Data Processing Addendum
Last updated: July 4, 2026
Illustrative template. This page summarizes the Data Processing Addendum (DPA) Growlift offers to customers who are subject to GDPR, UK GDPR, or similar data-protection laws. A counsel-reviewed, signable DPA is available on request and forms part of the agreement between you (the controller) and Growlift (the processor).
Roles
For personal data you submit or that Growlift processes on your behalf, you act as the data controller and Growlift acts as the data processor. Growlift processes personal data only on your documented instructions, which include the instructions expressed through your use of the product.
Subject matter and duration
The subject matter is the provision of the Growlift SEO automation service. Processing lasts for the term of your subscription plus the retention windows described in our Data Retention Policy.
Nature and purpose of processing
- Crawling and analyzing your connected website(s) and Search Console data
- Generating, reviewing, and publishing content on your instruction
- Producing analytics, reports, and product notifications
- Providing support and maintaining the security of the service
Categories of data subjects and personal data
Data subjects are primarily your team members and account users. Personal data is limited to account and contact details (name, email, workspace role), authentication identifiers, and any personal data incidentally present in content you ask Growlift to work with. Growlift is not designed to process special-category data.
Sub-processors
Growlift uses the sub-processors listed on our sub-processor page. We give notice of new sub-processors and offer a reasonable opportunity to object, as set out in the signable DPA.
Security
Growlift maintains technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and audit logging. See our security overview for detail.
International transfers
Where personal data is transferred outside the EEA or UK, the signable DPA incorporates the applicable Standard Contractual Clauses and the UK International Data Transfer Addendum.
Data subject rights, breach notification, and deletion
Growlift assists you in responding to data-subject requests, notifies you without undue delay after becoming aware of a personal-data breach, and, on termination, deletes or returns personal data in line with our Data Retention Policy.
To execute a signed DPA, contact your account owner or email privacy@growlift.com.