1. Parties & scope
This Data Processing Addendum (“DPA”) supplements the Terms of Service between you (“Customer”, the controller) and Shape Your Brand LLC (a Florida USA limited liability company, trading as RenderBeam — the processor) and applies whenever RenderBeam processes personal data on Customer's behalf in the course of providing the Service. It is binding from the moment Customer accepts the Terms.
2. Subject matter, nature, purpose & duration
- Subject matter: pre-rendering of Customer's web pages for delivery to search-engine and AI crawlers.
- Nature & purpose: fetching, rendering, caching, serving HTML, generating analytics about bot traffic.
- Categories of data subjects: visitors of Customer websites whose personal data may incidentally appear in rendered HTML; Customer's end users referenced in pages.
- Categories of personal data: any data Customer chooses to publish in rendered pages; technical metadata (URL, bot user-agent, response code, latency).
- Duration: for the term of the Service plus retention periods set out in the Privacy Policy.
3. RenderBeam's obligations
- Process personal data only on documented instructions from Customer (the Service configuration constitutes such instructions).
- Ensure that personnel authorised to process the data are bound by confidentiality obligations.
- Implement appropriate technical and organisational measures — see §5.
- Assist Customer with data-subject requests, DPIAs, and breach notifications.
- Notify Customer without undue delay (within 72 hours) after becoming aware of a personal data breach affecting Customer data.
- Make available all information necessary to demonstrate compliance and allow audits, subject to reasonable confidentiality and frequency limits.
4. Sub-processors
Customer grants general authorisation for RenderBeam to engage the sub-processors listed at /legal/subprocessors. We will provide at least 30 days' notice of any changes (by email or via this page); Customer may object on reasonable data-protection grounds, in which case the parties will work in good faith to resolve the objection — failing which Customer may terminate the affected portion of the Service.
5. Security measures
RenderBeam maintains, at minimum:
- TLS 1.2+ in transit and AES-256 at rest (provided by underlying infrastructure).
- Row-Level Security on all multi-tenant database tables.
- Hashed (SHA-256) API keys and IP addresses.
- Principle of least privilege for staff access; SSO + MFA on admin accounts.
- Continuous monitoring, automated dependency scanning, and a published security overview at /legal/security.
6. International data transfers
Where RenderBeam transfers personal data outside the United States/UK/Switzerland, the Standard Contractual Clauses (Module 2 or Module 3 as applicable) and the UK International Data Transfer Addendum apply, with the additional safeguards described in the relevant sub-processor's certification (DPF, SCCs, ISO 27001, SOC 2).
7. Data subject rights
RenderBeam will provide Customer with the tools to respond to data-subject requests directly (export, deletion, rectification through the dashboard) and will assist with manual requests at no extra cost where reasonably required.
8. Return or deletion of data
On termination of the Service, RenderBeam will delete or return Customer personal data within 90 days, except where retention is required by law. Backups are deleted in line with their normal rotation cycle (no longer than 35 days).
9. Liability
Each party's liability under this DPA is subject to the limitations set out in the Terms of Service.
10. Order of precedence
In case of conflict between this DPA and the Terms, this DPA prevails for matters of personal data processing.
Explore RenderBeam
Learn what we do, how we price it, and how to get set up.