Crawlhub Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the agreement between Crawlhub, registered address Kėstučio g. 41A, Vilnius, Lithuania) ("Crawlhub" or "Processor") and the customer ("Customer" or "Controller") under the Crawlhub General Conditions (the "Agreement").

This DPA applies when the Customer uses the Web Scraping API, SERP API or data delivery services to process personal data, and Crawlhub processes that personal data on the Customer's behalf. It meets the requirements of Article 28(3) of the EU General Data Protection Regulation ("GDPR").

The Customer accepts this DPA by accepting the Agreement. It does not need to be signed separately. If this DPA and the Agreement conflict on the processing of personal data, this DPA prevails.

1. Definitions

1.1. In this DPA:

• "Data Protection Laws" means the GDPR and any other data protection laws that apply to the processing under this DPA;
• "Personal Data" means any personal data (as defined in the GDPR) that Crawlhub processes on the Customer's behalf through the Services;
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data;
• "Sub-processor" means any third party Crawlhub engages to process Personal Data in providing the Services;
• "Services" means the Web Scraping API, SERP API and data delivery services under the Agreement.

1.2. Other capitalized terms have the meaning given in the Agreement or the GDPR.

2. Roles and scope

2.1. The Customer is the controller of the Personal Data and decides what is collected through the Services, from which sources and for what purpose. Crawlhub is the processor and processes Personal Data only to provide the Services.

2.2. The subject matter, nature, purpose and duration of the processing, and the types of Personal Data and data subjects, are set out in Annex 1.

2.3. This DPA does not cover personal data that Crawlhub processes as a controller, such as account, billing and support data. That processing is described in the https://crawlhub.ai/legal/privacy.

2.4. This DPA does not apply to proxy Services, where Crawlhub only routes the Customer's traffic and does not access, store or process the content of that traffic.

3. Customer's obligations

3.1. The Customer is responsible for the lawfulness of the processing. In particular, the Customer confirms that it:

1. has a valid legal basis under the GDPR for collecting and using the Personal Data it processes through the Services;
2. has given data subjects any required information and obtained any required consents;
3. complies with the terms and restrictions of the websites it collects data from, the Acceptable Use Policy and all applicable laws;
4. will not use the Services to collect special categories of personal data (Art. 9 GDPR) or data about criminal convictions (Art. 10 GDPR), unless it has a lawful basis and has told Crawlhub in writing first.

3.2. The Customer's instructions to Crawlhub are the Agreement, this DPA and the Customer's configuration and use of the Services (for example, the URLs, queries and parameters it sends). Any additional instruction must be in writing and consistent with the Agreement.

4. Crawlhub's obligations

4.1. Crawlhub will:

1. process Personal Data only on the Customer's documented instructions, including for international transfers, unless EU or Member State law requires otherwise. In that case Crawlhub will tell the Customer first, unless the law forbids it;
2. tell the Customer promptly if it believes an instruction breaks Data Protection Laws;
3. not use Personal Data for its own purposes, and not sell or share it with third parties except Sub-processors under section 5;
4. keep Personal Data only as long as needed to deliver the requested result to the Customer, as set out in Annex 1.

4.2. Confidentiality. Crawlhub will give access to Personal Data only to staff and contractors who need it to provide the Services and who are bound by confidentiality obligations.

4.3. Security. Crawlhub will implement appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the state of the art, costs and the risks involved (Art. 32 GDPR). The current measures are listed in Annex 2. Crawlhub may update them, provided the overall level of protection is not reduced.

5. Sub-processors

5.1. The Customer gives Crawlhub general authorization to engage Sub-processors, including infrastructure and data collection partners. Crawlhub keeps an up-to-date list of its Sub-processors and will provide it to the Customer on written request, subject to confidentiality.

5.2. Crawlhub will inform the Customer of any intended addition or replacement of a Sub-processor by email or dashboard notice. The Customer may object within 7 days on reasonable data protection grounds. If the objection cannot be resolved, the Customer's sole remedy is to terminate the affected Services.

5.3. Crawlhub will bind each Sub-processor by a written contract with data protection obligations at least as protective as this DPA. Crawlhub remains liable to the Customer for its Sub-processors' performance of those obligations.

6. International transfers

6.1. Crawlhub and its Sub-processors may process Personal Data outside the European Economic Area only where the transfer is protected by one of these safeguards:

• an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified US recipients; or
• the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), with supplementary measures where needed.

6.2. Where the Standard Contractual Clauses apply between the Customer and Crawlhub, they are incorporated into this DPA by reference, using Module 2 (controller to processor), with Annexes 1 and 2 of this DPA completing their annexes.

7. Data subject requests and assistance

7.1. If Crawlhub receives a request from a data subject about Personal Data processed for the Customer, it will forward it to the Customer without undue delay and will not respond itself, except to say the request has been passed on.

7.2. Taking into account the nature of the processing, Crawlhub will provide reasonable assistance to the Customer in:

• responding to data subjects exercising their rights under Chapter III of the GDPR;
• data protection impact assessments and prior consultations with supervisory authorities (Art. 35 and 36 GDPR);
• dealing with requests or inquiries from supervisory authorities.

7.3. If a request from an authority or other third party concerns Personal Data processed for the Customer, Crawlhub will refer it to the Customer where the law allows.

8. Personal Data Breaches

8.1. Crawlhub will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data.

8.2. The notice will include, as far as known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Information may be provided in stages.

8.3. Crawlhub will take reasonable steps to contain the breach and help the Customer meet its own notification obligations. A notice is not an admission of fault or liability.

9. Audits

9.1. Crawlhub will make available to the Customer the information reasonably needed to demonstrate compliance with this DPA, such as security documentation, policies and any third-party certifications or audit reports.

9.2. If that information is not enough, the Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, no more than once every 12 months (or after a Personal Data Breach), with at least 30 days' written notice, during business hours and without disrupting Crawlhub's operations. The Customer bears its own audit costs.

10. Deletion and return

10.1. When the Services end, Crawlhub will delete all Personal Data within 30 days, unless EU or Member State law requires it to keep the data. Because results are delivered to the Customer as part of the Services, a return of data is normally not needed; if the Customer asks in writing before the Services end, Crawlhub will return any Personal Data it still holds before deleting it.

10.2. Crawlhub will make its Sub-processors delete Personal Data in the same way and will confirm deletion in writing on request.

11. Liability

11.1. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws do not allow this.

11.2. The Customer will indemnify Crawlhub against claims, fines and losses arising from the Customer's breach of this DPA or Data Protection Laws, including processing without a valid legal basis, as set out in section 7 of the General Conditions.

12. Term and final provisions

12.1. This DPA applies for as long as Crawlhub processes Personal Data on the Customer's behalf, and ends automatically when that processing ends. Sections 10 and 11 survive termination.

12.2. Crawlhub may update this DPA to reflect changes in Data Protection Laws or the Services, with notice under the Agreement. Updates will not reduce the protection of Personal Data.

12.3. This DPA is governed by the laws of the Republic of Lithuania, and disputes are resolved as set out in the Agreement. Where the Standard Contractual Clauses apply, their own governing law and jurisdiction clauses prevail for them.

Annex 1 — Details of processing

Annex 2 — Technical and organizational measures

• Encryption: data encrypted in transit (TLS 1.2 or higher) and at rest.
• Access control: role-based access on a need-to-know basis, multi-factor authentication for admin and infrastructure accounts, prompt removal of access when no longer needed.
• Authentication: API access only with customer-specific API keys or credentials.
• Logging and monitoring: logs of access to systems holding Personal Data, monitored for unusual activity.
• Data minimization: results kept only for the retention period in Annex 1, then automatically deleted.
• Infrastructure: hosting with providers holding recognized security certifications (such as ISO 27001 or SOC 2).
• Resilience: backups, redundancy and incident response procedures to restore availability after an incident.
• People: confidentiality obligations and security awareness for all staff and contractors with access.
• Vendors: due diligence and written data protection terms with all Sub-processors.

Last updated: October 14, 2025