Last updated: 17 October 2026. This Data Processing Agreement (“DPA”) forms part of the agreement between you (“Customer”) and ContentSERP, Powred by S. Enterprise (“ContentSERP”, “we”) when we process personal data on your behalf through contentserp.in.
1. Roles and scope
You are the data controller and we are the data processor for personal data submitted to the service. We process that data only to provide, secure and support the service, on your documented instructions, and for no other purpose. Where we process data as a controller (for example your own account and billing records), our Privacy Policy applies instead.
2. Subject matter and duration
The processing covers hosted SEO and content tooling: storing account and project data, generating and analysing content you submit, and producing reports. It lasts for the term of your subscription plus the deletion period in section 8.
3. Categories of data and data subjects
Data subjects are your authorised users and any individuals whose data appears in content you submit. Categories are account identifiers (name, email), project and content data, and technical logs (IP address, timestamps). Special-category data is not intended to be submitted; you must not submit it without a lawful basis of your own.
4. Our obligations
- Process personal data only on your instructions, including for transfers outside India where you instruct or where required to deliver the service.
- Ensure personnel who access personal data are bound by confidentiality.
- Implement the technical and organisational measures described on our Security page.
- Assist you in responding to data-subject requests and in meeting your security, breach-notification and impact-assessment obligations, taking into account the nature of the processing.
- Notify you without undue delay after becoming aware of a personal data breach affecting your data.
5. Subprocessors
You give general authorisation for the subprocessors listed on our subprocessors page. We impose equivalent data-protection obligations on each of them. We will update that page before engaging a new subprocessor that processes personal data and give you the opportunity to object; if you object on reasonable data-protection grounds and we cannot offer an alternative, you may terminate the affected service.
6. International transfers
Our subprocessors may process data outside India. Where they do, transfers rely on the safeguards offered by those providers, including standard contractual clauses where applicable, and on your instructions to deliver the service.
7. Audits
We will make available the information reasonably necessary to demonstrate compliance with this DPA. Where an on-site audit is required, it is limited to once per year, on 30 days’ notice, during business hours, at your cost, and subject to confidentiality. Audits may not compromise the security or confidentiality of other customers’ data.
8. Deletion and return
On termination, we delete or return personal data at your choice, except where retention is required by law or for legitimate records such as invoices, which are kept for the statutory period. Backups containing your data age out under our backup retention schedule.
9. Liability
Each party’s liability under this DPA is subject to the limitations set out in the main agreement. Nothing in this DPA limits liability that cannot be limited by law.
10. Governing law
This DPA is governed by the laws of India, and the courts of Kolkata, West Bengal have exclusive jurisdiction.
11. Contact
Data-protection contact and grievance officer: Mr. S. Deb, [email protected]. To execute this DPA for your organisation, email us the legal entity name, registered address and signatory, and we will return a countersigned copy.