Data Processing Agreement

Version 1.0

This Data Processing Agreement ("DPA") is between ScrapeOps Ltd, a company registered in Ireland with company number 723170 ("ScrapeOps"), and each customer with a paid ScrapeOps subscription ("Customer").

This DPA forms part of the agreement under which ScrapeOps provides its services to Customer. That agreement is the ScrapeOps Terms and Conditions, or a signed order form or enterprise agreement that refers to them (the "Agreement"). This DPA applies whenever ScrapeOps processes Customer Personal Data on Customer's behalf.

To get a signed copy, or to name notification contacts for breach and subprocessor notices, email info@scrapeops.io.

1. Definitions

In this DPA:

• "Account Data" means personal data about Customer's users and contacts that ScrapeOps needs to run Customer's account. It includes names, email addresses, phone numbers, billing details, sign-up and login information, support conversations and usage records.
• "Customer Personal Data" means personal data that ScrapeOps processes on behalf of Customer when providing the Services. It includes personal data in target URLs, request parameters, request bodies, custom headers and the web pages fetched, rendered or parsed for Customer. It does not include Account Data.
• "Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Agreement. These include, as applicable:
  • Regulation (EU) 2016/679 (the "GDPR")
  • the Irish Data Protection Acts 1988 to 2018
  • the UK GDPR and the UK Data Protection Act 2018
  • the Swiss Federal Act on Data Protection
  • United States state privacy laws, including the California Consumer Privacy Act as amended (the "CCPA")
• "Personal Data Breach" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data while it is processed by ScrapeOps or its Subprocessors.
• "Restricted Transfer" means a transfer of Customer Personal Data to a country that Data Protection Laws do not recognise as giving adequate protection.
• "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• "Services" means the ScrapeOps services provided under the Agreement. These include the Proxy API Aggregator, the Residential & Mobile Proxy Aggregator, the Parser API, Monitoring & Scheduler and the ScrapeOps MCP server.
• "Subprocessor" means any third party that ScrapeOps engages to process Customer Personal Data.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

"Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR. "Business", "service provider", "sell" and "share" have the meanings given in the CCPA.

2. Scope and roles

2.1 For Customer Personal Data, Customer is the controller (or a processor acting for its own controllers) and ScrapeOps is the processor (or a subprocessor).

2.2 For Account Data, ScrapeOps is an independent controller and processes it as its Privacy Policy describes. This DPA does not cover Account Data.

2.3 Annex I sets out the details of the processing.

2.4 Free-trial accounts are provided for evaluation and must not be used to process personal data.

3. Customer obligations

3.1 Customer is responsible for having a lawful basis for the processing it instructs, and for giving any notices or obtaining any consents that Data Protection Laws require.

3.2 Customer's instructions to ScrapeOps must comply with Data Protection Laws.

3.3 The Services are designed to take target URLs and request options as input. Customer will send only the personal data that each request needs.

3.4 Without ScrapeOps' prior written agreement, Customer will not use the Services to target or submit special categories of personal data (GDPR Article 9) or personal data about criminal convictions and offences (GDPR Article 10).

3.5 Customer is solely responsible for deciding which websites it accesses through the Services. It must comply with the Agreement and with laws that apply to collecting data from those websites.

4. ScrapeOps obligations

4.1 Instructions. ScrapeOps will process Customer Personal Data only on Customer's documented instructions, unless EU or Member State law requires otherwise. In that case, ScrapeOps will tell Customer about the legal requirement before processing, unless the law prohibits it. Customer's instructions are the Agreement, this DPA, and Customer's use and configuration of the Services.

4.2 Unlawful instructions. ScrapeOps will tell Customer promptly if, in its opinion, an instruction breaks Data Protection Laws.

4.3 Confidentiality. ScrapeOps will make sure that everyone it authorises to process Customer Personal Data has committed to confidentiality, or is under a legal duty of confidentiality. Only employees who need access to provide, support or secure the Services will have it.

4.4 Security. ScrapeOps will put in place and maintain the technical and organisational measures in Annex II. ScrapeOps may update those measures over time, provided the overall level of protection does not go down.

4.5 Use limitation. ScrapeOps will not use Customer Personal Data for any purpose except providing, supporting and securing the Services. ScrapeOps may create aggregated statistics that do not identify any individual and do not contain Customer Personal Data, such as success rates by target domain or proxy provider, and use them to operate and improve the Services.

5. Subprocessors

5.1 Authorisation. Customer gives ScrapeOps general authorisation to engage Subprocessors. The current Subprocessors are listed at scrapeops.io/subprocessors (Part A) and summarised in Annex III.

5.2 Upstream proxy providers. Upstream proxy providers are authorised as a category, because the provider used for each request depends on the target site and request options. ScrapeOps will give Customer a current named list under NDA on request.

5.3 Subprocessor terms. ScrapeOps will have a written contract with each Subprocessor. The contract will impose data protection obligations that give at least the same level of protection for Customer Personal Data as this DPA, as far as they apply to the services that Subprocessor provides.

5.4 Notice of changes. ScrapeOps will give at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data. The 30-day notice period does not apply to additions within the upstream proxy provider category. Notice will be given by updating the Subprocessor List and by emailing the account owner and the notification contacts named in a signed copy of this DPA.

5.5 Objection. Customer may object to a new Subprocessor on reasonable data protection grounds by writing to ScrapeOps within 30 days of the notice. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the Services affected and receive a refund of any prepaid fees for the unused part of the subscription term.

5.6 Emergency replacement. If ScrapeOps must replace a Subprocessor urgently to protect the security or continuity of the Services, it may do so without advance notice. It will notify Customer as soon as possible, and section 5.5 will apply from the date of that notice.

5.7 Liability. ScrapeOps remains responsible to Customer for the performance of its Subprocessors' obligations.

6. Data subject requests

6.1 If ScrapeOps receives a request from a data subject about Customer Personal Data, ScrapeOps will tell Customer within 5 business days, where the law permits. ScrapeOps will not respond to the data subject except to confirm that the request relates to Customer, or as the law requires.

6.2 Taking into account the nature of the processing, ScrapeOps will give Customer reasonable assistance so Customer can respond to data subject requests.

6.3 ScrapeOps does not store page content after it is returned, and deletes request logs after 14 days. In most cases, ScrapeOps will therefore hold little or no Customer Personal Data relevant to a request.

7. Assistance with compliance

Taking into account the nature of the processing and the information available to it, ScrapeOps will give Customer reasonable assistance with Customer's obligations under GDPR Articles 32 to 36. These obligations cover security, breach notification, data protection impact assessments and prior consultation with supervisory authorities. ScrapeOps may charge reasonable fees for assistance that goes beyond its standard documentation.

8. International transfers

8.1 Location. ScrapeOps is established in Ireland. Customer Personal Data is processed in the locations set out in Annex I and in the Subprocessor List. These include the European Economic Area, the United Kingdom and the United States. Upstream proxy providers process data in the countries where they operate and where Customer chooses to target.

8.2 Onward transfers by ScrapeOps. If ScrapeOps or a Subprocessor makes a Restricted Transfer, ScrapeOps will make sure the transfer is covered by a valid transfer mechanism, such as:

• an adequacy decision
• the Subprocessor's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions)
• Module 3 (processor to processor) of the SCCs

8.3 Transfers to Customer. This section applies where Customer is outside the European Economic Area and ScrapeOps' transfer of Customer Personal Data to Customer is a Restricted Transfer. Module 4 (processor to controller) of the SCCs applies to that transfer and is incorporated into this DPA by reference.

8.4 SCC options. Where the SCCs apply:

• Clause 7 (docking clause) does not apply.
• Clause 9: Option 2 (general written authorisation) applies, with the notice period in section 5.4.
• The optional wording in Clause 11 does not apply.
• Clause 13: the competent supervisory authority is the Irish Data Protection Commission.
• Clauses 17 and 18: the law of Ireland and the courts of Ireland.
• Annexes I to III of this DPA complete the corresponding Annexes of the SCCs.

8.5 UK. For Customer Personal Data subject to the UK GDPR, the UK Addendum applies to the SCCs as completed above. Table 1 of the Addendum is completed with the parties' details in Annex I. Tables 2 and 3 are completed as set out in this section 8. In Table 4, either party may end the Addendum as allowed by its Section 19.

8.6 Switzerland. For Customer Personal Data subject to the Swiss Federal Act on Data Protection, the SCCs apply with these changes:

• References to the GDPR are read as references to that Act.
• The Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.
• "Member State" includes Switzerland, so that Swiss data subjects can enforce their rights there.

8.7 Conflicts. If the SCCs conflict with this DPA, the SCCs prevail.

9. Personal Data Breach

9.1 Notification. ScrapeOps will notify Customer without undue delay, and in any case within 48 hours of confirming a Personal Data Breach.

9.2 Content. As far as the information is available, the notice will describe:

• the nature of the breach
• the categories and approximate number of data subjects and records affected
• the likely consequences
• the measures taken or proposed to deal with the breach
• a contact point for more information

If ScrapeOps does not have all of this information at first, it will provide it in stages, without undue delay.

9.3 Cooperation. ScrapeOps will take reasonable steps to contain and investigate the breach and to reduce its effects. It will cooperate reasonably with Customer so Customer can meet its own notification obligations.

9.4 Unsuccessful attempts. An unsuccessful attempt is not a Personal Data Breach. An unsuccessful attempt is one that does not result in unauthorised access to Customer Personal Data or to the systems that store it. Examples include pings and other broadcast attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, and packet sniffing that does not result in access beyond IP addresses or headers.

9.5 Delivery. ScrapeOps will send notices by email to the notification contacts named in a signed copy of this DPA and to the account owner. Customer must keep those contacts up to date.

9.6 No admission. Notifying or responding to a Personal Data Breach is not an admission of fault or liability by ScrapeOps.

10. Audits

10.1 Information. On request, ScrapeOps will give Customer the information reasonably needed to show that it complies with this DPA. This includes the ScrapeOps Security Overview and written answers to one reasonable security questionnaire per year.

10.2 Audits. Customer may carry out an audit of ScrapeOps' compliance with this DPA in any of these cases:

• the information under section 10.1 is not enough to show compliance
• a supervisory authority requires the audit
• a Personal Data Breach has occurred

Customer may carry out the audit itself or through an independent auditor. The auditor must be bound by confidentiality obligations and must not be a competitor of ScrapeOps.

10.3 Conditions. Audits require at least 30 days' written notice, except where a supervisory authority requires a shorter period. They take place during normal business hours, no more than once in any 12 months (unless a supervisory authority requires another audit or a Personal Data Breach has occurred), and at Customer's cost. The parties will agree the scope in advance, so that the audit does not disrupt the Services or expose other customers' data. Audits will be carried out remotely where possible.

11. Deletion and return

11.1 Deletion. When the Agreement ends, ScrapeOps will delete Customer Personal Data within 30 days, unless EU or Member State law requires ScrapeOps to keep it. Request logs are deleted automatically after 14 days, and database backups expire after 7 days.

11.2 Return. ScrapeOps returns results to Customer as each request is processed, and does not keep page content. There is therefore normally no Customer Personal Data to return when the Agreement ends.

11.3 Certification. On Customer's request, ScrapeOps will confirm the deletion in writing.

12. United States state privacy laws

Where the CCPA or a similar US state privacy law applies to Customer Personal Data, ScrapeOps acts as Customer's service provider or processor. ScrapeOps will:

• not sell or share Customer Personal Data
• not keep, use or disclose Customer Personal Data for any purpose except the business purposes set out in the Agreement and this DPA, or outside its direct business relationship with Customer
• not combine Customer Personal Data with personal information it receives from other sources, except as those laws permit
• comply with those laws, and give the same level of privacy protection they require
• tell Customer if it can no longer meet its obligations under those laws

Customer may take reasonable and appropriate steps to stop and remedy any unauthorised use of Customer Personal Data.

13. Liability

Each party's liability under this DPA is subject to the exclusions and limitations of liability in the Agreement. Nothing in this DPA limits either party's liability to data subjects under the SCCs.

14. General

14.1 Term. This DPA takes effect on the date the last party signs it. If it is accepted by being incorporated into the Agreement, it takes effect from the start of Customer's paid subscription. It continues for as long as ScrapeOps processes Customer Personal Data.

14.2 Order of precedence. On data protection matters, the order of precedence is: first the SCCs (where they apply), then this DPA, then the Agreement.

14.3 Changes in law. If Data Protection Laws change in a way that affects this DPA, the parties will agree in good faith on any amendments needed.

14.4 Governing law. This DPA is governed by the laws of Ireland. The courts of Ireland have exclusive jurisdiction, except where the SCCs require otherwise.

Annex I: Description of the processing

A. Parties

Data exporter: Customer, as identified in the Agreement. Role: controller (or processor on behalf of its controllers). Activities: use of the ScrapeOps Services.

Data importer: ScrapeOps Ltd, Ireland. Contact: info@scrapeops.io. Role: processor. Activities: providing the ScrapeOps Services.

B. Description of the processing

Categories of data subjects

• Individuals whose personal data appears in the target URLs, request parameters, request bodies, custom headers or web pages that Customer chooses to fetch or parse through the Services
• Customer's authorised users, where their identifiers appear in request logs

Categories of personal data

Customer decides which personal data is processed. Depending on the websites Customer targets and the requests it sends, this may include:

• names and contact details
• online identifiers
• cookies or session tokens that Customer supplies in custom headers
• any other personal data published on the target pages

Special categories of data

None are intended (see section 3.4). Safeguards: page content is not stored after it is returned; request logs are deleted after 14 days; and access is limited as described in Annex II.

Frequency of transfer

Continuous, each time Customer sends a request.

Nature of the processing

• Fetching web pages through upstream proxy providers
• Rendering JavaScript
• Parsing pages, and LLM extraction where Customer asks for it
• Short-term caching
• Request logging
• Monitoring and scheduling of Customer's scraping jobs

Purpose of the processing

To provide the Services under the Agreement, including troubleshooting, security and abuse prevention.

Retention

Transfers to Subprocessors

As set out in Annex III, for the same nature, purpose and duration as above.

C. Competent supervisory authority

The Irish Data Protection Commission.

Annex II: Technical and organisational measures

The ScrapeOps Security Overview describes these measures in more detail.

Governance

• A named Security Lead is accountable for security.
• ScrapeOps maintains a documented Access Control Policy and Incident Response Policy, and reviews both at least once a year.

Personnel

• Only employees have access to production systems or Customer Personal Data. Contractors are not given production access.
• Employees are bound by confidentiality obligations that continue after their employment ends.

Access control

• Staff get only the access their role needs, approved by the Security Lead.
• Access is reviewed every quarter and removed on the day someone leaves.
• Admin roles in the ScrapeOps dashboard are scoped.
• Production servers are accessed over SSH with keys.
• Multi-factor authentication is required on administrative consoles.

Encryption

• HTTPS on public endpoints, and TLS on every connection to databases and caches.
• Provider-managed encryption at rest for databases (LUKS, AES-XTS), backups (AES-256) and object storage (AES-256).
• Stored third-party credentials are encrypted with AES-256. Passwords are hashed with PBKDF2-SHA256 at 260,000 iterations, with a salt for each user.

Application security

• Schema validation on API requests, and parameterised database queries through ORMs.
• HTTP security headers.
• Static analysis and automated tests in CI.
• Passkey support, short-lived session tokens, rate-limited passkey sign-in, and bot and fraud protection at sign-up.

Data minimisation and retention

• Successful page content is not stored.
• Request logs are kept for 14 days, failed-request copies for 30 minutes and large files for 30 days.
• LLM extraction usage records do not contain page content or results.

Logging and monitoring

• Centralised logging in Datadog EU.
• Automated alerting on service health, errors, fraud signals and usage anomalies.

Availability

• Requests are routed across multiple upstream proxy providers, with failover.
• Managed database backups are taken daily and kept for 7 days.
• Every production service has a revert workflow.

Subprocessor management

• Subprocessors are bound by written data protection terms and receive only the data they need.
• Customers get 30 days' notice of new Subprocessors.

Incident response

• ScrapeOps follows a documented process for detection, triage, containment, recovery and review.
• Customers are notified within 48 hours of a confirmed Personal Data Breach.

Annex III: Subprocessors

The current list is published at scrapeops.io/subprocessors. As of the date of this DPA, the Subprocessors of Customer Personal Data are: