Last updated: October 20, 2026
This Data Processing Addendum (“DPA”) forms part of the Terms of Service (or other master agreement) between Global Zone sp. z o.o. (“Processor”, “Ranksmile”) and the customer entity that accepts the Terms (“Controller”, “Customer”).
This DPA applies when Ranksmile processes personal data on Customer’s behalf in the course of providing the Service. It does not replace our role as independent controller for account, billing, and product operations data described in the Privacy Policy.
1. Definitions
Terms such as “personal data”, “processing”, “controller”, “processor”, and “sub-processor” have the meanings in the GDPR. “Customer Personal Data” means personal data contained in Customer Content or otherwise processed by Ranksmile solely on Customer’s documented instructions as a processor.
2. Roles
- Customer is the controller (or processor instructing Ranksmile as a sub-processor).
- Ranksmile is the processor for Customer Personal Data in the Service.
- Each party will comply with its obligations under applicable data protection law.
3. Details of processing
3.1 Subject matter and duration
Processing of Customer Personal Data to provide the Ranksmile Service for the term of the agreement and until deletion or return under this DPA.
3.2 Nature and purpose
Hosting, storage, transmission, analysis, AI-assisted processing, scoring, export, and related operations initiated by Customer users in the Service.
3.3 Types of personal data
As determined by Customer — commonly identifiers, contact data, content authored by individuals, URLs, and other data Customer chooses to upload or connect. Ranksmile does not control what Customer submits.
3.4 Data subjects
Customer’s personnel, contractors, end users, or other individuals whose data appears in Customer Content.
4. Instructions
Ranksmile will process Customer Personal Data only on documented instructions from Customer, including via the Service configuration, unless required by EU or Member State law. If we believe an instruction infringes GDPR, we will inform Customer (unless legally prohibited).
5. Confidentiality and personnel
Persons authorized to process Customer Personal Data are bound by confidentiality and receive appropriate training. Access is limited on a need-to-know basis.
6. Security
Ranksmile implements appropriate technical and organizational measures under Art. 32 GDPR, including access controls, encryption in transit, logging, and vulnerability handling practices proportionate to risk. Customer is responsible for securing its own accounts, API keys, and endpoint devices.
7. Sub-processors
Customer authorizes Ranksmile to engage sub-processors for infrastructure and product operations (for example hosting, database, email, monitoring, and AI providers used to deliver features Customer enables). We will impose data-protection terms no less protective than this DPA. A current list of material sub-processors is listed in section 5 of our Privacy Policy and available on request at privacy@tryranksmile.com.
We will provide notice of material sub-processor changes where practicable. Customer may object on reasonable data-protection grounds; if unresolved, Customer may terminate the affected Service as its sole remedy.
8. International transfers
Where Customer Personal Data is transferred outside the EEA/UK, Ranksmile will ensure a valid transfer mechanism (e.g. SCCs) with the relevant recipient, unless an adequacy decision applies.
9. Assistance
Taking into account the nature of processing, Ranksmile will assist Customer by appropriate technical and organizational measures with data-subject requests, DPIAs, and consultations with supervisory authorities, at Customer’s reasonable request and cost where the assistance is beyond standard product self-serve capabilities.
10. Personal data breach
Ranksmile will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide information reasonably available to help Customer meet Art. 33/34 obligations.
11. Deletion and return
Upon termination of the Service (or earlier written request), Ranksmile will delete or return Customer Personal Data within a commercially reasonable period, except where retention is required by law or needed for dispute resolution / security logs (retained under our own controller purposes where applicable).
12. Audits
Upon reasonable written notice, no more than once annually (unless a competent authority or confirmed breach requires otherwise), Customer may request information reasonably necessary to demonstrate compliance with this DPA, including summaries of security practices. On-site audits require mutual agreement on scope, timing, and confidentiality, and are at Customer’s expense unless a material breach of this DPA is found.
13. Liability
Liability under this DPA is subject to the limitations in the Terms, except where mandatory law provides otherwise regarding data protection claims.
14. Contact
Global Zone sp. z o.o.
ul. Michała Kleofasa Ogińskiego 11/9, 03-318 Warszawa, Poland
NIP: 1133098955 · KRS: 0001040092
privacy@tryranksmile.com · legal@tryranksmile.com