Effective Date: 1st of May 2023
This document outlines the responsibilities of Scrappey.com, hereafter referred to as Scrappey, to its customers concerning data protection, particularly in compliance with the General Data Protection Regulation (GDPR) of the European Union.
Scrappey operates as a Data Processor on behalf of its customers. Customers of Scrappey.com are individuals or organizations who pay to utilize the Scrappey service. Free trial users are not considered Customers. Scrappey's Customers are Data Controllers. "Personal data" refers to any information relating to an identified or identifiable person. "Data Protection Laws" encompass EU Directive 95/46/EC, as incorporated into the domestic legislation of each Member State, and any subsequent amendments, replacements, or supersedings, including the GDPR and relevant implementing or supplementary laws. "Services" refer to the Scrappey.com service, including the web application accessed through the browser-based user interface and API (application program interface), as well as any professional services provided by Scrappey. "Sub-processor" denotes any Data Processor engaged by Scrappey. "Data Subject" pertains to the individual to whom Personal Data relates.
By using the Scrappey service, it implies that Scrappey may process personal data on behalf of the Data Controller, adhering to the requirements of Data Protection Laws. The Data Controller must ensure that their users' instructions for processing personal data comply with Data Protection Laws. The Data Controller assumes sole responsibility for the accuracy, quality, legality, and acquisition of Personal Data. The data provided to Scrappey.com is stored in a centralized database. In certain cases, data may also be stored on other services to adequately perform the functionality of the service. Scrappey maintains an up-to-date and comprehensive description of its data protection practices on its website at gdpr, which is periodically updated to reflect any changes in practices.
Scrappey ensures that necessary consent is obtained from Data Subjects to allow for the processing of personal data on behalf of the Data Controller. In the event that Scrappey receives a request from a Data Subject for access to or deletion of their personal data, Scrappey will promptly notify the Data Controller, subject to legal permissions. Scrappey will not respond to such requests without the prior written consent of the Data Controller, except to confirm that the request pertains to the Data Controller. It is the sole responsibility of the Data Controller to fulfill such requests in compliance with applicable laws.
Scrappey ensures that its personnel engaged in the processing of personal data are aware of the confidential nature of the data. They receive appropriate training on their responsibilities and have agreed to confidentiality obligations that remain in effect even after their employment or engagement with Scrappey has ended. Scrappey takes commercially reasonable measures to ensure the reliability of its personnel involved in personal data processing, limiting access to personal data to only those personnel who require it to perform the Services. As per the GDPR, Scrappey does not require a data protection officer. However, for data protection inquiries, you can contact us via email at [email protected].
The Data Controller agrees that Scrappey may engage third-party Sub-processors to provide the Services. Such Sub-processors may access personal data solely for the purpose of delivering the services entrusted to Scrappey, without using it for any other purpose. Scrappey agrees to assume liability for the acts and omissions of its Sub-processors to the same extent as if Scrappey were directly performing the services of each Sub-processor under the terms of this agreement.
Scrappey agrees to implement and maintain the administrative, technical, and physical safeguards of personal data stored using the Services.
If Scrappey becomes aware of unlawful access to the Data Controller's personal data stored through the Services or unauthorized access to the Services resulting in loss, disclosure, or alteration of the Data Controller's personal data ("Security Breach"), Scrappey will promptly:
The Data Controller agrees that an unsuccessful Security Breach attempt will not be subject to Section 7.1 above. An unsuccessful Security Breach attempt is one that results in no unauthorized access to the Data Controller's personal data or to the Services storing the Customer's Personal Data, and may include, without limitation, pings and other broadcast attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond IP addresses or headers), or similar incidents.
Notification(s) of Security Breaches, if any, will be delivered to one or more of the Customer's business, technical, or administrative contacts by any means Scrappey selects, including via email. It is the Customer's sole responsibility to ensure it maintains accurate contact information on Scrappey's support systems at all times. Scrappey's report of and/or response to a Security Breach under this Section will not be construed as an admission by Scrappey to fault or liability with respect to the Security Breach.
Scrappey agrees to delete Customer personal data in accordance with Scrappey's procedures and Data Protection Laws. At a Customer's request, Scrappey will provide the Customer with a certification of deletion of personal data.
This agreement comes into effect from the 1st of June 2022 for all existing customers or from the time of purchase of a Scrappey subscription. It expires with the cessation of the Customer's Scrappey subscription.