES SOLUÇÕES EM DESENVOLVIMENTO, CNPJ 29.785.688/0001-44 (“serp.cheap” or “Processor”), and the Customer identified in the account (“Controller”). By accepting the Terms of Service and using the Service in a way that involves personal data, the Customer accepts this DPA.

1. Roles

The Customer is the Controller and serp.cheap is the Processor, under applicable data-protection law, with respect to personal data processed on the Customer’s behalf in providing the Service. Where serp.cheap processes data for its own purposes (e.g., managing the commercial relationship), it acts as Controller, subject to the Privacy Policy.

2. Subject matter and instructions

The Processor will process personal data only in accordance with the Controller’s documented instructions (these Terms, this DPA, and the use of the Service), except where required by law. The Processor will inform the Controller if it believes an instruction violates data-protection law.

3. Controller obligations

The Controller represents that it: has and maintains a valid legal basis for the processing resulting from its use of the Service; has provided the privacy notices required to data subjects; and will not use the Service in a way that violates data-protection law. The Controller acknowledges that, by submitting queries to the API, it may cause the Processor’s infrastructure to process personal data contained in the public content returned, and is solely responsible for ensuring the lawfulness of that activity.

4. Processor obligations

• Confidentiality: ensure authorized personnel are subject to a duty of confidentiality.
• Security: adopt technical and organizational measures appropriate to the risk (encryption in transit, access control, access logging, monitoring).
• Sub-processors: the Controller authorizes the use of the sub-processors necessary (e.g., hosting, payment processing, monitoring), under equivalent protection obligations. We will give reasonable advance notice of relevant changes, with a right to reasoned objection.
• Data subject rights: provide reasonable assistance for the Controller to handle data-subject requests (access, correction, deletion, etc.), forwarding to the Controller any requests received directly.
• Incidents: notify the Controller without undue delay after becoming aware of a security incident affecting data processed under this DPA, with the information then available.
• Deletion: on termination, delete or return personal data processed on the Controller’s behalf, except where mandatory legal retention applies.
• Cooperation: cooperate with the ANPD and other competent authorities as required by law.

5. International transfer

Where there is an international transfer, the Processor will adopt appropriate safeguards under the LGPD; for EU data, GDPR mechanisms (e.g., SCCs Module 2, Controller-to-Processor).

6. Aggregated technical data

The Processor may collect and use aggregated and anonymized technical and performance data (response times, error rates, usage patterns) to monitor service health and improve it, without processing personal data for any purpose other than providing the Service.

7. Liability

Liability under this DPA is subject to the limits set out in the applicable Terms of Service. The Processor is not liable for damages arising from the Controller’s instructions, from the Controller’s failure to comply with data-protection law, or from the Customer’s unlawful use of the Service.

8. Term

This DPA remains in force for the duration of the contractual relationship and terminates with it, subject to deletion/retention obligations. In the event of a conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails.

Contact: [email protected]

Annex I — Description of the processing

• Subject matter: provision of the search-results API.
• Nature/Purpose: execution of requests submitted by the Customer; logs, billing, support, security.
• Types of data: (a) account/API data (key, IP, request metadata, logs); (b) data contained in the public content returned, defined exclusively by the Customer; (c) support data.
• Data subjects: the Customer’s authorized users; individuals whose data may appear in the content returned (defined by the Customer); the Customer’s contacts.
• Location of processing: Brazil (management) and abroad — hosting in Germany (Contabo) and the United States (AWS Lambda), plus payment, analytics, marketing, and CRM processors based abroad.

Annex II — Sub-processors