Last updated: 2026-10-28
Version 1.0.
This Data Processing Agreement (the "DPA") forms part of the Scrap.io Terms and Conditions (the "Terms") between GH CONSULTANCY DEV LLP ("Scrap.io", the "Processor"), whose representative in the European Union under Article 27 of the GDPR is Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria, and the customer who accepted the Terms (the "Customer", the "Controller"). It applies automatically when the Customer uses a feature in which Scrap.io processes personal data on the Customer's behalf. No signature is needed. In case of conflict between the Terms and this DPA on the processing of personal data, this DPA prevails.
1. Scope
1.1 This DPA applies to personal data contained in files the Customer uploads to the Service for enrichment, in the identifiers the Customer submits for enrichment through the API, the MCP server or the reverse search, and in the lists the Customer creates in the Service (such as exclusion lists) (the "Customer Personal Data").
1.2 It does not apply to the business data that Scrap.io collects from public sources and supplies to its customers, for which Scrap.io is an independent controller, nor to the Customer's account and billing data, for which Scrap.io is also a controller. Both are described in the Scrap.io Privacy Policy.
1.3 "Data Protection Laws" means the UK GDPR, the UK Data Protection Act 2018, the EU General Data Protection Regulation 2016/679 (the "GDPR") and any other data protection law applicable to the processing. Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the GDPR.
2. Details of the processing
- Subject matter and purpose: matching the Customer's files and lists with the Scrap.io business database, returning enriched results to the Customer, and applying the Customer's exclusion lists to its exports.
- Duration: until the Customer Personal Data is deleted under section 10. Identifiers submitted through the API, the MCP server or the reverse search are kept in a cache for 30 days. Where the Customer holds only passes, or holds an active pass when its subscription is cancelled, the processing ends when the Customer deletes the data or asks Scrap.io to delete it.
- Nature of the processing: upload, storage, parsing, matching, generation of result files, deletion.
- Categories of data: identifiers and contact details contained in the Customer's files, such as names, professional email addresses, phone numbers, websites, addresses and business identifiers, and any other data the Customer chooses to include.
- Categories of data subjects: the Customer's contacts, prospects and customers, and any other person whose data the Customer includes.
- Special categories of data: none. The Customer must not upload special categories of data or data relating to criminal convictions.
3. Instructions
3.1 Scrap.io processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use of the Service's features are the Customer's complete instructions.
3.2 Scrap.io immediately informs the Customer if, in its opinion, an instruction infringes Data Protection Laws.
3.3 If a law to which Scrap.io is subject requires it to process Customer Personal Data other than on the Customer's instructions, Scrap.io informs the Customer before the processing, unless that law prohibits it.
3.4 Scrap.io does not use Customer Personal Data for its own purposes. In particular, it does not add Customer Personal Data to its business database.
3.5 The Customer is responsible for the lawfulness of the Customer Personal Data and of its instructions, including having a legal basis for the processing and providing the required information to data subjects. Where the Customer processes the Customer Personal Data as a processor on behalf of another controller, the Customer warrants that this controller has authorised its instructions and the engagement of Scrap.io, which then acts as the Customer's sub-processor under this DPA.
4. Confidentiality
Scrap.io ensures that the persons it authorises to process Customer Personal Data are bound by an obligation of confidentiality and only access it as needed to provide the Service or support.
5. Security
Scrap.io implements appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the costs and the risks, as required by Article 32 of the GDPR. They include in particular: encryption in transit, encryption at rest of stored files, access restricted to authorised staff with individual accounts, separation of each customer's data within the application, logging and monitoring of the systems, and backups. The measures in force are described in Annex 1. Scrap.io may update them provided the overall level of protection is not reduced.
6. Sub-processors
6.1 The Customer gives Scrap.io a general authorisation to engage sub-processors to process Customer Personal Data. The current list is published on the subprocessors page, which marks the sub-processors of Customer Personal Data and also lists providers that Scrap.io uses for its own processing as a controller. Sections 6.2 and 6.3 apply only to sub-processors of Customer Personal Data.
6.2 Scrap.io informs the Customer of any intended addition or replacement of a sub-processor of Customer Personal Data by updating that page and notifying the Customer by email at least 30 days in advance. The Customer may object on reasonable data protection grounds within that period. If the parties have not resolved the objection within 30 days after it is made, the Customer may terminate the affected subscription within the following 30 days, and Scrap.io refunds the amount the Customer prepaid for the period after termination.
6.3 Where a sub-processor must be replaced urgently, for a security reason or because it fails, Scrap.io may give shorter notice, but always notifies the Customer before the new sub-processor processes Customer Personal Data. The Customer may then object under section 6.2, within 30 days of that notification.
6.4 Scrap.io imposes on each sub-processor data protection obligations equivalent to those of this DPA and remains liable to the Customer for its sub-processors' performance.
7. International transfers
Where Customer Personal Data is transferred outside the United Kingdom or the European Economic Area, Scrap.io ensures that the transfer is covered by an adequacy decision or by appropriate safeguards. For the hosting on Amazon Web Services in the United States, these are the standard contractual clauses of the European Commission included in the AWS data processing addendum and, for transfers from the United Kingdom, the UK International Data Transfer Addendum or the UK International Data Transfer Agreement. For providers certified under the EU US Data Privacy Framework and its UK extension, including Amazon Web Services, the transfer also relies on that certification.
8. Assistance
8.1 Taking into account the nature of the processing, Scrap.io assists the Customer, through the features of the Service and on request, in responding to data subjects' requests to exercise their rights. If Scrap.io receives such a request directly for Customer Personal Data, it forwards it to the Customer without undue delay and does not answer it itself, except to direct the data subject to the Customer.
8.2 Taking into account the nature of the processing and the information available to it, Scrap.io provides reasonable assistance to the Customer in meeting its obligations under Articles 32 to 36 of the GDPR: security of the processing, personal data breaches, data protection impact assessments and prior consultations with supervisory authorities. Beyond the documentation that Scrap.io makes available, this assistance is provided at the Customer's cost.
9. Personal data breaches
Scrap.io notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notification describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Scrap.io takes reasonable steps to contain the breach and mitigate its effects.
10. Deletion and return
10.1 While the Customer has access to the Service, it can download its enrichment results and delete its files, enrichments and exclusion lists from the Service. It can also ask for their return or deletion at any time under section 10.3.
10.2 When the Customer's subscription is cancelled while the Customer holds no active pass, Scrap.io deletes the Customer Personal Data, including uploaded files, the data extracted from them, enrichment results and exclusion lists, unless the Customer has asked for their return before that date under section 10.3. Copies in backups are deleted in the normal backup cycle, within 3 days, and are not restored into the Service in the meantime.
10.3 While it has access to the Service, the Customer can ask Scrap.io to return or delete Customer Personal Data, by writing to [email protected]. A return is made as a copy of the uploaded files, the enrichment results and the exclusion lists, before their deletion.
11. Audit
Scrap.io makes available to the Customer, on written request, the information reasonably necessary to demonstrate compliance with this DPA, in the form of written answers and documentation. If this information is not sufficient to demonstrate compliance, the Customer, or an independent auditor it appoints, may carry out an audit of the processing of Customer Personal Data, at the Customer's own cost, under an obligation of confidentiality, during business hours and without disrupting the Service. Requests for information and audits are limited to one a year, and an audit requires at least 30 days' notice. These limits do not apply after a personal data breach affecting Customer Personal Data, where the Customer has a serious suspicion of non-compliance supported by evidence, or where a supervisory authority requires it.
12. Liability and term
The limitation of liability of the Terms applies to this DPA, except where the law does not allow it. This DPA applies for as long as Scrap.io processes Customer Personal Data. It is governed by the law and jurisdiction set out in the Terms.
Annex 1: security measures
- Hosting on Amazon Web Services, in the United States, with encryption at rest of the file storage.
- Matching of the Customer's files against the Scrap.io business database, hosted by the providers marked on the subprocessors page as processing Customer Personal Data.
- Encryption in transit of the traffic between the Customer and the Service.
- Access to production systems restricted to named staff members, with individual accounts protected by strong authentication.
- Each customer's files, enrichments and lists are only accessible from that customer's account and by authorised staff for support.
- Monitoring of errors and availability.
- Regular automated backups of the database.
- Deletion of uploaded files and enrichment data on request and when the Customer's subscription is cancelled while the Customer holds no active pass.