--- title: "Data Processing Agreement - Serpwise" description: "How Codeful ApS processes personal data for Serpwise customers, including security, subprocessors and retention." url: "https://serpwise.ai/legal/dpa/" source: "https://serpwise.ai/legal/dpa/" --- # Data Processing Agreement **DPA version:** 2026-09-14 **Effective date:** The date on which both parties accept this DPA and its schedules, recorded with the service order or a separate acceptance. ## 1. Parties, roles, and precedence **Processor:** Codeful ApS, CVR 39453584, VAT DK39453584, Åbogade 15, 8200 Aarhus N, Denmark, operating Serpwise AI. Data-protection contact: [**hello@serpwise.ai**](mailto:hello@serpwise.ai). **Customer:** The legal entity identified in the accepted service order and Schedule A. The customer acts as controller of the personal data covered by this DPA, or as processor for its own controller where expressly identified in Schedule A. In the latter case, Codeful acts as subprocessor. The customer must hold the necessary upstream authorization and communicate lawful instructions; the equivalent processor obligations in this DPA apply throughout that arrangement. Actual roles follow the processing performed, not contractual labels alone. This DPA forms part of the Serpwise service agreement and governs personal data Codeful processes on the customer’s behalf (“Customer Personal Data”). It prevails over inconsistent service terms on that processing. Mandatory law and applicable international-transfer standard contractual clauses take precedence. Terms such as controller, processor, personal data, processing, and personal data breach have their GDPR meanings. Applicable data-protection law means the GDPR and applicable Danish or other EU/EEA implementing legislation. Codeful’s separate processing for its own purposes, such as managing its commercial relationship, invoicing, and meeting its own legal duties, falls outside this DPA and must have its own lawful basis and privacy information. This distinction does not authorize Codeful to reuse Customer Personal Data for its own purposes. ## 2. Scope and documented instructions Schedule A sets out the processing subject matter, duration, purposes, activities, data types, and data subjects. Schedules B–D set out security, providers/locations, and retention and exit instructions. All schedules form part of this DPA. Codeful shall process Customer Personal Data only on documented customer instructions, including instructions about transfers outside the EEA. Instructions comprise this DPA, its schedules, the accepted order, and authorized feature settings or written requests consistent with them. A setting cannot authorize processing outside the agreed scope or override mandatory law. Codeful shall preserve an appropriate record of instructions and changes. If EU or Member State law requires processing beyond those instructions, Codeful shall inform the customer of that requirement before processing, unless the law prohibits notification on important public-interest grounds. Codeful shall immediately inform the customer if, in its opinion, an instruction infringes applicable data-protection law, and suspend the affected instruction pending resolution where necessary to avoid unlawful processing. The customer determines its purposes and lawful basis, provides required notices, obtains required consents, and ensures its instructions are lawful. The customer may issue supplementary instructions, inspect compliance, and require correction or restriction of processing. These responsibilities do not remove Codeful’s own legal obligations. ## 3. Confidentiality and permitted use Codeful shall limit access to authorized personnel with a work-related need and ensure they are bound by contractual confidentiality or an appropriate statutory duty. Personnel shall receive appropriate data-protection and security instruction; access shall be withdrawn when no longer needed. Confidentiality continues after access or the agreement ends. Customer Personal Data may not be sold, used for Codeful’s own advertising, or used to train or improve general-purpose/shared AI models under this DPA. AI processing is permitted only for the customer’s requested feature through an authorized provider, under the documented purposes and retention settings in Schedule C. Any proposed additional purpose requires a separate lawful arrangement and may change the parties’ roles; it is not authorized by acceptance of this DPA. ## 4. Security Codeful shall implement and maintain the appropriate technical and organisational measures in Schedule B, considering the state of the art, implementation costs, the nature and scope of processing, and risks to individuals. These shall support confidentiality, integrity, availability, resilience, timely restoration, and regular evaluation of effectiveness. Codeful shall regularly assess relevant risks and address identified weaknesses. Security changes may not materially reduce the agreed level of protection. Codeful shall provide relevant information about material changes so the customer can assess continued suitability. Claims about certifications, encryption, hosting geography, or recovery performance apply only where specifically documented and verified in the schedules. ## 5. Subprocessors The customer gives general written authorization for the subprocessors identified in the Schedule C. Codeful shall give at least **30 days’ advance written notice** of additions or replacements, identifying the entity, service, data involved, locations, and transfer safeguards. The customer may object on reasonable data-protection grounds before the change takes effect. The parties shall seek a solution, such as an alternative provider or disabling the affected feature. Codeful shall not give the disputed new provider access to that customer’s data while the objection remains unresolved. If no compliant solution can be agreed, the customer may terminate the affected service without an early-termination penalty and receive a refund of prepaid subscription fees for the unused affected period. Existing providers remain subject to applicable law and the agreed arrangements during resolution. Before access, Codeful shall bind each subprocessor to obligations offering at least the same protection for the entrusted processing as this DPA. Codeful shall assess and monitor sufficient guarantees, maintain the provider inventory, and remain fully responsible to the customer for the subprocessor’s performance of those obligations. Codeful shall provide relevant contractual and compliance information on request, subject to necessary redaction that does not obstruct verification. Customer-selected analytics, advertising, and webhook destinations must be assessed separately: they are not automatically Codeful subprocessors. Their actual role, authorization, data flow, and transfer arrangements must be documented in Schedule C before forwarding begins. ## 6. International transfers and access Codeful shall process data only in the agreed locations and shall not initiate a restricted third-country transfer without documented authorization and a valid GDPR Chapter V mechanism. The assessment must include relevant remote access and onward transfers, not just server location. Where relying on adequacy, Codeful shall verify its applicability to the recipient and processing. Where required, the parties shall execute the appropriate international-transfer clauses, assess destination-country risks, and implement necessary supplementary measures. This DPA is not itself an international-transfer mechanism, and an Article 28 agreement does not replace transfer safeguards. Codeful shall assess legally binding disclosure requests, challenge them where there are reasonable grounds, limit disclosure to what is legally required, and notify the customer unless prohibited. Codeful shall inform the customer if agreed safeguards can no longer be met and suspend affected transfers where necessary until lawful safeguards are restored. ## 7. Assistance and data-subject requests Taking account of the nature of processing, Codeful shall provide appropriate assistance with requests for access, rectification, erasure, restriction, portability, objection, and other applicable Chapter III rights. It shall promptly pass requests concerning Customer Personal Data to the customer and shall not decide or respond substantively on the customer’s behalf unless instructed or legally required. Codeful shall assist with security obligations, breach assessments and notifications, data-protection impact assessments, and prior consultation with supervisory authorities, taking account of the processing and information available to Codeful. Assistance includes relevant technical facts, available records, and execution of lawful corrective instructions. Timelines shall enable the customer to meet applicable statutory deadlines. Any fee discussion shall not delay or prevent legally required assistance; Codeful shall not charge to remedy its own breach. ## 8. Personal data breaches Codeful shall notify the customer’s contact in Schedule A **without undue delay** after becoming aware of a personal data breach affecting Customer Personal Data. It shall not wait for a complete investigation or condition notification on its own view that the breach creates a high risk. Initial notification may be followed by updates as facts become available. The notification shall provide available information about the incident, affected data and data-subject categories and approximate numbers, likely consequences, remedial and mitigation measures, and a contact for follow-up. Codeful shall contain and investigate the breach, preserve relevant evidence, cooperate with the customer, and provide updates and a written account of material findings and remediation. The controller decides on notification to authorities and individuals unless law independently requires Codeful to act. Codeful shall assist promptly; the controller’s possible 72-hour regulatory deadline is not a 72-hour waiting period for Codeful. ## 9. Evidence, audits, and cooperation Codeful shall make available information necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the customer or an independent auditor mandated by it. This includes appropriate access to processing records, policies, relevant personnel, systems evidence, and information needed to assess subprocessors. Audits shall use reasonable notice and confidentiality/security arrangements to protect other customers and service continuity. Existing reports may be used where adequate, but shall not replace necessary inspection rights. Shorter notice or additional audits may be justified by a breach, substantiated concern, or supervisory authority request. Audit arrangements or charges shall not make the rights ineffective. Both parties shall cooperate with competent supervisory authorities and provide legally required information. ## 10. Retention, return, and deletion Codeful shall retain Customer Personal Data only for the agreed purposes and periods in Schedule D and implement the customer’s lawful deletion and restriction instructions. At the end of the processing services, the customer chooses return and subsequent deletion, or deletion, of Customer Personal Data and copies. Codeful shall implement the choice within Schedule D’s retention and deletion rules and confirm completion on request. Where EU or Member State law requires retention, Codeful shall identify the legal basis and affected data unless prohibited, isolate the retained data, limit processing to that duty, and erase it when the duty ends. Backup copies remain subject to the retention, isolation and restoration safeguards in Schedule D. Pending authorized return, deletion, or mandatory retention, this DPA remains in force. Statutory switching/retrieval rights and GDPR requirements shall be reconciled in the exit instructions; commercial disputes do not permit indefinite retention or withholding statutory rights. ## 11. Suspension, termination, and liability If Codeful breaches this DPA, the customer may require suspension of affected processing until compliance is restored. The customer may terminate affected processing where compliance cannot be restored within a reasonable period, there is a substantial or persistent breach, or a binding decision requires termination. Codeful may terminate affected processing where the customer insists on an unlawful instruction after being informed. Return and deletion obligations continue to apply. Service-agreement liability provisions apply only so far as consistent with this DPA and mandatory law. Nothing limits data subjects’ statutory rights, supervisory powers, or liability that cannot lawfully be limited, including rights under GDPR Article 82. Codeful’s subprocessor responsibility in section 5 remains in force. ## 12. Acceptance, changes, and contacts This DPA must be accepted with its schedules before the covered processing begins. Acceptance may be electronic as part of an order expressly incorporating this version, or by separate signature. The parties shall retain evidence identifying the customer, authorized accepter, version, schedules, and acceptance date. This DPA applies prospectively from acceptance. Material changes require the applicable written agreement, except provider changes following section 5 and lawful customer instructions within the existing scope. No change may diminish mandatory protection. The service agreement’s governing law and forum apply subject to mandatory data-protection law and supervisory competence. **Codeful operational contact:** [hello@serpwise.ai](mailto:hello@serpwise.ai). **Customer contact:** Schedule A. These are operational contacts, not a representation that either party has appointed a statutory DPO. ## Schedule A — Customer and processing particulars | Item | Particulars | |--------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Customer | The business customer identified by its legal name, address and organization/account identifier in the accepted order or service agreement; those details are incorporated here by reference. | | Customer role | Controller for its own purposes; where an agency processes for a client, processor for that client, as identified in the order or written instructions, with the necessary upstream authorization. | | Customer contact | The organization owner at the email registered on the account, unless an authorized contact has designated another contact in writing. The customer shall keep this contact current and available for incident notices. | | Service scope | Connected domains, selected features, authorized destinations and settings recorded in the order and instruction history. The accepted order and authorized configuration identify the applicable selection and are incorporated by reference. | | Subject matter | Processing website traffic and customer-provided content to deliver configured proxy, SEO, analytics, AI, and optional conversion-tracking services. | | Duration/frequency | Continuous request processing while traffic is routed; periodic/on-demand crawling and AI operations; event-driven tracking where enabled; storage under Schedule D, including limited exit processing. | | Data subjects | Website visitors, leads and customers; individuals named in customer website content or submissions; customer/agency personnel whose details occur in customer-controlled workspaces, instructions or support material. | | Activity and purpose | Potential Customer Personal Data, limited to enabled features | |----------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Route, secure and optimize traffic | IP address, user-agent, URL/path/query, timestamps, method/status, referrer, bot classification; headers, cookies and request/response content encountered in transit. Transient handling is processing even where not logged. | | Cache, crawl, index and manage content | Page text/HTML and metadata, names or other personal data appearing in pages, generated suggestions, customer instructions and revision records. Personalized/private pages require appropriate exclusion controls. | | Analytics and attribution | Request metadata, visitor/session and click identifiers, attribution context, consent signals, event and conversion records. | | Optional conversion tracking | Email, phone and other configured identity fields; hashed identifiers; browser/ad identifiers; order identifiers, product details, value/currency; event payloads, delivery/replay records and configured recipients. Hashing does not automatically make data anonymous. | | Optional AI features | Selected page content, prompts and inputs, generated output and related operational metadata. Only task-required inputs may be submitted, subject to sections 3, 5 and 6 and Schedules C–D. | | Customer support and administration on instruction | Customer-submitted troubleshooting data, support attachments, workspace user information and audit records within the agreed scope. | Article 9 special-category data, Article 10 criminal-offence data, national identification numbers, payment-card security data, and other high-risk content are not intended feature inputs. Deliberate processing of such data requires a prior written scope/risk/security assessment and lawful instructions. This restriction does not pretend incidental data cannot occur in routed traffic, URLs, or pages; the parties must assess foreseeable exposure and configure appropriate exclusions and minimization. Do not enable a use case whose risks the agreed safeguards cannot address. ## Schedule B — Technical and organisational measures Codeful shall maintain the following safeguards for the processing covered by this DPA. These are contractual requirements; no independent certification or universal encryption-at-rest guarantee is given by this agreement. | Area | Measures | |---------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Access management | Limit access by role, organization and work-related need. Use individual authorization for staff, protect privileged access with key-based or equivalently strong authentication, review permissions regularly and remove access when no longer needed. | | Transport and credentials | Protect dashboard and visitor-to-edge connections using HTTPS/TLS. Protect internal and provider connections through encryption or appropriately restricted private networks. Use HTTPS to customer origins where configured; notify the customer of an insecure origin connection and agree appropriate protection. Restrict access to API keys and integration credentials, protect stored secrets, and revoke or rotate compromised credentials. | | Storage and separation | Restrict network and administrative access to databases, logs, indexes, caches and object storage. Apply organization/domain access boundaries. Select encryption, pseudonymization and other measures according to risk; assess any stronger storage requirements before accepting the affected processing. | | Data minimization | Limit recorded fields and AI inputs to the enabled purpose. Apply exclusions for private or personalized pages in shared caching. Respect configured consent and destination settings for optional tracking; restrict sensitive troubleshooting material and prevent secrets from entering ordinary logs. | | Personnel and providers | Bind authorized personnel to confidentiality, provide appropriate instruction, and assess and monitor providers’ access and physical-security protections. | | Operations | Maintain security updates, vulnerability assessment, controlled configuration changes and incident handling. Monitor relevant security events, investigate suspected unauthorized access and maintain records needed for remediation and customer assistance. | | Recovery | Maintain restricted-access backups and recovery procedures. Forge database backups are scheduled twice daily, stored in DigitalOcean Spaces in Amsterdam and retained for 30 days. Test restoration periodically and reapply deletion instructions before restored data returns to ordinary use. No fixed recovery time or recovery point is promised unless separately agreed. | | Evaluation and assistance | Regularly assess these measures and after material changes or incidents. Provide information needed to assess compliance, investigate failures in export or deletion, and verify corrective action across active systems, external stores and subprocessors. | ## Schedule C — Subprocessors and international processing The following providers support the listed service functions. Authorization is limited to processing necessary for the customer’s enabled services and remains subject to sections 3, 5 and 6. Optional providers do not receive every customer’s data. Customer-specific routing, any applicable regional contracting affiliate and additional processing/access countries shall be identified to the customer in writing before that processing; those particulars form part of this schedule. A listed provider is not authorization for an undisclosed transfer. | Provider | Function and data scope | Storage or routing information | |---------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Hetzner Online GmbH | Application/AI infrastructure and edge hosting; hosted customer content, databases and request metadata as needed for the assigned workload. | AI hosting in Nuremberg, Germany; edge infrastructure in Germany and the United States. | | OVHcloud | Edge hosting; proxied requests and associated network metadata. | London, United Kingdom; Warsaw, Poland; Beauharnois, Canada. | | EDIS GmbH | Copenhagen edge hosting; proxied requests and network metadata. | Copenhagen, Denmark. | | Fly.io, Inc. | Ingress routing where used; encrypted traffic passthrough and connection metadata. | Routing locations include Frankfurt, Amsterdam, London and Ashburn, United States. | | Cloudflare, Inc. | R2 object storage and related delivery of customer media/content. | The application images bucket uses Eastern Europe (EEUR). This location setting is not a guarantee of exclusively EEA processing or support access. | | Plus Five Five, Inc. (Resend) | Transactional email delivery; recipient details and message content where sent on the customer’s instruction. | United States-based service; applicable delivery and support processing is subject to section 6. | | Google (Gemini), Anthropic and OpenAI | Optional AI generation and analysis; selected page content, prompts, task inputs and output. | Provider services may involve EEA and United States processing. The provider and routing for the enabled task are subject to the written processing particulars and section 6. | | Perplexity and DataForSEO OÜ | Optional search, research and visibility measurement; submitted queries, page references and relevant task inputs. | International API services; Perplexity is US-based and DataForSEO is Estonia-based. Headquarters do not establish exclusive data location; task routing is subject to section 6. | | Webshare Software, Company | Proxy services used for fetching/crawling; requested URLs and associated connection metadata and content. | International proxy network. The configured Denmark preference does not itself restrict all provider processing to Denmark. Specific routing outside the agreed locations requires the authorization and safeguards in section 6. | | DigitalOcean, LLC | Forge database backup storage; copies of the backed-up application data. | Spaces, AMS3, Amsterdam, Netherlands; 30-day retention. Provider administration and onward access remain subject to section 6. | Codeful shall maintain the applicable provider agreements, instructions, processing-location records and transfer assessments and make relevant information available under section 9. The customer may request the current processing record at [hello@serpwise.ai](mailto:hello@serpwise.ai). For restricted transfers, Codeful shall apply an applicable adequacy decision or appropriate standard contractual clauses and necessary supplementary measures before access. US provider incorporation or an EEA storage region alone is not a transfer safeguard. Changes follow section 5. AI providers may process only the inputs necessary for the requested task. Codeful shall use contractual terms and account settings that restrict processing to the authorized service purpose and enforce section 3’s prohibition on shared-model training. Any provider retention necessary for security or abuse prevention must be limited to the authorized purpose, disclosed in the processing record and compatible with Schedule D. A feature must not submit Customer Personal Data where those conditions cannot be met. Customer-selected Meta, TikTok, Google Ads/GA4, Snapchat, Pinterest, X and webhook destinations are governed by the customer’s documented selection, consent settings and applicable recipient agreements. They are not automatically Codeful subprocessors. Their actual roles and any required transfer safeguards must be established before delivery. Stripe’s processing for Codeful’s own billing and Codeful’s own account emails fall outside customer-instructed processing under this schedule. ## Schedule D — Retention, return and deletion These periods distinguish ongoing service storage from deletion at the customer’s instruction. A shorter lawful deletion instruction takes priority over an ordinary retention period. Retention does not authorize use for another purpose. | Data | Ordinary service retention | |---------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Raw request and staging logs | Configured expiry of 365 days. Expired data is removed through asynchronous storage cleanup. Shorter subscription history windows limit dashboard access, rather than changing this storage period. Associated identifiable copies and aggregates remain subject to purpose limitation and the deletion rules below. | | Behavioral and security events | 90-day retention policy; cleanup is scheduled. Records required for a specific incident or legal duty are isolated and retained only for that purpose. | | Sera tool traces and run events | Detailed tool traces: 30 days. Run events: 90 days. | | Raw ranking snapshots | 90 days. | | Customer content, crawls, indexes, generated output, conversations, memories and workspace instructions | For the life of the relevant domain/workspace while needed for the enabled service, or until a deletion instruction. Temporary task material is removed when no longer needed for the task or its permitted security purpose. | | HTML cache | For the configured cache lifetime, subject to invalidation and bypass rules. A removal instruction also applies to cached copies. | | Conversion deliveries, replay queues and support material | While needed to deliver or troubleshoot the instructed event or support request. Stop replay on withdrawal of the destination instruction; remove associated personal data when the purpose ends or upon a lawful deletion instruction. | | Integration credentials | While the authorized integration remains connected; revoke or remove on disconnection or a lawful deletion instruction. | | Forge database backups | DigitalOcean Spaces, Amsterdam: 30 days for each of the two daily backup jobs. | **Request and retrieval.** Send instructions from an authorized customer contact to [hello@serpwise.ai](mailto:hello@serpwise.ai). The customer chooses secure return followed by deletion, or deletion only. Codeful shall verify authority and the recipient and agree a secure delivery channel. Return covers the customer’s available personal data in a commonly used machine-readable format. The [switching and exit arrangements](/legal/terms/#switching-and-exit-arrangements) govern any applicable transition and retrieval period; ordinary subscription cancellation alone is not an instruction to delete the organization. **Active systems.** Self-service account, organization and domain deletion has a 30-day recovery period followed by scheduled purge. An explicit request for earlier erasure will be handled separately where legally required. After the applicable recovery or retrieval period ends, Codeful shall delete the affected personal data without undue delay from databases, object storage, indexes, vectors, caches and applicable provider systems. Codeful shall investigate failed deletion operations, repeat or otherwise complete them, and verify completion; submission of a deletion job is not completion. The ordinary log-retention periods above do not postpone an applicable erasure instruction. **Backups and residual copies.** Once data has been removed from active systems, existing Forge database backup copies expire within the remaining part of their 30-day retention cycle. During that interval they shall be isolated from ordinary use. Codeful shall prevent deleted data returning to active use after restoration. Any separate disaster-recovery copy remains subject to the same return/deletion instruction and shall not be retained indefinitely or reused. Codeful shall identify its remaining lifecycle in the deletion response. The 30-day backup period is measured from backup creation, not automatically from the customer’s original request. **Legal retention and confirmation.** If law requires residual retention, Codeful shall identify the data, legal basis and necessary period, restrict processing to that duty and erase it when the duty ends. Codeful’s own proportionate records of account administration or legal claims are covered by its privacy policy, not a permission to retain customer content indefinitely. On request, Codeful shall provide a deletion record distinguishing completed active-system deletion, pending backup expiry, provider deletion and any lawful residual retention.