Data Processing Addendum
This addendum forms part of the Terms of Service (version 2026-10-29) and is accepted by accepting them.
This addendum forms part of the Terms of Service between you and SVG ASSOCIATES LTD, trading as Power Scraping. It sets out, as Article 28(3) of the UK GDPR requires, how we process the personal data in collected material on your behalf: only on your documented instructions, under a duty of confidentiality, with appropriate security, through the sub-processors named here, with help for your data-subject and security obligations, deleting or returning the data at the end, and open to audit.
1. Parties, incorporation and definitions
This addendum is between you, the customer named on the account, as controller, and SVG ASSOCIATES LTD, trading as Power Scraping, company number 17391911, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, as processor. It forms part of the Terms of Service and is accepted by accepting them; there is no separate acceptance. On a data protection conflict it prevails. Customer Personal Data means personal data collected through either the paired extension or hosted automatic browser, including comments, replies and media, and the evidence, analysis, exports and archives derived from it. Account and connection-management data for which we are controller are described in the privacy notice. UK GDPR definitions apply.
2. Roles
You are controller of Customer Personal Data and we process it on your behalf. You choose declared targets, lawful basis, a session you may use, parameters and schedules; our software performs collection in your browser or on the configured hosted server. If a court or supervisory authority finds you and us joint controllers of the collection and transmission step, this is the Article 26 arrangement: you handle entitlement, lawful basis and the notice your jurisdiction requires under Articles 13 and 14; we handle extraction software, scope controls, security and the privacy notice. Each answers rights requests reaching it and tells the other within five working days; people may exercise rights against either of us. The essence of this arrangement is published in our privacy notice. Later storage, enrichment, archives and exports remain processing on your behalf.
3. Subject matter, duration, nature and purpose, data and data subjects
Subject matter: the service in the Terms. Duration: your account and the deletion period. Nature and purpose: collect declared targets through a paired extension or hosted automatic browser, execute unattended schedules and resumable complete-history instructions, stage extension records in a staging table for at most two days, enrich through local rules, OCR and video frames and optional configured AI or Places, meter processed posts, retain media and durable archives, provide cited results, CSV, JSONL and review HTML, and delete under the retention policy. Types of personal data: handles, post identifiers and permalinks, dates and capture times, captions, names, mentions, hashtags, locations, comments and replies with authors, images and video, media links and metadata, engagement counts and derived fields with evidence. Categories of data subjects: target creators, commenters and people named, tagged or shown. The extension never sends comments, but hosted collection may collect them and retain media. Special category and criminal-offence data are not the purpose; you must not instruct processing aimed at those categories.
4. Processing only on your documented instructions (Art. 28(3)(a))
We process Customer Personal Data only on your documented instructions - the Terms of Service, the acceptable-use terms, your target declarations, the jobs and schedules you start and the settings you choose - including with regard to transfers to a third country, unless UK law requires us to do otherwise, in which case we will tell you before processing unless that law forbids it. We will tell you immediately if, in our opinion, an instruction infringes the UK GDPR or other data protection law. You are responsible for your instructions complying with data protection law and for having a lawful basis for the processing.
5. Confidentiality (Art. 28(3)(b))
Access to Customer Personal Data is limited to the people who operate the service, and each of them is bound by a duty of confidentiality, contractual or statutory, before they get access.
6. Security (Art. 28(3)(c) and Art. 32)
We apply the security measures in the privacy notice: tenant-scoped queries and durable artifacts; hashed service passwords, API keys and pairing tokens; authenticated tenant-specific encryption for reusable hosted session material; temporary restricted runtime copies; revocation that clears stored session ciphertext and blocks late refresh; fail-closed challenge and reauthentication handling; automatic retention of records and archives; and an audit trail without credentials or post content. We do not retain Instagram passwords or verification codes as account credentials. For hosted login, the customer device encrypts input commands to a temporary key of the isolated server browser; the HTTPS API/database relay only ciphertext. The private key exists only in browser process memory, never in the database, environment, files or backups. The runtime transiently decrypts input in memory and delivers it to Instagram, without logging or retaining typed credentials. Consumed input and active terminal images/queues are cleared; closing the browser discards the private input key. Latest page images are separately encrypted and form-input fields are masked. Historical encrypted image backup copies expire under the hosting backup cycle, as the privacy notice describes. These measures are reviewed and their overall effectiveness will not be reduced during your account.
7. Sub-processors (Art. 28(2), 28(3)(d) and 28(4))
You generally authorize sub-processors. The current database and API host is Render in Frankfurt, Germany; an operator-configured hosted worker or durable storage uses that environment's host and storage provider. Neon provides private archive object storage in US east 2 when that configured route is enabled; archive objects are encrypted by the service before upload and their metadata remains in the control-plane database. Our business email provider processes Customer Personal Data only if you include it in email to stefano@svgassociates.co.uk. Cloudflare serves the website and DNS and does not carry API traffic, so it does not process Customer Personal Data in that route. Stripe processes billing data. No third-party acquisition provider collects for you. Optional configured remote AI receives selected evidence and the enrichment request; optional Google Places receives venue queries and location text. Local rules, OCR and video-frame processing do not need those integrations. Activation requires operator configuration and permitted job settings; provider identity, location and processing terms must reflect the environment actually enabled. We do not claim an unconfigured provider processes data. We tell the owner at least 30 days before adding or replacing a sub-processor receiving Customer Personal Data, and you may object; an unresolved reasonable objection lets you end the subscription with the applicable prepaid-fee refund, as the refunds clause of the Terms of Service provides. Article 28(4) obligations apply and we remain responsible for the sub-processor's performance. Contact us for the current provider list and processing terms; no signed contract or certification is invented here.
8. Helping you with data-subject requests (Art. 28(3)(e))
Taking into account the nature of the processing, we help you answer requests from data subjects with appropriate technical and organisational measures: you can download a job's records as CSV or JSON Lines and its retained review/media artifacts, revoke a target or connection, pause its schedules, and ask us to delete a target's applicable records, evidence, media and archives at any time. When a target is revoked because the person behind it objected, the profile is suppressed across the whole service and cannot be declared again by any customer. If a request about Customer Personal Data reaches us directly, we tell you within five working days. Because the roles clause makes us responsible for part of the collection step, we also act on such a request ourselves as the privacy notice describes, and tell you what we did.
9. Security, breaches and impact assessments (Art. 28(3)(f))
We help you meet your obligations under Articles 32 to 36 - security, notification of personal data breaches, data protection impact assessments and prior consultation - taking into account the nature of the processing and the information available to us. We notify you of a personal data breach affecting Customer Personal Data without undue delay after becoming aware of it, with the information Article 33(3) requires as it becomes available. The data protection impact assessment we keep for the service is available to you on request.
10. Deletion or return at the end (Art. 28(3)(g))
Customer Personal Data is deleted automatically at the end of your plan's retention window. When your account closes you can download your records first; at your choice we then delete the remaining Customer Personal Data, or return it as records and retained artifacts and then delete it, within 30 days of closure, unless UK law requires us to keep it. Ordinary audit events, which name targets and declared bases but hold no post content, are kept for 24 months and then deleted automatically. Unresolved account or membership deletion requests remain recorded for operator processing until completion is recorded for the exact request in the same account, even beyond 24 months. Completion proof is retained beyond 24 months only while its matching request is still within the ordinary audit retention window, so completed work does not reappear as pending. Once a completed request is outside that window, it and any expired completion proof are deleted by the purge. Recording a request does not delete the account or its data; erasure remains operator-assisted.
11. Information and audits (Art. 28(3)(h))
We make available to you the information necessary to demonstrate compliance with Article 28 and this addendum, and we allow for and contribute to audits, including inspections, by you or an auditor you mandate. We answer a written questionnaire first. An inspection needs 30 days' written notice, takes place in business hours, at most once a year unless a regulator requires it or a personal data breach has occurred, at your cost, and under a duty of confidentiality. We tell you immediately if, in our opinion, an audit instruction infringes data protection law.
12. International transfers
The configured host, storage service, business email provider and any enabled remote AI or Google Places integration may process Customer Personal Data outside the UK. We transfer on your documented instructions and only under applicable safeguards, including adequacy regulations or the UK International Data Transfer Agreement or the UK International Data Transfer Addendum to EU standard contractual clauses where required. Current providers and locations follow the enabled deployment; we supply available information and safeguards on request without asserting unverified certifications or signed terms. The UK Extension to the EU-US Data Privacy Framework is another available safeguard where the provider is verified as covered by it; this does not assert certification for an unverified provider.
13. Liability
Each party's liability under this addendum is subject to the limitation of liability in the Terms of Service. Nothing in this addendum limits either party's liability to a data subject under Article 82 of the UK GDPR, or any liability that cannot lawfully be limited.