WordPress,
Shopify,
Wix, Webflow and Ghost. Any other site, hosted on your own domain →Last updated 30 October 2026
This Data Processing Agreement ("DPA") is between Nexborne Ltd, which provides Helio SEO ("we", "us"), and the customer who has accepted our Terms of Service ("you"). It forms part of the Terms and applies automatically when you use the Service. No signature is needed.
It sets out the terms required by Article 28(3) of the UK GDPR for the personal data we process on your behalf. If this DPA and the Terms disagree about personal data, this DPA wins.
"UK GDPR" and "Data Protection Act 2018" have their usual meanings, and "Data Protection Law" means both, with any other UK law on personal data. "Controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the UK GDPR. "Customer Personal Data" means personal data we process on your behalf under the Terms. "Sub-processor" means a company we engage to process Customer Personal Data. "Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the ICO under section 119A of the Data Protection Act 2018.
You are the controller of Customer Personal Data and we are your processor. You are responsible for having a lawful basis for the processing you ask us to do, and for the information you give to the people whose data it is.
For the data we use to run our own business, such as your account and billing details, we are a controller and our Privacy Policy applies.
Subject matter: providing Helio SEO to you under the Terms.
Duration: for as long as you use the Service, and then until the data is deleted or returned under section 12.
Nature: collecting, storing, organising, analysing, adapting, publishing, sending and deleting data, using automated tools including AI models.
Purpose: scanning your website, planning and writing articles, publishing them to your site or a blog we host, showing your search and reader results, and sending link requests you have switched on.
Types of personal data: names, job titles, contact details and other personal data that appear on your website or in material you give us. Your Search Console data. Contact details published on other websites, with link request emails and replies. IP addresses and browser details of readers of your articles, used only for counting and never stored. We do not ask for special category data and you should not give us any.
Data subjects: your staff, customers and others named on your website or in your material; readers of your articles; and contacts at websites we ask for links for you.
We process Customer Personal Data only on your documented instructions. The Terms, this DPA and the settings you choose in the Service are those instructions. We will not process it for any other purpose, unless the law requires us to, in which case we will tell you first unless the law forbids it.
We will tell you straight away if we think an instruction breaks Data Protection Law.
Only people who need access to provide or support the Service can reach Customer Personal Data. Everyone who works for us is bound by a duty of confidentiality.
We take the technical and organisational measures required by Article 32 of the UK GDPR. They include:
Encryption in transit: every connection to the Service uses HTTPS, with HTTP Strict Transport Security.
Account security: passwords stored only as salted scrypt hashes; sign-in cookies that are secure-only and cannot be read by scripts; sessions that expire after 30 days; repeated failed sign-ins slowed down; and every other browser signed out when a password changes.
Separation: each account can reach only its own sites and data, and only the account owner can delete the account.
Credentials: publishing credentials are held server-side, never shown back in full once saved, never sent to AI providers, and used only to deliver articles to your site.
Safe fetching: when the Service fetches web pages it refuses private and internal network addresses.
Data minimisation: reader counts are kept as daily totals only, with no cookie, identifier or IP address stored.
Hosting: servers in an EU data centre run by Hetzner.
We review these measures as the Service changes, and will not reduce the overall level of protection.
You authorise us to use the sub-processors below. We have a written contract with each that gives at least the protection in this DPA, and we remain responsible to you for what they do.
Hetzner Online GmbH (Germany): hosting and storage, in its Helsinki data centre in Finland.
Anthropic PBC (United States): AI models that plan and write articles, and find, draft and sort link requests and their replies.
Sendinblue SAS, trading as Brevo (France): delivery of the emails the Service sends you.
IONOS SE (Germany): our support inbox, which holds anything you email us.
Google LLC (United States): Google Fonts, which supplies typefaces to the blog pages we host, so readers' browsers send it their IP address.
Link request emails are not being sent yet. Before they are, we will add the mailbox provider that sends them to this list, under the notice rule below.
We will give you at least 30 days' notice by email to your account's owner before we add or replace a sub-processor, and update this page. You may object on reasonable data protection grounds within that time. If you do, we will try to find a solution. If we cannot, you may end the Service by email before the change takes effect, and we will refund any fees you have paid for the period after it ends.
Hetzner, Brevo and IONOS process data inside the European Economic Area, which the UK recognises as adequate. Anthropic and Google process data in the United States. For those transfers we rely on the Addendum, which forms part of our contract with each of them. We will not transfer Customer Personal Data outside the UK in any other way without a safeguard that Data Protection Law allows.
If someone asks us to use their data protection rights over Customer Personal Data, we will pass the request to you without undue delay and will not answer it ourselves unless you ask us to. Taking into account the nature of the processing, we will help you answer such requests, and help you meet your duties on security, breach notification, data protection impact assessments and consulting the ICO, under Articles 32 to 36 of the UK GDPR.
If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay, and in any case within 48 hours of becoming aware of it, by email to your account's owner.
We will tell you what happened, the kinds and rough number of people and records affected, the likely consequences, what we have done and will do about it, and who to contact. Where we do not yet know everything, we will send what we know and the rest as soon as we have it. We will take reasonable steps to contain the breach and limit the harm.
When the Service ends, you choose whether we delete Customer Personal Data or return it to you. You can delete everything yourself at any time from Settings, which removes it at once. If you would rather have a copy first, email hello@helioseo.io and we will send your articles and other data in a common format, then delete it.
We will not keep Customer Personal Data after that, unless the law requires us to.
On request, we will give you the information you reasonably need to show that we meet Article 28 of the UK GDPR, for example answers to a security questionnaire.
If that is not enough, we will allow for and contribute to an audit, including an inspection, by you or an independent auditor you choose who is bound by confidentiality. You must give us at least 30 days' notice, keep it to once a year unless a breach or a regulator requires more, and meet your own costs.
Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law does not allow it to be limited.
We may update this DPA when the law or the Service changes. We will not reduce the protection it gives without telling you first.
Questions about this DPA can be sent to hello@helioseo.io.
Terms of Service · Privacy Policy · Cookie Policy · Refund Policy · Data Processing Agreement
Nexborne Ltd. Registered in England and Wales. Company number 17375877. ICO registration ZC240034. hello@helioseo.io