Data Processing Addendum

DRAFT. Lawyer review pending. Items marked [L] are open questions for the lawyer.

This addendum is part of our Terms of Service between AENIGMA EOOD ("we") and the business that holds the account ("you"). It applies only where we process personal data on your behalf. [L1]

1. Why this addendum is short

Our service is designed so that personal data does not flow through it. Our scrapers collect public business and product information and remove names, email addresses, phone numbers and profile links before a row leaves the scraper. Our Acceptable Use Policy forbids inputs that target individuals.

Personal data can still reach us in two ways: you put it in a run input, or a filter misses something in a result. This addendum covers those cases.

2. Roles

Data	Our role	Your role
Your account data (sign-in email, company, VAT ID, keys, billing)	Controller, under our privacy notice	Not applicable
Run inputs you send, and run results we hold for you	Processor	Controller
Data we collect from public websites to build our scrapers and the catalogue	Controller [L2]	Not applicable

3. Details of the processing

Item	Details
Subject matter	Running scrapers with your inputs and holding the results for you to download
Duration	For as long as you use the service; results are deleted 7 days after the run [L3]
Nature and purpose	Storing, transmitting and deleting run inputs and results, only to provide the service
Types of personal data	None expected. Any personal data that you put in an input or that a filter misses
Data subjects	People named in your inputs or in source pages
Special categories	None. You must not send them

4. Our obligations as processor

1. We process the data only on your documented instructions. The API calls you make are those instructions. If we think an instruction breaks data protection law, we tell you.
2. Everyone who works with the data is bound to confidentiality.
3. We apply the security measures described on our security page. We may improve them; we will not reduce the overall level of protection.
4. We use the sub-processors on our sub-processor list. We give account holders at least 30 days' email notice before adding or replacing one. You may object on reasonable data protection grounds within that period; if we cannot resolve the objection, you may close your account and get a refund of unused paid credit, whatever its age. Each sub-processor is bound by data protection terms no weaker than these. [L4]
5. We help you answer requests from data subjects and meet your duties on security, breach notification and impact assessments, as far as our role allows.
6. We tell you about a personal data breach affecting your data without undue delay, and within 48 hours of becoming aware of it, with the information we have at the time. [L5]
7. When the account closes, results are deleted on their 7-day schedule and inputs are deleted with the run records, except where the law requires us to keep them. [L3]
8. We give you the information you need to show that we comply with this addendum. You may audit us once a year, with 30 days' notice, at your cost, or accept a written report instead. [L6]

5. Transfers

Our servers and database are in the EU. Where a sub-processor processes data outside the EEA, the transfer relies on an adequacy decision or on the European Commission's standard contractual clauses. [L7]

6. Liability

Liability under this addendum follows the limits in our Terms of Service, except where the law does not allow a limit.

---

Questions for the lawyer

Remove this section and every [L] marker before publishing.

• [L1] Do we need a DPA at all if our service is designed so that no personal data passes through it, or is a short one like this the right shape? Customers with procurement checklists will ask for one either way.
• [L2] When our scrapers read public pages that contain personal data before filtering it out, we decide the means and purpose, so we are the controller of that brief processing. Is this right, and what is our legal basis (legitimate interest)?
• [L3] The 7-day result retention is planned, not yet built. How long should inputs be kept (they are part of run records that may be accounting records)?
• [L4] The plan named a concern: offering a DPA while not naming the engine provider as a sub-processor is probably inconsistent. If we must name it, is a factual entry in the sub-processor list compatible with the provider's terms?
• [L5] Is 48 hours the right commitment, given our own 72-hour duty to the authority when we are controller?
• [L6] Audit clause scope for a company of our size.
• [L7] Which transfer tool applies to each provider outside the EEA?