Skip to content
PortyLink
Sign inGet started

Data Processing Agreement

Last updated 17 October 2026

This agreement (“DPA”) is part of the Terms of Service between PortyLink, a service of Tech Go Negev LTD (“we”, the processor) and the organization using PortyLink (“you”, the controller). It applies when we process personal data on your behalf, and follows Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR. It takes effect when you accept the Terms; no signature is needed.

1. What we process

  • Purpose: to provide PortyLink: connecting your Google Analytics and Search Console properties, showing reports, and sending report data to the people, AI agents and API keys you authorize.
  • Personal data: your team's names, email addresses and activity; Google account email addresses and OAuth tokens; and whatever personal data your Analytics and Search Console reports contain (usually aggregated statistics, sometimes search queries or page addresses).
  • Data subjects: your team members, and visitors to the websites you manage to the extent reports describe them.
  • Duration: for as long as you use PortyLink, then until deletion as described in section 7.

2. Your instructions

We process personal data only on your documented instructions: the Terms, this DPA, and how you configure PortyLink (which sites, agents and keys may read what). We tell you if we believe an instruction breaks data protection law. We never sell the data, use it for advertising, or use it to train AI models.

3. Confidentiality and security

Everyone who can access personal data is bound by confidentiality. We maintain the technical and organizational measures described on our security page, including encryption in transit, encryption of Google tokens at rest, database-level separation between organizations, role-based access, two-factor sign-in, and activity logging.

4. Sub-processors

You authorize the sub-processors listed on our sub-processors page. We bind each of them to data protection terms at least as protective as this DPA and remain responsible for them. We update that page at least 30 days before adding a new one, and you may object as described there.

5. International transfers

Your data is stored in the European Union. Where a sub-processor processes it outside the EU/EEA, the transfer is covered by the European Commission's Standard Contractual Clauses or another lawful mechanism, as listed on the sub-processors page.

6. Helping you

  • Data subject requests: PortyLink lets you export and delete your organization's data yourself. For anything else, we help you respond to requests to access, correct, delete or move personal data.
  • Breaches: we notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
  • Assessments: we provide reasonable information for your data protection impact assessments and consultations with supervisory authorities.

7. Deletion

When you delete your organization, we erase its data and revoke its Google access, unless another organization has connected the same Google account. Before deleting, owners and admins can export everything as JSON from Settings. Backups held by our providers expire on their normal cycle.

8. Audits

On request we make available the information needed to show compliance with this DPA, and answer reasonable security questionnaires. Write to hello@portylink.com.

9. Precedence

If this DPA conflicts with the Terms on the processing of personal data, this DPA applies.