Data Processing Agreement (DPA)

Effective date: 13 August 2026 · Version 1.0 · This DPA forms part of the Terms of Service for IndexFixer Pro.

0. How this DPA is concluded

This DPA is incorporated by reference into the Terms of Service. By creating a ZinkWP account or purchasing IndexFixer Pro, the customer accepts the Terms and thereby enters into this DPA — no signature is required. On written request ([email protected]) we will countersign a copy for your records.

1. Parties and roles

This Data Processing Agreement ("DPA") is entered into between the customer using IndexFixer Pro (the "Controller") and MuseAnn Paweł Zinkiewicz, ul. Droga Męczenników Majdanka 32/6, 20-334 Lublin, Poland, VAT ID PL9462484480 (the "Processor", operating the ZinkWP brand). It governs the processing of personal data under Regulation (EU) 2016/679 ("GDPR") in connection with the IndexFixer Pro service.

2. Subject matter and nature of processing

The Processor operates a hosted service (api.zinkwp.com) that, on the Controller's behalf:

stores the Controller's account data (email address, hashed password, billing status),
stores an encrypted Google OAuth token authorized by the Controller (read-only scope: webmasters.readonly),
queries the Google Search Console URL Inspection API for the Controller's verified property,
stores the resulting indexing statuses of the Controller's public URLs and mirrors them to the Controller's WordPress installation.

3. Categories of data and data subjects

Category	Data	Data subjects
Account data	Email address, hashed password, plan/billing status	The Controller's staff who register the account
Authorization data	Google OAuth refresh token (encrypted at rest), Google account email	The person authorizing GSC access
Service data	Public URLs of the Controller's website and their Google indexing statuses	Not personal data in typical use; may incidentally contain personal data if URLs embed it

4. Duration and retention

Data is processed for the duration of the service agreement.
Upon account deletion, account data, tokens and stored inspection results are deleted within 30 days; any residual copies in server backups expire within a further 30 days.
The Controller may revoke the Google authorization at any time in their Google account settings; the stored token becomes unusable immediately.

5. Sub-processors

The Controller authorizes the following sub-processors. The Processor will inform of changes in advance and the Controller may object on reasonable grounds.

Sub-processor	Purpose	Location
OVH SAS	Server hosting (dedicated server, EU)	France/Poland (EU)
Cloudflare, Inc.	DNS, TLS, DDoS protection, request proxying	EU/US (EU-U.S. Data Privacy Framework)
Google LLC	Search Console API (data source, on Controller's authorization)	EU/US (EU-U.S. Data Privacy Framework)
Stripe, Inc.	Payment processing (billing data only)	EU/US (EU-U.S. Data Privacy Framework)
Resend (Plus Five Five, Inc.)	Transactional email	US (SCC)

6. Security measures (Art. 32 GDPR)

OAuth tokens encrypted at rest (AES-256-GCM; key management separated from application data).
TLS for all data in transit (Cloudflare + origin TLS).
Passwords stored as bcrypt hashes; login rate-limiting per IP and per account.
Read-only Google scope — the service cannot modify the Controller's site or Search Console property.
Access to production infrastructure restricted to the Processor; SSH key authentication.
Server-side data stored in the EU (OVH).

7. Processor obligations

The Processor shall: process data only on documented instructions of the Controller (the service configuration constitutes such instructions); ensure confidentiality of persons authorized to process; assist the Controller in fulfilling data-subject requests (Art. 12–23) and security obligations (Art. 32–36); notify the Controller without undue delay after becoming aware of a personal data breach; make available information necessary to demonstrate compliance and allow audits within reason; delete or return data at the end of the service as described in Section 4.

8. International transfers

Primary processing and storage take place in the EU. Where sub-processors transfer data outside the EEA (Cloudflare, Google, Stripe, Resend), transfers rely on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses as indicated in Section 5.

9. Contact

Data protection contact: [email protected]