Data Processing Agreement
Last updated: 20 October 2026 · Download PDF
This Data Processing Agreement (“DPA”) under Article 28 of the EU General Data Protection Regulation (GDPR), and the UK GDPR where it applies, forms part of the Terms of service between the customer and W System Hungary Kft.
How to accept it
You accept this DPA online when you create an account (the sign-up checkbox covers the Terms, the Privacy Policy and this DPA) or by using the service. If you need a signed copy, email hello@decayqueue.com with your company name and address and we send a countersigned PDF.
1. Parties and roles
- Controller: the customer (the company that opens the DecayQueue account). When an agency uses the service for a client site, the agency confirms it is allowed to instruct us for that client, and acts as processor for its client with us as its sub-processor.
- Processor: W System Hungary Kft., Harmat u. 208., 1108 Budapest, Hungary, company registration number 01-09-470081, EU VAT HU33119856, hello@decayqueue.com.
2. Subject matter, duration, nature and purpose
Analysing the customer’s Google Search Console data and website content, drafting and checking content, saving drafts to and (only when approved or when auto-publish is switched on) publishing them on the customer’s WordPress site, and reporting results. For the term of the customer’s account, plus the deletion period in section 9.
3. Types of personal data and data subjects
- Customer users: name, work email, login data, settings, correspondence.
- Personal data contained in website content the Editor account can access, for example author names, and commenter names, email and IP addresses in WordPress comments. DecayQueue doesn’t need comments and doesn’t use them.
- Search Console data is aggregated (pages, queries, clicks, impressions, positions) and normally contains no personal data of site visitors.
No special categories of personal data are intended to be processed.
4. Processor obligations
- Process personal data only on the customer’s documented instructions: these terms, the settings the customer chooses in the app, and written instructions by email. We tell the customer if we believe an instruction breaks data protection law.
- Make sure everyone authorised to process the data is bound by confidentiality.
- Take the technical and organisational measures described on the Security page (Article 32), including encryption of stored WordPress credentials, access limited to what the service needs, HTTPS, and per-site separation of data.
- Help the customer, as far as reasonably possible, respond to data subject requests and meet its obligations under Articles 32 to 36.
- Notify the customer without undue delay after becoming aware of a personal data breach affecting customer data, with the information available at the time.
- Make available the information needed to show compliance with Article 28 and allow audits by the customer or an auditor it mandates, with reasonable notice, at most once a year unless there was a breach, and at the customer’s cost.
5. Sub-processors
The customer gives general authorisation for the sub-processors listed below. We impose data protection obligations on them equivalent to this DPA. We announce new or replaced sub-processors by updating this page and emailing account owners at least 14 days before the change; the customer may object on reasonable grounds and, if we can’t resolve it, cancel the affected sites without penalty.
| Sub-processor | What for | Data |
|---|---|---|
| Cloudflare, Inc. (USA; global network) | Hosting of decayqueue.com and the app; app database (accounts, sites, encrypted WordPress credentials, queue, drafts, reports); security logs | Account and site data, page content and drafts, Search Console figures |
| Google LLC / Google Ireland | Search Console API (reading your data with our read-only service account); Google Workspace email for hello@ and outreach | Search Console figures; business email correspondence |
| OpenAI, L.L.C. (USA) | AI model provider: drafting, the automated source check, the quality gate, AI-answer visibility checks, support and outreach email drafting | Page content, search queries and figures for the page; business contact data in correspondence |
| SerpApi, LLC (USA) | Search lookups to find primary sources for a draft and to check Google AI Overviews for tracked questions | Search phrases only (no personal data) |
| Resend, Inc. (USA) | Sending app emails (sign-up confirmation, password reset, weekly digest, free-check results) | Name and email address, email content |
| Stripe Payments Europe, Ltd. (Ireland) | Card payments, subscriptions, invoices and VAT calculation (Stripe Tax) | Billing contact, company and VAT details; card data is handled by Stripe only |
| Hetzner Online GmbH (Germany) | Hosting of blog.decayqueue.com | Blog visitor server logs |
| Web3Forms (form delivery) | Delivering the contact and custom-quote forms to our inbox | What you type into the form |
| W System engine server | The weekly analysis and drafting runs on a server operated by W System | Search Console snapshots, copies of the pages being refreshed, drafts and backups |
6. International transfers
Some sub-processors are in the USA. Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission’s Standard Contractual Clauses (and the UK Addendum for UK data).
7. Customer obligations
The customer has a lawful basis for the processing, has the right to connect the sites and accounts it adds (including client sites), and keeps its instructions lawful.
8. Liability
As set out in the Terms, unless the law requires otherwise.
9. Deletion and return
Removing a site in the app deletes its queue, drafts, backups and reports from the app database straight away, and its stored WordPress credential. Deleting the account removes the account and its sites. Remaining copies on the engine server, including Search Console data and page content, are deleted within 90 days after the last measurement report, unless the customer asks for earlier deletion or the law requires us to keep them. Before deletion the customer can download its reports from the app or ask us for an export.
10. Law
Hungarian law. Courts of Budapest. If this DPA conflicts with the Terms on data protection, this DPA prevails.