How focadio processes customer data.

This Data Processing Addendum (DPA) forms part of the Terms of Service between the customer (the "Controller") and Patnick, operating focadio (the "Processor"). It applies where focadio processes personal data on the customer's behalf and is governed by Article 28 GDPR.

The customer is the Controller of the personal data it submits (for example, contacts or competitor data within its projects). Patnick acts as the Processor, processing that data only to provide the service. For its own account, billing and analytics data, Patnick is an independent Controller (see the Privacy Policy).

Patnick processes personal data for the duration of the subscription and only to deliver, support and secure the service, and as further instructed by the customer in writing. Processing ends on termination, subject to the return/deletion section below.

• Data subjects: the customer's authorised users and any individuals named in the queries or projects the customer enters.
• Categories: account identifiers (name, email), project configuration, and the brand/competitor/query data the customer chooses to track.

Patnick will: process personal data only on documented instructions; ensure personnel are bound by confidentiality; implement appropriate technical and organisational security measures; assist the Controller with data-subject requests and security obligations; and make available the information needed to demonstrate compliance.

The customer authorises the use of vetted sub-processors: Stripe (payments), Supabase (database, EU), Vercel/Railway (hosting), OpenRouter & OpenAI (AI-engine probing), DataForSEO (SERP data), an email provider, and Plausible (cookieless analytics). Patnick imposes equivalent data-protection obligations on each and notifies the Controller of material changes. No sub-processor may use personal data to train its AI models.

The primary database is in the EU. Where personal data is transferred outside the EEA, Patnick relies on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU–US Data Privacy Framework where the recipient is certified.

• TLS 1.2+ in transit and encryption at rest
• Bcrypt password hashing and least-privilege access with audit logging
• Two-factor authentication for staff
• Regular updates and planned security reviews

Patnick notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available to support the Controller's own notification duties.

Taking into account the nature of the processing, Patnick assists the Controller by appropriate technical and organisational measures in responding to data-subject requests (access, rectification, erasure, restriction, portability and objection).

Patnick makes available the information necessary to demonstrate compliance with Article 28 and allows for and contributes to reasonable audits, including inspections, conducted by the Controller or an auditor it mandates, on reasonable notice.

On termination, and at the Controller's choice, Patnick returns or deletes the Controller's personal data and deletes existing copies, unless retention is required by law (see the retention schedule in the Privacy Policy).

This DPA is governed by Finnish law and forms part of, and is subject to, the Terms of Service. Contact: legal@patnick.com.