Data processing agreement.

Last updated: 9 October 2026

This Data Processing Agreement ("DPA") is between Crawlbase LLC ("Crawlbase") and the customer that holds a Crawlbase account ("Customer"). It forms part of the Terms of Service and applies automatically from the moment Customer creates an account or uses the services. No signature is required.

(1) Roles and scope

Customer is the controller, and Crawlbase is the processor, of any personal data contained in the content Customer instructs Crawlbase to crawl, store or deliver, and in the request logs kept for Customer ("Customer Personal Data"). Crawlbase is the controller of the account information it needs to run Customer's account, as described in the Privacy Policy.

This DPA applies wherever the UK GDPR, the Data Protection Act 2018 or the EU GDPR ("Data Protection Law") applies to Customer Personal Data.

(2) Details of the processing

• Subject matter: provision of the Crawlbase services to Customer.
• Duration: for as long as Customer uses the services, and until the data is deleted under section 9.
• Nature and purpose: retrieving web pages that Customer requests, processing them, delivering the results to Customer, storing them where Customer uses Cloud Storage, and keeping request logs so Customer can review usage.
• Data subjects: individuals whose personal data appears on the web pages Customer chooses to crawl, and Customer's own users.
• Types of personal data: whatever personal data is contained in the pages and URLs Customer chooses to crawl. Crawlbase does not select or inspect this content. Customer must not direct the services at special category data unless it has a lawful basis to process it.

(3) Customer instructions

Crawlbase processes Customer Personal Data only on Customer's documented instructions, which are the Terms of Service, this DPA and the requests and settings Customer sends through the services, unless the law requires otherwise. Crawlbase will tell Customer if, in its opinion, an instruction infringes Data Protection Law.

(4) Confidentiality

Crawlbase ensures that anyone authorised to process Customer Personal Data is bound by a duty of confidentiality.

(5) Security

Crawlbase implements appropriate technical and organisational measures under Article 32 of the GDPR, including:

• encryption of data in transit using SSL/TLS;
• systems kept behind secured networks, with access limited to the personnel who need it;
• passwords stored only as irreversible hashes;
• regular security and malware scanning of our systems.

(6) Sub-processors

Customer gives Crawlbase general authorisation to use sub-processors. The current list, with each sub-processor's location and purpose, is published in the sub-processors section of our Privacy Policy. Crawlbase will update that list at least 15 days before adding or replacing a sub-processor, so that Customer can object on reasonable grounds. If an objection cannot be resolved, Customer may stop using the services and close its account. Crawlbase imposes data protection obligations on each sub-processor equivalent to those in this DPA, and remains responsible for its sub-processors.

(7) Assistance

Taking into account the nature of the processing, Crawlbase will help Customer respond to requests from data subjects exercising their rights, and will give Customer the information it reasonably needs for its security obligations, data protection impact assessments and prior consultations with a supervisory authority.

(8) Personal data breaches

Crawlbase will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information Customer reasonably needs to meet its own notification obligations.

(9) Retention and deletion

• Page content returned by the Crawling API is not stored. It is held in memory only while the request is processed and discarded once the response is returned.
• Pages Customer chooses to keep in Cloud Storage are deleted after 30 days.
• Request logs are kept while Customer's account is open so Customer can review its usage history, and are deleted when the account is closed or when Customer asks.

When Customer closes its account, Crawlbase deletes Customer Personal Data, unless the law requires it to be kept.

(10) Location of processing and transfers

Crawlbase hosts Customer Personal Data on servers in the European Union, which the United Kingdom recognises as providing an adequate level of protection. Sub-processors that operate outside the European Economic Area rely on their own transfer safeguards, as described in the Privacy Policy.

(11) Audits

Crawlbase will make available the information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR, in the form of written answers to security questionnaires and relevant security documentation. Customer may request this information on reasonable written notice, no more than once a year, and must keep it confidential.

(12) Precedence

If this DPA conflicts with the Terms of Service on the processing of Customer Personal Data, this DPA prevails. Crawlbase may update this DPA, and will publish any change on this page; changes will not reduce the protection given to Customer Personal Data.

Questions about this DPA can be sent through our contact page.