RunHarvester Data Processing Addendum

This Data Processing Addendum, including its Schedules (the “DPA”), forms part of the agreement between Isentró Kft. (“RunHarvester”) and the Customer that has accepted the RunHarvester Terms of Service, an Order Form, or another agreement governing access to the Service (the “Agreement”).

This DPA applies when RunHarvester processes Customer Personal Data on behalf of Customer as a processor or sub-processor. It includes:

• the mandatory processor terms required by Article 28 of the EU GDPR and UK GDPR;
• completed processing details;
• technical and organizational measures (“TOMs”);
• a subprocessor authorization and notification framework;
• the 2021 EU Standard Contractual Clauses (“EU SCCs”) as a conditional transfer mechanism;
• the UK International Data Transfer Addendum (“UK Addendum”);
• Swiss transfer adaptations; and
• U.S. state service-provider and contractor terms.

By accepting the Agreement, using the Service to process Customer Personal Data, or signing an Order Form that incorporates this DPA, each party agrees to this DPA. Electronic acceptance and account records may evidence execution.

1. Parties and contact details

1.1 RunHarvester

Isentró Korlátolt Felelősségű Társaság (Isentró Kft.)
Company registration number: 01-09-444499
Hungarian tax number: 32822933-1-42
Registered office: 1082 Budapest, Corvin sétány 6, 8th floor, unit 4, Hungary
Privacy and legal contact: [email protected]

1.2 Customer

Customer is the person or entity identified in the applicable Account, Order Form, checkout record, or Agreement. Customer’s privacy contact is the administrator, legal contact, or privacy contact identified in those records.

1.3 Roles

For Customer Personal Data:

• where Customer determines the purposes and means of processing, Customer is the Controller and RunHarvester is the Processor;
• where Customer processes Personal Data for another Controller, Customer is a Processor and RunHarvester is Customer’s Sub-processor; and
• each party may separately act as an independent Controller for Personal Data it processes for its own account, contract, billing, security, legal, and business purposes. That independent processing is governed by the Privacy Policy and Applicable Data Protection Law, not by this DPA.

The parties’ legal roles depend on the actual processing and Applicable Data Protection Law, not merely the labels used in this DPA.

2. Definitions

Capitalized terms not defined in this DPA have the meaning given in the Agreement.

• “Applicable Data Protection Law” means laws applicable to the processing of Customer Personal Data, including, as applicable, Regulation (EU) 2016/679 (“EU GDPR”), the EU ePrivacy rules, the UK GDPR, the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (“Swiss FADP”), and applicable U.S. state privacy laws.
• “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Processing,” “Supervisory Authority,” and “Special Categories of Personal Data” have the meanings given in Applicable Data Protection Law.
• “Customer-Directed Recipient” means a Target, proxy route supplied or selected by Customer, webhook, integration, storage location, AI provider directly selected by Customer, account, endpoint, or other recipient to which Customer instructs RunHarvester to disclose or transmit Customer Personal Data and that is not appointed by RunHarvester as its own Subprocessor.
• “Customer Personal Data” means Personal Data contained in Customer Content that RunHarvester processes on Customer’s behalf under the Agreement.
• “Data Protection Impact Assessment” or “DPIA” means an assessment required under Article 35 EU GDPR, Article 35 UK GDPR, or an equivalent law.
• “EU SCCs” means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914, as amended, replaced, or superseded.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data transmitted, stored, or otherwise processed by RunHarvester.
• “Restricted Data” means data identified as restricted in the Terms, including highly sensitive or regulated data that the Service is not designed to process without express written approval.
• “Restricted Transfer” means a transfer of Personal Data that requires an adequacy decision, standard contractual clauses, approved addendum, binding corporate rules, or another transfer safeguard under Applicable Data Protection Law.
• “Subprocessor” means a third party appointed by RunHarvester to process Customer Personal Data on behalf of Customer. A Target or Customer-Directed Recipient is not a Subprocessor merely because Customer instructs RunHarvester to communicate with it.
• “Subprocessor Register” means the current list of Subprocessors made available in the Account, an Order Form, RunHarvester’s legal or documentation pages, or on request from [email protected], together with any version preserved for Customer at acceptance or notice.
• “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, as revised in accordance with its terms.

3. Scope and duration

3.1 Scope

This DPA applies only to Customer Personal Data processed by RunHarvester as Processor or Sub-processor in connection with the Service. The processing is described in Schedule 1.

This DPA does not apply to:

• Personal Data for which RunHarvester acts as an independent Controller, including Account, billing, security, support, website, and business-contact processing described in the Privacy Policy;
• data that is not Personal Data;
• processing performed independently by a Target, Customer-Directed Recipient, payment provider, identity provider, or another independent Controller; or
• Customer’s processing after Customer retrieves, exports, transmits, or otherwise removes data from RunHarvester’s control.

3.2 Duration

This DPA begins when it is incorporated into the Agreement and continues for as long as RunHarvester processes Customer Personal Data on Customer’s behalf, including any permitted return, retrieval, deletion, backup, legal-hold, or transition period.

3.3 Order of precedence

If there is a conflict concerning Customer Personal Data, the following order applies:

1. the mandatory terms of the EU SCCs or UK Addendum where applicable;
2. this DPA;
3. an Order Form that expressly identifies and modifies a provision of this DPA, to the extent modification is legally permitted;
4. the remainder of the Agreement; and
5. the Privacy Policy and Documentation.

No commercial term, limitation, or other provision may reduce a Data Subject’s rights or contradict the EU SCCs or UK Addendum.

4. Processing on documented instructions

4.1 Instructions

RunHarvester will process Customer Personal Data only:

• on Customer’s documented instructions;
• as necessary to provide, secure, support, maintain, troubleshoot, and administer the Service;
• to prevent fraud, abuse, and security incidents consistent with the Agreement;
• to delete or return data in accordance with Customer’s instructions and this DPA; and
• as required by Applicable Law binding on RunHarvester.

Documented instructions include:

• the Agreement and this DPA;
• the processing details in Schedule 1;
• Customer’s API calls, Account settings, Target selections, schemas, selectors, recipes, workflow definitions, routing parameters, retention settings, evidence settings, and webhook or integration configuration;
• an Order Form or statement of work; and
• lawful written instructions submitted by an authorized Customer contact and accepted by RunHarvester.

4.2 Required processing under law

If Applicable Law requires RunHarvester to process Customer Personal Data contrary to or beyond Customer’s instructions, RunHarvester will inform Customer before the processing unless the law prohibits notice on important grounds of public interest.

4.3 Unlawful instructions

RunHarvester will promptly inform Customer if, in RunHarvester’s reasonable opinion, an instruction infringes Applicable Data Protection Law. RunHarvester may suspend the affected processing until the parties resolve the instruction and may refuse an instruction that would require unlawful processing, compromise security, infringe another customer’s rights, or materially alter the Service beyond the Agreement.

RunHarvester’s acceptance or technical execution of an instruction is not legal advice or a determination that Customer’s use is lawful.

4.4 Additional instructions

If Customer requests processing materially outside the Agreement or ordinary Service functionality, the parties may agree on scope, fees, implementation, security, and timing. RunHarvester is not required to build a custom feature or disclose its trade secrets, source code, security-sensitive information, or another customer’s data.

5. Customer obligations

5.1 General compliance

Customer is responsible for ensuring that its instructions and use of the Service comply with Applicable Data Protection Law. Customer represents and warrants that it has, and will maintain:

• a valid lawful basis for processing;
• all required notices, consents, permissions, licenses, and authorizations;
• authority to instruct RunHarvester and appoint it as Processor or Sub-processor;
• a lawful and proportionate purpose;
• appropriate data minimization, accuracy, access, retention, and deletion controls;
• procedures to honor Data Subject rights and objections;
• required records, legitimate-interest assessments, transfer assessments, and DPIAs;
• appropriate safeguards for Customer-selected Targets, routes, webhooks, integrations, and recipients; and
• appropriate security for Customer systems and exported data.

5.2 Customer as Processor

If Customer is a Processor for another Controller, Customer warrants that:

• the Controller has authorized Customer to appoint RunHarvester as a Sub-processor;
• Customer’s instructions reflect and do not exceed the Controller’s documented instructions;
• the agreement between Customer and the Controller permits the processing and international transfers contemplated by the Service;
• Customer will provide the Controller with information and notices required for Subprocessor authorization; and
• Customer will relay RunHarvester’s assistance and notices to the Controller where required.

RunHarvester may follow Customer’s instructions without independently verifying the upstream Controller’s authorization, but may request evidence where reasonably necessary.

5.3 Transparency and public-source data

Customer acknowledges that information being publicly accessible does not eliminate privacy obligations or establish consent. Customer is responsible for any direct or indirect collection notice required by Articles 13 or 14 EU GDPR, UK law, or equivalent rules, including documenting any lawful exception.

5.4 Rights, objections, and suppression

Customer must maintain a process to receive and honor lawful access, deletion, correction, restriction, objection, opt-out, appeal, and suppression requests. Customer must promptly instruct RunHarvester where action is required in the Service and must avoid re-collecting data subject to a valid suppression or objection.

5.5 Accuracy and proportionality

Customer must configure Targets, fields, selectors, frequency, evidence, screenshots, prompts, and retention to collect only what is necessary. Customer must take reasonable steps to verify material data before relying on it, especially for a person or High-Impact Decision.

5.6 Restricted Data

Customer must not submit Restricted Data unless:

• the specific data and use are necessary and lawful;
• the Agreement expressly permits them;
• RunHarvester has provided any required written approval;
• the parties have agreed on additional safeguards where needed; and
• Customer has completed all required assessments, notices, consents, and authorizations.

RunHarvester may reject, quarantine, mask, or delete Restricted Data that is outside the agreed scope or creates an unacceptable risk.

5.7 Customer security

Customer is responsible for Account administration, least-privilege access, credential storage, key rotation, secure webhooks, destination security, exported data, device and network security, and incident response for systems under Customer’s control.

6. Customer-Directed Recipients and Third-Party Targets

6.1 Customer instruction

Customer instructs RunHarvester to communicate with the Targets, proxy routes, webhooks, integrations, storage destinations, and other Customer-Directed Recipients selected in Customer’s configuration.

Such communication may disclose Customer Personal Data or request metadata, including a requested URL, IP or proxy endpoint, user agent, locale, headers, cookies, body, credentials, timing, browser characteristics, result payload, or webhook event.

6.2 Allocation of responsibility

Customer is responsible for determining and documenting:

• whether the Customer-Directed Recipient acts as Controller, Processor, joint controller, or another recipient;
• the lawful basis and purpose of the disclosure;
• required notices and consents;
• the recipient’s terms and security;
• whether a Restricted Transfer occurs and the transfer mechanism required; and
• whether Customer is authorized to use credentials, accounts, sessions, or private content associated with the recipient.

RunHarvester remains responsible for complying with this DPA when executing the instruction and for its own Subprocessors. RunHarvester is not responsible for a Customer-Directed Recipient’s independent acts, retention, security, or legal compliance.

6.3 Webhooks and integrations

Customer must use secure destinations, validate supported signatures, protect webhook secrets, prevent replay, and restrict access to delivered data. Delivery to a Customer-configured endpoint is deemed delivery to Customer. Customer is responsible for data copied, logged, forwarded, or retained by that endpoint.

6.4 Targets outside Customer’s jurisdiction

A Target’s physical or legal location may be unknown or different from the requested domain or proxy geography. RunHarvester does not determine the transfer legality of every Customer-selected Target. Customer must assess the actual recipients and applicable law.

7. AI-assisted processing

7.1 Scope

Where Customer enables an AI-assisted feature, Customer instructs RunHarvester to transmit the minimum context reasonably required to the AI Subprocessors identified in the Subprocessor Register. Depending on the feature, context may include field definitions, schemas, instructions, HTML or page excerpts, extracted values, errors, or recipe content.

7.2 Customer obligations

Customer must not include passwords, API keys, private keys, authorization headers, cookies, full session state, payment data, Restricted Data, or unnecessary Personal Data in an AI instruction. Customer must ensure that the lawful basis, notices, processor chain, and Restricted Transfer mechanism cover the AI processing.

7.3 Provider controls

Where an AI input contains Customer Personal Data and an AI provider acts as RunHarvester's Subprocessor, RunHarvester will use contractual and technical controls designed to require that provider to process the data only to deliver the enabled feature and not to use it to train or improve a general-purpose, shared, or provider-owned model for the provider's independent purpose.

An authorized AI Subprocessor may retain limited request or security records only for the disclosed period and purpose needed to provide, secure, troubleshoot, or lawfully operate the relevant route. A zero-data-retention commitment applies only where expressly stated in the Subprocessor Register, Account control, or Order Form.

A provider that intends to use Customer Personal Data for independent model training, advertising, data brokerage, or another independent Controller purpose may receive that data only if Customer separately and expressly enables the arrangement, the legal roles and Restricted Transfer mechanism are documented, and all required notices and lawful bases are in place. Such a provider is not treated as an undisclosed Subprocessor under this DPA.

7.4 No independent training purpose

RunHarvester will not use Customer Personal Data to train a RunHarvester general-purpose model for an independent purpose unless Customer separately provides a valid express opt-in under written terms. This does not prevent minimized, transient, or otherwise disclosed processing by an authorized AI Subprocessor solely to provide and secure the enabled feature in accordance with Section 7.3.

7.5 Human review

Customer is responsible for validating AI-generated recipes and Outputs. Customer must not use them as the sole basis for a High-Impact Decision and must implement any required human review, notice, contestability, accuracy, bias, and impact safeguards.

8. Confidentiality and personnel

8.1 Confidentiality obligations

RunHarvester will ensure that persons authorized to process Customer Personal Data:

• process it only as necessary for their duties and Customer’s instructions;
• are subject to confidentiality obligations or an appropriate statutory duty of confidentiality;
• receive privacy and security guidance appropriate to their role; and
• lose access when it is no longer required.

8.2 Access limitation

RunHarvester will limit personnel access to Customer Personal Data according to role, least privilege, and operational need. Support or administrative access may occur where necessary to resolve a Customer request, investigate a security or abuse issue, comply with law, or maintain the Service.

8.3 Customer confidentiality

Customer must ensure that its personnel and downstream recipients protect RunHarvester security information, Subprocessor assessment materials, audit reports, and other Confidential Information disclosed under this DPA.

9. Security

9.1 Appropriate measures

Taking into account the state of the art, implementation costs, nature, scope, context, and purposes of processing, and the risk to Data Subjects, RunHarvester will maintain technical and organizational measures designed to provide a level of security appropriate to the risk.

The minimum measures are described in Schedule 2. RunHarvester may update a measure to reflect technical development, provided the overall level of protection is not materially reduced.

9.2 No absolute guarantee

No security measure eliminates all risk. RunHarvester does not warrant that the Service is immune from every attack, error, provider failure, or unauthorized act. This limitation does not reduce RunHarvester’s obligations under Applicable Data Protection Law or the EU SCCs.

9.3 Customer configuration

Some security depends on Customer choices, including API scopes, Authorized Users, credentials, headers, cookies, browser state, webhook destinations, evidence capture, retention, AI use, and export handling. RunHarvester is not responsible for a security failure caused by Customer’s configuration or systems, except to the extent RunHarvester independently breached this DPA.

10. Personal Data Breaches

10.1 Notification

RunHarvester will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

Notification will be sent to the security, privacy, administrator, or other contact in the Account or Agreement. Customer is responsible for keeping contacts current and for forwarding notice to an upstream Controller where Customer is a Processor.

10.2 Information

To the extent known and reasonably available, RunHarvester will provide information such as:

• the nature of the Personal Data Breach;
• the categories of affected Customer Personal Data and Data Subjects;
• approximate numbers where reasonably ascertainable;
• likely consequences;
• measures taken or proposed to contain, investigate, remediate, and mitigate; and
• a contact for follow-up.

RunHarvester may provide information in phases as an investigation develops. A notification is not an admission of fault or liability.

10.3 Cooperation

RunHarvester will take reasonable steps to contain and remediate the Personal Data Breach and will reasonably assist Customer with legally required notifications and communications, taking into account the nature of processing and information available to RunHarvester.

Customer remains responsible for determining whether it must notify a Supervisory Authority, Data Subject, client, insurer, or other person and for the content and timing of its notice.

10.4 Customer incidents

Customer must notify RunHarvester without undue delay of a breach or compromised credential in Customer-controlled systems that may affect the Service, RunHarvester, another customer, a Target, or Customer Personal Data processed by RunHarvester. Customer must cooperate with containment and rotate affected credentials.

11. Data Subject requests

11.1 Customer responsibility

Customer is responsible for responding to Data Subject requests concerning Customer Personal Data and for verifying identity, authority, exceptions, and scope.

11.2 RunHarvester assistance

Taking into account the nature of processing, RunHarvester will provide reasonable assistance through appropriate technical and organizational measures to enable Customer to respond to requests to:

• access;
• correct;
• delete;
• restrict processing;
• receive portable data;
• object;
• opt out of sale, sharing, or targeted advertising where applicable; or
• exercise another applicable privacy right.

Assistance may include Account controls, API functions, export or deletion features, support, and reasonable search of systems controlled by RunHarvester.

11.3 Requests received directly

If RunHarvester receives a request relating to Customer Personal Data for which Customer is the Controller, RunHarvester will, where legally permitted:

• inform the requester that RunHarvester acts for a Customer;
• direct the requester to Customer where Customer can be identified; or
• forward the request to Customer.

RunHarvester will not independently respond on Customer’s behalf unless Customer instructs it or law requires it.

11.4 Costs and limitations

Ordinary self-service assistance is included in the Service. If a request requires disproportionate, repetitive, bespoke, or forensic work beyond ordinary functionality, RunHarvester may charge reasonable fees based on documented costs, unless law prohibits charging.

RunHarvester is not required to disclose another customer’s data, compromise security, reveal trade secrets, or create data that it does not possess.

12. DPIAs, prior consultation, and compliance assistance

Taking into account the nature of processing and information available, RunHarvester will provide reasonable assistance with:

• Customer’s security obligations under Articles 32 to 34 EU GDPR or equivalent law;
• a DPIA under Article 35 EU GDPR, Article 35 UK GDPR, or equivalent law;
• prior consultation with a Supervisory Authority under Article 36; and
• reasonable documentation needed to demonstrate processor compliance.

Assistance may include this DPA, Schedule 1, Schedule 2, the Subprocessor Register, transfer information, security questionnaires, product documentation, and available audit reports or summaries.

Customer is responsible for conducting and approving its assessment. Bespoke workshops, extensive questionnaires, on-site support, regulator meetings, custom architecture review, or professional services may be subject to reasonable fees and scope agreement, except where the assistance is required because of RunHarvester’s breach.

13. Subprocessors

13.1 General authorization

Customer grants RunHarvester general written authorization to appoint the Subprocessors identified in the Subprocessor Register and to add or replace Subprocessors in accordance with this Section.

The version of the Subprocessor Register made available to Customer at acceptance, in an Order Form, or by notice is incorporated into Schedule 7. RunHarvester may preserve a timestamped snapshot or version identifier as evidence of the authorized list.

13.2 Subprocessor obligations

Before a Subprocessor processes Customer Personal Data, RunHarvester will enter into a written agreement requiring data-protection obligations that are materially equivalent to those applicable to RunHarvester for the relevant processing, including confidentiality, security, deletion or return, rights assistance, breach cooperation, and Restricted Transfer safeguards where required.

RunHarvester remains responsible to Customer for a Subprocessor’s performance of its data-protection obligations to the extent required by Applicable Data Protection Law.

13.3 Notice of changes

RunHarvester will provide notice of an intended new or replacement Subprocessor at least 15 calendar days before the Subprocessor begins processing Customer Personal Data, where practicable. Notice may be provided by email, Account notice, Subprocessor Register update notification, or another agreed mechanism.

Notice will identify the provider, purpose, and relevant processing location or transfer information. Customer is responsible for maintaining a monitored contact and, where Customer is a Processor, informing its Controller.

13.4 Emergency changes

RunHarvester may appoint a Subprocessor on shorter notice where reasonably necessary to address a security incident, provider failure, legal requirement, service continuity risk, or emergency. RunHarvester will provide notice as soon as reasonably practicable and preserve Customer’s objection rights.

13.5 Objection

Customer may object to a new Subprocessor only on reasonable, documented grounds relating to protection of Customer Personal Data. The objection must be sent to [email protected] within the notice period and explain the specific data-protection concern.

A general objection to a provider’s country, business model, or industry is insufficient unless it creates a concrete legal or security risk for Customer’s processing.

13.6 Resolution

The parties will work in good faith to resolve a valid objection. RunHarvester may:

• provide additional information or safeguards;
• avoid sending Customer Personal Data to the Subprocessor where technically and commercially reasonable;
• offer a reasonable alternative feature, route, or configuration; or
• discontinue the affected processing.

If no reasonable resolution is available, Customer may terminate only the affected Service or feature by written notice before the Subprocessor begins processing. RunHarvester will refund the prepaid unused fees attributable to the terminated portion, if any. Termination is Customer’s sole remedy for a Subprocessor objection, except for rights that cannot lawfully be limited.

13.7 Downstream model and routing providers

Where an AI routing service can select among downstream model providers, each downstream provider that may receive Customer Personal Data must be covered by the Subprocessor Register, an applicable provider allowlist, or another disclosure and authorization mechanism agreed with Customer. Unrestricted provider routing is not authorized merely because the routing platform is listed.

14. International transfers

14.1 Processing locations

RunHarvester may process Customer Personal Data in countries identified in the Subprocessor Register, Account, or Order Form. No data-localization commitment applies unless expressly stated in an Order Form.

Because RunHarvester is established in Hungary, a transfer to RunHarvester’s Hungarian establishment from the EEA is ordinarily not a third-country transfer. A Restricted Transfer may still occur through a processing location, Subprocessor, Customer-Directed Recipient, or direct transfer involving another jurisdiction.

14.2 Transfer safeguards

Where RunHarvester makes a Restricted Transfer to a Subprocessor, RunHarvester will use a legally recognized safeguard, such as:

• an adequacy decision;
• the EU SCCs;
• the UK Addendum or another UK-approved mechanism;
• the Swiss adaptations in Schedule 5;
• binding corporate rules; or
• another mechanism permitted by Applicable Data Protection Law.

14.3 Customer-Directed Transfers

Customer is responsible for Restricted Transfers to Customer-Directed Recipients. RunHarvester will provide reasonable information available to it about the technical disclosure, but does not select or contract with those recipients on Customer’s behalf unless they are also RunHarvester Subprocessors.

14.4 EU SCCs

Schedule 3 applies where a direct Restricted Transfer between the parties requires the EU SCCs. For onward Restricted Transfers, RunHarvester will enter into the applicable EU SCC module or another lawful mechanism with the relevant Subprocessor.

The EU SCCs do not apply where the transfer is covered by an adequacy decision, is not a Restricted Transfer, or another valid mechanism agreed by the parties applies.

14.5 UK Addendum

Schedule 4 applies where a direct Restricted Transfer between the parties requires the UK Addendum. RunHarvester will use the UK Addendum or another lawful UK transfer mechanism for relevant onward transfers to Subprocessors.

14.6 Swiss transfers

Schedule 5 applies to a Restricted Transfer governed by the Swiss FADP where the EU SCCs are used as the transfer mechanism.

14.7 Transfer assessments and supplementary measures

Upon reasonable request, RunHarvester will provide information available to it that Customer reasonably needs to assess an applicable Restricted Transfer, subject to confidentiality and security restrictions. RunHarvester will implement supplementary technical, contractual, or organizational measures where reasonably necessary and appropriate to the risk.

Each party is responsible for its own legal assessment. RunHarvester is not required to disclose confidential legal advice, security-sensitive details, another customer’s information, or a Subprocessor’s trade secrets.

14.8 Invalid or replaced mechanism

If a transfer mechanism is invalidated, replaced, or no longer lawful, the parties will cooperate in good faith to implement a valid alternative. RunHarvester may suspend the affected transfer if no lawful mechanism is available.

15. Government access and legally binding requests

Where RunHarvester or a Subprocessor receives a legally binding request for Customer Personal Data, RunHarvester will, to the extent legally permitted and reasonably practicable:

• review the request for facial validity and appropriate authority;
• seek clarification, narrow the request, or challenge it where there are reasonable grounds;
• disclose only the minimum data legally required;
• notify Customer before disclosure or as soon as legally permitted;
• document the request and response; and
• maintain safeguards required by the applicable transfer mechanism.

RunHarvester will not voluntarily provide bulk, indiscriminate, or disproportionate access to Customer Personal Data to a public authority. Nothing in this Section requires RunHarvester to violate law or disclose privileged legal advice.

16. Return, export, deletion, and backups

16.1 During the term

Customer may retrieve, export, or delete Customer Personal Data through supported Account, API, result, evidence, and deletion functions, subject to Service functionality, ordinary retention, legal restrictions, and security.

Data API result content is ordinarily available for seven days after completion unless a different period applies. Customer must retrieve needed results before expiry. One-run browser session state is designed to be deleted when the run reaches a terminal status, subject to incident preservation and technical deletion cycles.

16.2 End of processing

At the end of the Services involving processing, RunHarvester will, at Customer’s choice and subject to Section 16.4:

• return Customer Personal Data in a supported format; or
• delete Customer Personal Data.

Customer’s choice may be made through Account controls, a termination or switching request, an Order Form, or written instruction. If Customer gives no instruction, RunHarvester may delete the data after the applicable retrieval period.

16.3 Deletion timing

RunHarvester will complete active-system deletion without undue delay according to the applicable product retention and deletion cycle. Data in backups will be isolated from ordinary use and deleted or overwritten through the ordinary backup lifecycle, unless restoration is required for disaster recovery. If restored, applicable deletion instructions will be reapplied where reasonably practicable.

16.4 Permitted retention

RunHarvester may retain limited data where required by law or reasonably necessary for:

• tax, accounting, payment, and corporate records;
• security, fraud, abuse, and incident investigation;
• establishment, exercise, or defense of legal claims;
• proof of instructions, billing, deletion, consent, or contract performance;
• legal hold or regulatory requirement; or
• data that has been irreversibly anonymized so it is no longer Personal Data.

Retained Customer Personal Data remains protected by this DPA, is not used for an incompatible purpose, and is deleted when the retention ground ends.

16.5 Certification

Upon reasonable written request after termination, RunHarvester will confirm completion of deletion or describe the lawful basis and expected lifecycle for remaining copies. RunHarvester is not required to expose internal backup architecture or security-sensitive information.

16.6 Customer copies

RunHarvester is not responsible for copies that Customer or a Customer-Directed Recipient exported, downloaded, logged, emailed, stored, or otherwise placed outside RunHarvester’s control.

17. Audit and demonstration of compliance

17.1 Information rights

RunHarvester will make available information reasonably necessary to demonstrate compliance with this DPA and Article 28, which may include:

• this DPA and its Schedules;
• security and privacy summaries;
• the Subprocessor Register;
• relevant policies and questionnaire responses;
• available independent audit or assessment reports, certifications, or summaries, if any; and
• reasonable explanations from qualified personnel.

RunHarvester does not represent that a certification or independent report exists unless expressly provided.

17.2 Audit sequence

Customer must first use available documentation and remote information. If that information is insufficient to demonstrate compliance with a specific legal requirement, Customer may request an additional audit no more than once in any 12-month period, unless:

• a Personal Data Breach materially affecting Customer occurred;
• a Supervisory Authority requires an audit; or
• Customer has reasonable documented grounds to suspect a material breach of this DPA.

17.3 Audit conditions

An audit must:

• be limited to systems and processing relevant to Customer Personal Data;
• occur during normal business hours on at least 30 days’ notice, unless urgency is legally justified;
• avoid unreasonable disruption;
• comply with security, confidentiality, safety, and access policies;
• not expose another customer’s data, source code, credentials, vulnerability details, or trade secrets;
• use an independent auditor that is not a competitor and is bound by confidentiality; and
• be coordinated with RunHarvester.

RunHarvester may satisfy an on-site request through an independent audit report, virtual review, written evidence, or another method that provides materially equivalent assurance.

17.4 Costs

Customer bears its audit costs and RunHarvester’s reasonable costs of bespoke audit support, unless the audit identifies a material breach by RunHarvester, in which case RunHarvester will bear its own reasonable remediation and support costs.

17.5 Remediation

If an audit identifies a material non-compliance, RunHarvester will develop and implement a reasonable remediation plan. Audit information is RunHarvester Confidential Information.

18. U.S. state privacy terms

Schedule 6 applies where Customer Personal Data is governed by a U.S. state privacy law that requires contractual terms for a service provider, contractor, or processor. The parties agree that the specific business purposes are those described in Schedule 1 and are not expanded by a general reference to the Agreement.

19. De-identified and aggregated data

RunHarvester may create and use aggregated or de-identified information derived from Service operation only where it:

• does not identify Customer, an Authorized User, a Data Subject, or a Target account;
• cannot reasonably be linked back using means available to RunHarvester;
• is not combined with data to re-identify a person; and
• is protected against re-identification where Applicable Data Protection Law requires it.

RunHarvester will not attempt to re-identify de-identified data except to test whether de-identification is effective or where law permits and appropriate safeguards apply.

This Section does not authorize use of identifiable Customer Personal Data for advertising, data brokerage, or unrestricted model training.

20. Liability

The liability provisions of the Agreement apply to this DPA, subject to the following:

• they do not limit rights or liability that cannot lawfully be limited;
• they do not prejudice Data Subject rights under the EU SCCs or UK Addendum;
• they do not reduce a party’s obligation to comply with a Supervisory Authority’s binding order; and
• where the EU SCCs or UK Addendum conflict with a limitation, the transfer instrument controls.

Each party remains responsible for its own compliance, instructions, systems, personnel, and independent Controller processing.

21. Termination

This DPA terminates when RunHarvester no longer processes Customer Personal Data on Customer’s behalf, except that provisions concerning confidentiality, deletion, audits, government requests, liability, and transfer instruments survive for as long as relevant data or obligations remain.

Termination of this DPA does not automatically terminate the Agreement unless the Agreement or mandatory law provides otherwise.

22. Notices and changes

22.1 Notices

Privacy, DPA, transfer, Subprocessor, and legal notices to RunHarvester must be sent to [email protected] with a clear subject. Notices to Customer may be sent to the Account administrator, privacy contact, legal contact, or other address in the Agreement.

22.2 Changes required by law

RunHarvester may update this DPA to reflect a change in Applicable Data Protection Law, an approved transfer mechanism, or a regulator’s binding requirement. A change may not materially reduce protection of Customer Personal Data without a lawful basis and appropriate notice.

22.3 Other changes

A material non-mandatory change will be notified through email, Account notice, legal page, or another reasonable method. Continued use after the effective date constitutes acceptance to the extent permitted by law. Customer may cease the affected processing if it does not accept the change.

23. General provisions

23.1 Entire processing agreement

This DPA and the processing-related provisions of the Agreement form the entire agreement concerning RunHarvester’s processing of Customer Personal Data as Processor or Sub-processor, except for a signed enterprise addendum that expressly modifies them.

23.2 Severability

If a provision is invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remainder remains effective. The EU SCCs and UK Addendum are not modified except as they permit.

23.3 Governing law

Except where the EU SCCs, UK Addendum, Swiss FADP, or mandatory law requires otherwise, this DPA is governed by the governing-law and venue provisions of the Agreement.

23.4 No third-party beneficiaries

There are no third-party beneficiaries except Data Subjects and other persons expressly granted rights by the EU SCCs, UK Addendum, Applicable Data Protection Law, or another mandatory provision.

23.5 Electronic signature

Electronic acceptance of the Agreement constitutes signature of this DPA and, where permitted, the transfer schedules. A party may request a countersigned copy for procurement records, but lack of a separate signature does not invalidate electronic acceptance.

Schedule 1 - Processing Details and Annex I to the EU SCCs

Part A - Parties

Data exporter

The data exporter is:

• Customer, where Customer transfers Customer Personal Data subject to the EU SCCs to a data importer under this DPA; or
• RunHarvester, where RunHarvester transfers Customer Personal Data to a data importer Subprocessor under a separate onward-transfer agreement.

For a direct transfer under this DPA, Customer’s legal name, address, registration details, contact person, and signature are those identified in the Agreement, Account, Order Form, or electronic acceptance record.

Activities relevant to the transfer: use of the Service as described below.
Role: Controller for Module 2 or Processor for Module 3, as applicable.
Signature and date: electronic acceptance or the applicable Order Form.

Data importer

For a direct transfer under this DPA, the data importer is the RunHarvester entity or other party identified as receiving data in a third country and subject to the applicable EU SCC module. The current RunHarvester contracting entity is:

Isentró Kft.
1082 Budapest, Corvin sétány 6, 8th floor, unit 4, Hungary
Contact: [email protected]
Activities: provision of the Service and processing described in this Schedule.
Role: Processor for Module 2 or Sub-processor for Module 3, as applicable.
Signature and date: electronic acceptance or the applicable Order Form.

Because Isentró Kft. is established in Hungary, the EU SCCs ordinarily operate only as a conditional fallback where a direct Restricted Transfer actually requires them. RunHarvester’s onward transfers to third-country Subprocessors are governed by separate transfer arrangements with those Subprocessors.

Part B - Description of processing

1. Subject matter

RunHarvester processes Customer Personal Data to provide web-data operations requested by Customer, including request routing, proxy use, HTTP or browser execution, Target interaction, capture, extraction, structured output, evidence, result delivery, optional AI-assisted recipe generation or repair, support, security, and related Service functions.

2. Duration

Processing continues for the term of the Agreement and the period necessary to return, retrieve, delete, secure, investigate, or lawfully retain Customer Personal Data in accordance with Section 16.

3. Nature of processing

Processing may include:

• receiving, collecting, retrieving, recording, organizing, structuring, and storing;
• transmitting requests to Targets and receiving responses;
• proxy routing and geographic routing;
• HTTP execution and browser automation;
• rendering, navigation, waiting, interaction, challenge handling, and session management;
• reading or applying Customer-supplied headers, cookies, credentials, tokens, variables, and browser state;
• capturing HTML, text, JSON, XML, images, files, screenshots, evidence, network responses, status, and events;
• parsing, filtering, selecting, transforming, validating, extracting, and structuring;
• generating or repairing recipes through optional AI processing;
• caching, retrying, deduplicating, metering, and attributing usage;
• encrypting, decrypting, isolating, logging, monitoring, and troubleshooting;
• delivering results through API, dashboard, webhook, integration, or another Customer-selected destination; and
• restricting, returning, exporting, deleting, or anonymizing.

4. Purposes

The purposes are limited to:

• executing Customer’s documented instructions;
• providing the Service and requested Outputs;
• maintaining security, integrity, availability, tenant isolation, and abuse prevention;
• providing Customer-requested support and troubleshooting;
• measuring usage and preventing duplicate or incorrect processing as necessary to provide the Service;
• complying with law binding on RunHarvester; and
• returning or deleting Customer Personal Data.

RunHarvester does not process Customer Personal Data for cross-context behavioural advertising, sale to data brokers, or unrestricted training of a RunHarvester general-purpose model.

5. Categories of Data Subjects

Depending on Customer’s Targets and fields, Data Subjects may include:

• Customer’s employees, contractors, representatives, Authorized Users, clients, and users;
• users, visitors, account holders, customers, subscribers, sellers, buyers, authors, publishers, developers, and other participants associated with a Target;
• business contacts, professionals, company representatives, directors, owners, and personnel;
• persons named in public pages, public records, directories, marketplaces, repositories, news, social pages, or other Customer-selected sources;
• website owners, administrators, network operators, and proxy endpoint operators;
• persons appearing in images, screenshots, documents, communications, reviews, comments, listings, or evidence; and
• any other person whose Personal Data appears in Customer Content or a response selected by Customer.

6. Categories of Personal Data

Depending on Customer’s instructions, Customer Personal Data may include:

• names, aliases, usernames, handles, profile identifiers, account identifiers, and public identifiers;
• business and personal contact details;
• professional, employment, education, company, role, and public-profile information;
• online identifiers, IP addresses, domains, URLs, device, browser, cookie, user-agent, session, and network information;
• approximate or declared geographic information;
• public posts, comments, reviews, listings, product data, marketplace data, repository information, documents, text, images, and other content;
• communication content where Customer is authorized to process it;
• commercial, transaction, product, pricing, availability, and relationship information;
• Target credentials, headers, cookies, tokens, session state, and other authentication data supplied by Customer for authorized execution;
• request, event, status, latency, error, evidence, screenshot, and result metadata;
• Customer-defined fields, selectors, schemas, recipes, prompts, transformations, and extracted values; and
• incidental Personal Data contained in a Target response.

7. Special Categories and sensitive data

The Service is not intended for Special Categories of Personal Data, criminal-offence data, children’s high-risk data, biometric identification, protected health information, full payment-card data, government identifiers, private communications, or other Restricted Data unless expressly approved in writing and subject to appropriate safeguards.

Such data may appear incidentally in a Target response. Customer must minimize, mask, filter, restrict, and delete it where not necessary.

8. Frequency

Processing is continuous, recurring, scheduled, batched, or ad hoc, depending on Customer’s API calls and configuration.

9. Retention

Retention follows Section 16, the Documentation, Account settings, and any Order Form. In particular:

• Data API result content is ordinarily available for seven days after completion;
• one-run browser session state is designed to be deleted at terminal run status;
• screenshots, evidence, traces, and temporary artifacts are retained for the feature-specific short period shown in the Service or Agreement;
• designated secrets are retained only as needed for authorized execution, retry, recovery, or requested support and are subject to secure cleanup;
• request, run, usage, billing, security, and audit metadata may be retained longer where necessary for contract, billing, incident, abuse, legal, and dispute purposes; and
• backups are overwritten through the ordinary lifecycle, subject to legal hold and disaster recovery.

10. Customer-Directed Recipients

Customer may instruct disclosure to Targets, proxy routes, webhooks, integrations, storage destinations, or other recipients. Customer is responsible for the recipient relationship and transfer mechanism under Section 6.

11. AI processing

If Customer enables AI-assisted recipe generation, repair, or another AI feature, RunHarvester may send minimized instructions, schemas, page excerpts, extracted values, and error context to authorized AI Subprocessors. The relevant providers and locations must appear in the Subprocessor Register. Credentials and unnecessary Restricted Data must not be sent.

12. Subprocessor processing

Subprocessors may provide hosting, compute, database, storage, content delivery, security, proxy routing, AI routing, AI models, CAPTCHA services, error monitoring, telemetry, email, support, authentication, or other infrastructure necessary for the enabled Service. Their processing is limited to the relevant function and the Subprocessor Register.

Part C - Competent Supervisory Authority

For the EU SCCs, the competent Supervisory Authority is determined under Clause 13 of the EU SCCs.

Where RunHarvester is the data exporter established in Hungary and Clause 13 designates its authority, the authority is:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

Where Customer is the data exporter, the competent authority is the authority determined by Customer’s establishment, representative, or affected Data Subjects under Clause 13.

Schedule 2 - Technical and Organizational Measures (TOMs) and Annex II to the EU SCCs

RunHarvester will maintain measures materially equivalent to those below for the relevant Service components. Measures may evolve as technology changes, provided the overall level of protection is not materially reduced. This Schedule does not disclose credentials, exploit details, exact network topology, key material, or other information that would weaken security.

1. Security governance and risk management

• Defined responsibility for Service security, privacy, incident handling, access, and vendor oversight.
• Policies and procedures appropriate to company size and processing risk.
• Periodic review of material risks, access, vendors, retention, and security controls.
• Data-protection and security considerations in material product and infrastructure changes.
• Records of relevant incidents, remediation, and compliance decisions.

2. Personnel security and confidentiality

• Confidentiality obligations for personnel and contractors with access to Personal Data.
• Role-appropriate security and privacy guidance.
• Access granted according to role and business need.
• Access review and removal when duties change or engagement ends.
• Administrative and production access limited to authorized personnel.

3. Identity, authentication, and access control

• Account authentication and authorization controls.
• Verified-account controls for relevant functions.
• Role and permission enforcement for users and administrators.
• Scoped API keys for programmatic access.
• API-key values protected through keyed hashing or equivalent non-plaintext verification, with constant-time comparison in relevant components.
• Multi-factor authentication and recovery controls where supported.
• Credential revocation, rotation, and compromise response.
• Separation of customer and administrative interfaces.

4. Tenant isolation and authorization

• Customer and API-key tenant boundaries enforced in application logic and data access.
• Owner and organization attribution for requests, results, usage, and billing.
• Authorization checks before access to results, events, evidence, Account data, and administrative functions.
• Ownerless diagnostic or administrative data separated from Customer-accessible data.
• Administrative access subject to role controls and auditability.

5. Encryption and cryptographic controls

• TLS or equivalent encrypted transport for supported public Service interfaces.
• Authenticated encryption at rest for designated target secrets, headers, cookies, proxy credentials, and ephemeral session material in relevant components, including AES-256-GCM or a materially equivalent control.
• Encryption keys and secrets separated from ordinary application data and managed through restricted configuration or secret-management processes.
• API credentials not intentionally stored in recoverable plaintext after issuance where the applicable key design uses one-way verification.
• Rotation or replacement procedures for compromised secrets.

6. Secret and sensitive-data handling

• Decryption of designated execution secrets limited to the worker or component that needs them.
• Redaction of sensitive values in ordinary logs, errors, responses, support material, and administrative displays.
• Restrictions against placing full API keys, passwords, authorization headers, cookies, proxy credentials, or private keys in analytics and ordinary telemetry.
• Customer guidance to minimize secrets and use restricted service accounts.
• Cleanup of execution secrets according to feature lifecycle and retention.

7. Network and request security

• URL, scheme, host, DNS, redirect, and destination validation designed to reduce server-side request forgery risk.
• Restrictions on private, local, reserved, metadata, and otherwise unsafe network destinations in relevant public request paths.
• Browser resource-routing and navigation controls for relevant workflows.
• Timeout, payload-size, concurrency, rate, and request controls.
• Proxy validation, protocol checks, and endpoint health classification where relevant.
• Controlled failure where a required proxy or route is unavailable rather than unintended direct connection where the mode requires proxying.

8. Application security and secure development

• Typed request and response validation for relevant interfaces.
• Input schemas, payload limits, and validation of URLs, fields, recipes, and transformations.
• Safe regular-expression and JSON-schema validation in relevant recipe functions.
• Transactional processing, idempotency controls, and queue locking for relevant job lifecycle functions.
• Automated type checking, tests, builds, static analysis, and container build checks in the development pipeline.
• Dependency review and patching based on risk and operational feasibility.
• Separation of API, worker, maintenance, and validator roles where applicable.

9. Browser and session isolation

• Browser contexts and session handling designed to isolate Customer executions.
• Customer-provided cookies, headers, and session state applied only to authorized execution.
• One-run browser session state encrypted at rest in relevant components, not returned through ordinary result APIs, and designed for deletion at terminal run status.
• Restricted and authenticated access to any operational browser support interface.
• Evidence and screenshots subject to tenant access and retention controls.

10. Logging, monitoring, and auditability

• Request identifiers and structured lifecycle records.
• Authentication, authorization, request, job, billing, error, and security events as relevant.
• Service health and metrics interfaces.
• Error monitoring, OpenTelemetry, Prometheus, or comparable observability where configured.
• Redaction and minimization of sensitive values in monitoring systems.
• Records sufficient to investigate material incidents, abuse, billing disputes, and unauthorized access, subject to retention limits.

11. Availability, integrity, and resilience

• Durable database-backed job processing with locking, heartbeat, recovery, or retry controls for relevant public scrape and recipe workflows.
• Graceful shutdown and recovery procedures for relevant services.
• Health checks and operational monitoring.
• Database and infrastructure backup arrangements appropriate to the deployed environment.
• Recovery and restoration procedures, with deletion instructions reapplied where reasonably practicable after restoration.
• Capacity, rate, and concurrency controls designed to protect availability.

No specific recovery time, recovery point, or uptime commitment applies unless stated in an Order Form.

12. Incident response

• Procedures to identify, triage, contain, investigate, remediate, and document security incidents.
• Escalation to responsible personnel.
• Preservation of evidence where appropriate.
• Customer notification in accordance with Section 10.
• Post-incident remediation and control review appropriate to severity.

13. Data minimization, retention, and deletion

• Product and API controls that allow Customer to limit Targets, fields, evidence, and data submitted.
• Short ordinary retention for result content as described in Schedule 1.
• Lifecycle cleanup for designated secrets and temporary state.
• Account and data deletion processes subject to verification, legal obligations, and backup cycles.
• Separation of longer-lived billing, audit, security, and legal metadata from short-lived result content.
• Anonymization or aggregation where data is used without identifying Customer or Data Subjects.

14. Subprocessor and supplier management

• Privacy and security review proportionate to provider risk.
• Written data-processing terms with Subprocessors.
• Restricted Transfer safeguards where required.
• Subprocessor change notice and objection process.
• Limitation of provider access to the function required.
• Review of material incident, deletion, retention, and security commitments where available.

15. Physical and environmental security

RunHarvester relies on professional data-center and infrastructure providers for physical security of hosted systems. Relevant providers maintain physical access, environmental, power, and facility protections under their own security programs and RunHarvester’s contracts. RunHarvester office access does not provide unrestricted physical access to hosted production systems.

16. Customer-facing security controls

Depending on the feature, Customer can use:

• role and permission management;
• scoped and revocable API keys;
• Account verification and multi-factor authentication;
• request validation and explicit modes;
• secure webhook configuration and signature validation;
• configurable retention or deletion features;
• restricted evidence access;
• optional disabling or limitation of AI features; and
• Account export and deletion controls.

Customer is responsible for configuring and using available controls appropriately.

Schedule 3 - EU Standard Contractual Clauses

1. Conditional incorporation

Where a direct Restricted Transfer between the parties requires the EU SCCs, the applicable module of the EU SCCs is incorporated into and forms part of this DPA without alteration, except for selections, completion of annexes, and additional safeguards expressly permitted by the EU SCCs.

The official clauses are those annexed to European Commission Implementing Decision (EU) 2021/914. This Schedule incorporates that official text; it does not replace, summarize, or modify it. The EU SCCs apply only where the relevant data importer and transfer are eligible to rely on them under that Decision.

If the European Commission replaces the EU SCCs, the existing clauses continue for the lawful transition period. RunHarvester may update this Schedule to incorporate the successor clauses after appropriate notice, and the parties will complete or execute any additional information reasonably required for continued lawful transfers.

For an onward Restricted Transfer to a Subprocessor, RunHarvester will enter into the applicable module of the EU SCCs or another lawful transfer mechanism directly with that Subprocessor.

On a valid request by a Data Subject entitled to receive them, the relevant party will provide, free of charge, a copy of the official EU SCC text as incorporated, the selected module and options, and the completed annex information. Information may be redacted only to the extent permitted by the EU SCCs, and a meaningful summary will be supplied where required.

2. Applicable modules

• Module 2 - Controller to Processor applies where Customer is a Controller and a direct Restricted Transfer to a RunHarvester data importer requires the EU SCCs.
• Module 3 - Processor to Processor applies where Customer is a Processor and a direct Restricted Transfer to a RunHarvester data importer requires the EU SCCs.
• Module 1 or Module 4 applies only if an Order Form expressly states that the facts require it and completes the necessary information.

3. Clause selections

For Modules 2 and 3:

• Clause 7 (Docking Clause): applies.
• Clause 9(a): Option 2, general written authorization, applies.
• Notice period under Clause 9(a): 15 calendar days, subject to the emergency-change process in Section 13.4.
• Clause 11 (Optional redress): the optional language does not apply.
• Clause 17: Option 1 applies; the law of Hungary governs, provided that law allows third-party beneficiary rights. If it does not for a particular transfer, the law of another EEA Member State that does will apply as agreed by the parties.
• Clause 18(b): the courts of Hungary have jurisdiction, subject to Data Subject rights under the EU SCCs.

For Module 3, Customer confirms that the relevant Controller has authorized the processing and Subprocessors and that Customer can make the EU SCC obligations available to the Controller as required.

4. Annex completion

• Annex I.A - List of parties: Schedule 1, Part A.
• Annex I.B - Description of transfer: Schedule 1, Part B.
• Annex I.C - Competent Supervisory Authority: Schedule 1, Part C.
• Annex II - TOMs: Schedule 2.
• Annex III - List of Subprocessors: the Subprocessor Register incorporated through Schedule 7, for the processing to which the EU SCCs apply.

5. Additional safeguards

The following supplement the EU SCCs without contradicting them:

• the security measures in Schedule 2;
• the government-access commitments in Section 15;
• minimization of data sent to Subprocessors;
• encryption in transit and designated encryption at rest;
• access limitation, confidentiality, and auditability;
• transfer assessment cooperation under Section 14.7; and
• suspension of an affected transfer where no lawful safeguard is available.

6. Conflicts and liability

A term in the Agreement that conflicts with or reduces a right under the EU SCCs does not apply to the conflict. Liability and third-party beneficiary rights under the EU SCCs remain governed by the EU SCCs.

7. Signatures

Electronic acceptance of this DPA constitutes execution of the EU SCCs where electronic signature is legally valid. The parties may sign a counterpart or Order Form containing the same selections without changing the effective date of the underlying Agreement.

Schedule 4 - UK International Data Transfer Addendum

This Schedule applies where a direct Restricted Transfer between the parties is governed by UK Data Protection Laws and requires the UK Addendum. For onward transfers, RunHarvester will use the UK Addendum or another valid UK transfer mechanism with the relevant Subprocessor.

Part 1 - Tables

Table 1 - Parties

Exporter: the party identified as exporter for the relevant UK Restricted Transfer in the Agreement, Account, Order Form, or Schedule 1. Where Customer transfers UK Personal Data to a RunHarvester data importer, Customer is exporter.

Importer: the party identified as importer for the relevant UK Restricted Transfer. Where Customer transfers UK Personal Data to a RunHarvester data importer, that RunHarvester entity is importer.

Exporter contact: Customer’s privacy, legal, or Account contact identified in the Agreement.
Importer contact for RunHarvester: [email protected].
Key activities: the processing described in Schedule 1.
Signatures: electronic acceptance of this DPA or the applicable Order Form.

Table 2 - Selected EU SCCs, modules, and clauses

• The Approved EU SCCs are the EU SCCs described in Schedule 3.
• Module 2 applies for Controller-to-Processor transfers.
• Module 3 applies for Processor-to-Processor transfers.
• Clause 7 applies.
• Clause 9 uses Option 2 with a 15-calendar-day notice period.
• The optional wording in Clause 11 does not apply.
• The selections in Schedule 3 apply except where the mandatory UK Addendum changes them.

Table 3 - Appendix information

• List of parties: Schedule 1, Part A, as adapted for the UK transfer.
• Description of transfer: Schedule 1, Part B.
• TOMs: Schedule 2.
• Subprocessors: the Subprocessor Register incorporated through Schedule 7.

Table 4 - Ending the UK Addendum when the approved form changes

Neither party may end the UK Addendum solely under the optional termination right associated with an approved revision of the UK Addendum. The parties will instead cooperate to implement the revised approved terms or another valid transfer mechanism.

Part 2 - Mandatory clauses

Part 2 consists of the mandatory clauses in the ICO-approved UK Addendum B.1.0 that was laid before Parliament on 2 February 2022 under section 119A of the Data Protection Act 2018, together with revisions made under Section 18 of those clauses. Those mandatory clauses are incorporated by reference and bind both parties.

The parties intend this paragraph to use the ICO-approved incorporation-by-reference method. If a prescribed replacement sentence or form becomes necessary for continued validity, that prescribed text applies to the minimum extent necessary without reducing Data Subject protection.

If this Schedule conflicts with the mandatory clauses of the UK Addendum, the mandatory clauses control. References to law, regulator, courts, and terminology are interpreted as required by the UK Addendum.

Electronic acceptance of this DPA constitutes signature of the UK Addendum where legally valid.

Schedule 5 - Swiss Transfer Adaptations

Where the Swiss FADP applies to a Restricted Transfer and the parties use the EU SCCs:

1. references in the EU SCCs to the GDPR are interpreted to include the Swiss FADP to the extent applicable;
2. references to “Member State” or the EU are interpreted to include Switzerland where necessary for the transfer, without preventing Data Subjects in Switzerland from exercising rights in Switzerland;
3. the competent authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC) where the Swiss FADP so requires;
4. the term “Personal Data” includes data protected under the Swiss FADP;
5. references to Special Categories include sensitive personal data under the Swiss FADP;
6. if a transfer is governed exclusively by the Swiss FADP, the governing law and courts in Clauses 17 and 18 are those of Switzerland to the extent required for enforceability; otherwise the selections in Schedule 3 remain;
7. the EU SCCs also protect data relating to legal persons only if and to the extent the applicable version of Swiss law protects such data; and
8. these adaptations do not reduce protection under the EU SCCs where the EU GDPR also applies.

Schedule 6 - U.S. State Privacy Addendum

This Schedule applies to Customer Personal Data subject to a U.S. state privacy law that regulates a service provider, contractor, or processor, including the California Consumer Privacy Act as amended (“CCPA”).

1. Roles and limited purposes

Customer is the business, controller, or equivalent entity, and RunHarvester is the service provider, contractor, processor, or equivalent recipient for Customer Personal Data.

Customer discloses Customer Personal Data to RunHarvester only for the specific business purposes described in Schedule 1, including request execution, proxy routing, browser processing, extraction, result delivery, optional AI processing selected by Customer, security, support, and deletion. The purposes are limited and specified and are not expanded by a generic reference to the entire Agreement.

2. Restrictions

RunHarvester will not, with respect to Customer Personal Data processed under this Schedule:

• sell or share it as those terms are defined by applicable law;
• use it for cross-context behavioural advertising;
• retain, use, or disclose it for a purpose outside the limited purposes in Schedule 1, except as permitted by applicable law;
• retain, use, or disclose it outside the direct business relationship with Customer, except as permitted by applicable law;
• combine it with Personal Data received from another person or collected from RunHarvester’s own interaction with a consumer, except where applicable law expressly permits the combination; or
• attempt to re-identify de-identified data except as permitted for testing or compliance.

3. Level of protection

RunHarvester will comply with applicable obligations imposed on a service provider, contractor, or processor and will provide the same level of privacy protection required by the applicable law for the Customer Personal Data within its role.

RunHarvester will notify Customer if it determines that it can no longer meet a material obligation under this Schedule.

4. Customer oversight and remediation

Customer may take reasonable and appropriate steps to ensure RunHarvester uses Customer Personal Data consistently with Customer’s obligations, using the audit framework in Section 17.

Upon notice of suspected unauthorized use, Customer may require reasonable steps to stop and remediate the use. RunHarvester will cooperate and provide reasonable confirmation of remediation, subject to security, confidentiality, and proportionality.

5. Consumer requests

RunHarvester will enable Customer to comply with applicable consumer requests through the assistance in Section 11. If RunHarvester receives a request directly, it will act on Customer’s instructions or inform the consumer that the request must be directed to Customer, as applicable.

6. Subcontractors

A Subprocessor that processes Customer Personal Data subject to this Schedule must be bound by written terms that provide substantially equivalent restrictions and protections.

7. Security, risk assessments, and audits

RunHarvester will maintain reasonable security procedures appropriate to the nature of Customer Personal Data. Taking into account its role and information available, RunHarvester will reasonably assist Customer with legally required cybersecurity audits, risk assessments, or automated-decision obligations to the extent they concern RunHarvester’s processing and the assistance is required by applicable law.

8. State-specific interpretation

Terms such as consumer, sale, sharing, targeted advertising, business, controller, processor, service provider, contractor, and sensitive data have the meaning given by the applicable state law. If a state law imposes a stricter mandatory processor term, that term is incorporated to the minimum extent necessary.

Schedule 7 - Subprocessor Register and Change Record

1. Incorporated register

Before RunHarvester relies on the general authorization in Section 13 for production processing, it must make a current Subprocessor Register available to Customer. Generic provider categories alone are not a complete register and do not replace the provider-specific information required by this Schedule.

The current Subprocessor Register is incorporated into this DPA. It may be provided through:

• a RunHarvester legal page or documentation page;
• an Account or enterprise portal;
• an Order Form or procurement package;
• a versioned attachment; or
• a copy supplied on request to [email protected].

For auditability, the register should identify a version or date, and RunHarvester may preserve the version associated with Customer’s acceptance.

2. Required fields

For each Subprocessor that may receive Customer Personal Data, the register will identify, at minimum:

3. Provider categories

Depending on enabled features, the register may include providers for:

• infrastructure hosting, compute, networking, database, storage, and content delivery;
• datacenter or residential proxy routing;
• AI routing and downstream model inference;
• CAPTCHA or challenge services;
• error monitoring, telemetry, and security;
• email, support, authentication, and notifications;
• object storage and evidence delivery; and
• other technical operations that process Customer Personal Data.

A payment provider or identity provider that processes only RunHarvester Controller data may be described in the Privacy Policy rather than this register. It must be included here if it processes Customer Personal Data as RunHarvester’s Subprocessor.

4. Downstream AI providers

The register must identify each downstream AI model provider that can receive Customer Personal Data, not only the routing platform. RunHarvester may satisfy this through a restricted allowlist incorporated into the register. A provider not listed or otherwise authorized must not receive Customer Personal Data.

5. Change record

RunHarvester will maintain evidence of material Subprocessor notices, effective dates, objections, and resolutions for an appropriate contractual and compliance period.

Optional signature block

The parties may execute this DPA through the Agreement or by signing below.