Data processing addendum
Template, version 1, 2026-10-23.
Our datasets hold no personal data, and using the API does not require you to send us any. The only personal data we handle for a customer is the account data of your contacts. This page explains the roles and is the template we sign when your procurement process asks for a DPA. To get a countersigned copy, write to [email protected] with your company's legal name and address.
1. Roles
For account and usage data, Arcadium Data (the company named in the legal notice, "we") is an independent controller: we decide how that data is used, within the purposes below, and our privacy notice applies. A processor agreement under GDPR Art. 28 is not needed for it.
The data we sell (companies, jobs, contracts, aggregates) is not customer data and contains no personal data. If, against this design, an input you send us (for example a watchlist entry) contains personal data, we process it as your processor, only to provide the service, under sections 3 to 9 of this addendum.
2. Data, purposes and roles
| Category | What | Our role | Purpose |
|---|---|---|---|
| Account data | Business email address of the customer’s contact, company name and website domain, plan, billing details | Controller | To set up and run the account, answer support requests, invoice and meet tax law |
| Usage data | API key hash and prefix, daily call counts per route, error counts; IP addresses of anonymous callers held in memory for rate limiting | Controller | Quotas, billing, abuse protection and service security |
| Customer inputs | Company domains on watchlists, query parameters | Processor, only if an input contains personal data | To answer the request and deliver watchlist changes; never used for anything else |
Data subjects: the customer's employees or contractors who are named as account contacts. No special categories of data (GDPR Art. 9) and no data about children are processed.
3. Our duties as processor
Where we act as your processor, we:
- process the data only on your documented instructions, which are the agreement and your use of the API;
- make sure the people who can access it are bound to confidentiality;
- apply the technical and organisational measures described on our security page to it;
- help you answer data subject requests and meet your duties under GDPR Art. 32 to 36, as far as we can;
- delete the data when the agreement ends (watchlists and keys are deleted within 30 days), unless law requires us to keep it;
- give you the information needed to show compliance with GDPR Art. 28, as set out in section 8.
4. Sub-processors
You authorise the sub-processors below. We give you at least 30 days' notice by email before we add or replace one; you may object on reasonable data-protection grounds, and if we cannot address the objection you may end the affected service and get a refund of the unused prepaid period.
| Provider | Location and transfer basis | Purpose |
|---|---|---|
| Hetzner Online GmbH | Germany (EU) | Hosting of the API, the MCP server and the database |
| Cloudflare, Inc. | Global network; EU-US Data Privacy Framework and standard contractual clauses | Website delivery and DNS; storage of encrypted off-site backups (R2) |
| Apify Technologies s.r.o. | Czech Republic (EU) | Only for customers who use our actors or the MCP server through Apify: runs them and bills under its own terms |
5. Transfers outside the EU
The service runs in the EU. Where a sub-processor may process data outside the EU or EEA, the transfer is covered by an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
6. Personal data breaches
We notify you without undue delay, and in any case within 48 hours of becoming aware of a breach affecting your data, with what we know about its nature, the data involved, the likely consequences and the measures taken. Security contact: [email protected].
7. Duration and deletion
This addendum runs as long as the main agreement. Account data is kept as stated in the privacy notice; invoice data as long as accounting law requires.
8. Audits
We answer reasonable security questionnaires and give you the documents that describe our measures. If that is not enough to show compliance, you may audit once a year with 30 days' notice, at your cost, during business hours and under confidentiality, or ask an independent auditor to do so.
9. Precedence and law
If this addendum and the main agreement conflict on data protection, this addendum prevails. Liability follows the main agreement. This addendum is governed by Bulgarian law.