Skip to content
OMBZ
Sign in

Data processing agreement

Version 2026-10-18, effective 18 Oct 2026.

Draft: this agreement is being reviewed and is not final yet.

Permanent link to this version: https://ombz.com/en/data-processing-agreement/2026-10-18

This data processing agreement sets out how we process personal data on behalf of the businesses that use OMBZ, as Article 28 of the General Data Protection Regulation (GDPR) requires. It is part of the OMBZ beta terms, and of any later terms for OMBZ that refer to it.

1. Parties and roles

This agreement is between the business that uses OMBZ ("you") and Server.Biz BV ("we"). For the personal data in your website data, you are the controller and we are your processor. You accept this agreement on behalf of your business, together with the beta terms and with the same checkbox.

Processor
Server.Biz BV
Address
Van Vredenburchlaan 51, 2661 HE Bergschenhoek
Statutory seat
Bergschenhoek
Chamber of Commerce (KvK)
27306767
Email
privacy@ombz.com

Where this agreement and the terms differ about the processing of personal data, this agreement prevails. The law and the court chosen in the terms also apply to this agreement. This agreement exists in Dutch and in English. If the two versions differ, the Dutch version prevails.

2. Subject, duration, nature and purpose

We process personal data on your behalf only to provide OMBZ to you: we collect data about the websites you add from Google Search Console, Google Analytics, Google PageSpeed Insights, our crawler OmbzBot and, once those features are available to you, DataForSEO, and we store, analyse and show that data to you in the app and in emails. The processing lasts as long as described in section 15. Annex A describes it in more detail.

3. Categories of data subjects

  • People whose name or other details appear in search queries in the Search Console data of your websites.
  • People named in page addresses, page titles, meta descriptions or link texts of your websites, of websites that link to them and of the competitors you add, and in search results.
  • Your users, but only where you have us process their details as part of your website data. For their accounts (names, email addresses, sign-ins) we are the controller ourselves, as described in our privacy policy.

4. Categories of personal data

Keywords and competitor domains you enter, search query texts, page addresses (URLs), page titles, meta descriptions, link texts, and the titles and addresses of search results, as far as they contain personal data. We do not expect special categories of personal data (Article 9 GDPR) or data about criminal convictions. You do not add such data to OMBZ, for example as keywords.

5. Your instructions

We process the personal data only on your documented instructions, also with regard to transfers outside the European Economic Area. Your instructions are the terms, this agreement and the settings you choose in OMBZ, such as which websites, Google accounts, keywords and competitors you connect. We do not use the data for our own purposes. If the law requires us to process it in another way, we tell you before we do, unless the law forbids that. If we believe that an instruction infringes the GDPR or other data protection law, we tell you straight away.

6. Confidentiality

Everyone who works for us and has access to the personal data is bound to confidentiality, by contract or by law, and has access only where their work requires it.

7. Security

We take appropriate technical and organisational measures to protect the personal data against loss and against any form of unlawful processing, taking into account the state of the art, the costs and the risks. Annex B lists these measures. We may change them, but never in a way that lowers the overall level of protection.

8. Sub-processors

You give us general written authorisation to engage sub-processors. The current list, with the date of every change, is on our sub-processors page (Annex C). At least 30 days before we add or replace a sub-processor, we tell the owners of your workspace by email and update that page. You can object on reasonable data protection grounds within 14 days of that email. We then look for a solution with you. If we do not find one, you can end the agreement and your use of OMBZ before the change takes effect, and we refund any unused balance you have paid in full.

We impose the same data protection obligations as in this agreement on every sub-processor by contract. We remain responsible to you for the work of our sub-processors.

9. Transfers outside the European Economic Area

We store the personal data in the Netherlands and do not transfer it to countries outside the European Economic Area (EEA) ourselves. DataForSEO OÜ is established in Estonia; some of its own sub-processors are in the United States and rely on the EU-US Data Privacy Framework or on the standard contractual clauses of the European Commission. We do not engage DataForSEO for your data until it has confirmed which safeguard applies to any access from outside the EEA. If we ever transfer personal data outside the EEA ourselves, we do so only with a valid transfer mechanism under Chapter V of the GDPR, and after telling you as described in section 8.

10. Assistance

Taking into account the nature of the processing, we help you to respond to data subjects who exercise their rights, for example by finding or deleting the website data concerned. If a data subject contacts us about your website data, we pass the request on to you without delay and do not answer it ourselves unless you ask us to. We also help you with data protection impact assessments and with prior consultation of a supervisory authority, as far as they concern OMBZ, and with your other obligations under Articles 32 to 36 GDPR. We do this at no cost, unless a request takes an excessive amount of work; we then tell you the cost beforehand.

11. Personal data breaches

If we discover a personal data breach that affects your website data, we tell you without undue delay and at the latest within 48 hours after we discovered it. We give you the information listed in Article 33(3) GDPR as far as we have it: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures we have taken or propose, and a contact person. Information we do not have yet follows as soon as we have it. We record every breach, also those that do not have to be reported.

12. Deletion or return at the end

Until the agreement ends, and afterwards until the data is deleted, you can ask us for an export of your website data. Within 30 days after the end, we delete the personal data we process on your behalf; copies in backups are gone at most 14 days later. On request, we confirm the deletion in writing. We keep data longer only where the law requires it.

13. Audits

On request, we give you the information you need to show that we meet our obligations under Article 28 GDPR. You can audit this yourself, or have it audited by an independent auditor bound to confidentiality, at most once a year, with at least 30 days' notice, at your own cost and without disturbing our business more than necessary. A supervisory authority can always carry out an audit.

14. Liability

The liability of the parties under this agreement follows the liability clause of the terms that apply between us. That clause does not limit the rights of data subjects under Article 82 GDPR.

15. Duration

This agreement applies for as long as we process personal data on your behalf, also after the terms themselves have ended, until the data is deleted as described in section 12.

16. Annexes

Annexes A (description of the processing), B (security measures) and C (sub-processors) below are part of this agreement.

Annex A: Description of the processing

Controller
The business that uses OMBZ.
Processor
Server.Biz BV.
Purpose
Providing OMBZ to the controller: showing how its websites perform in search, with alerts and reports.
Nature of the processing
Collecting data through the Google Search Console, Google Analytics and PageSpeed Insights APIs, crawling the controller's websites with OmbzBot, receiving search results and backlink data from DataForSEO, and storing, analysing, showing and deleting that data.
Data subjects
As listed in section 3.
Personal data
As listed in section 4. No special categories.
Frequency
Continuous while OMBZ is used: regular imports from Search Console and Google Analytics, crawls and PageSpeed measurements on a schedule or on request, and rank and backlink checks once those features are available.
Retention
Until the controller deletes the website or the workspace, or earlier on request. The data is then deleted within 30 days, and from backups at most 14 days later.
Location
Our own servers in Amsterdam, the Netherlands.

Annex B: Security measures

  • Two-factor authentication is required for every user, and every email address is verified before the account can be used.
  • Passwords are stored only as one-way hashes. Google access tokens and two-factor secrets are stored encrypted.
  • Every workspace is strictly separated from the others. A dedicated set of automated tests checks this separation on every change to the software.
  • Access is checked in layers: every page and action requires a signed-in user, membership of the workspace and the right role.
  • Access to Google is read-only and can be ended at any time by disconnecting Google, which deletes the stored tokens.
  • OmbzBot stores page addresses, titles, meta descriptions and links, not the content of pages. Google Analytics data is stored only in aggregated form, without data about individual visitors.
  • All connections to OMBZ are encrypted (HTTPS).
  • A security log records sign-ins and important actions and is kept for 12 months. Server logs are kept for at most 30 days.
  • Backups are made regularly and kept for at most 14 days.
  • The server software and the software libraries OMBZ uses are kept up to date; the libraries are checked for known vulnerabilities on every change.
  • Our staff have access to personal data only where their work requires it, and are bound to confidentiality.
  • The data is hosted on our own servers in a data centre in Amsterdam, the Netherlands.
  • The data centre has physical access control; only our own staff manage the servers.

Annex C: Sub-processors

The sub-processors we use are listed, with the date of every change, at https://ombz.com/en/sub-processors. That list is part of this agreement; changes follow section 8.