Data Processing Agreement

“Data Protection Law” means every law on personal data that applies to the processing under this agreement, including Malaysia’s Personal Data Protection Act 2010, the EU General Data Protection Regulation (GDPR), the GDPR as it applies in the United Kingdom (UK GDPR), the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act.

“Customer Personal Data” means personal data that Intercrawl processes on the Customer’s behalf in providing Intercrawl. “Controller”, “processor”, “data subject”, “personal data”, “processing” and “personal data breach” have the meanings given in the GDPR, or their equivalents in other Data Protection Law.

The Customer is the controller of Customer Personal Data (or a processor acting for its own client, in which case Intercrawl is its sub-processor), and Intercrawl is the processor. Under US state privacy laws, Intercrawl is the Customer’s service provider or processor. Annex 1 describes the processing.

Data about the Customer’s own account and how it uses Intercrawl (for example sign-in details and usage counts) is held by Intercrawl for itself, as described in the Privacy Policy, and is not covered by this agreement.

Intercrawl processes Customer Personal Data only on the Customer’s documented instructions: the Terms of Service, this agreement, and the settings and installs the Customer chooses in Intercrawl. Intercrawl will tell the Customer if it believes an instruction breaks Data Protection Law, and need not follow it until the Customer confirms or changes it. Intercrawl does not process Customer Personal Data for any other purpose, unless the law requires it, in which case it tells the Customer first where the law allows.

Everyone Intercrawl allows to process Customer Personal Data is bound to keep it confidential.

Intercrawl keeps the technical and organisational measures in Annex 2, which protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Intercrawl may change them, but never in a way that lowers the overall protection.

The Customer authorises Intercrawl to use the sub-processors in Annex 3. Intercrawl will tell the Customer at least 30 days before adding or replacing a sub-processor, by email to the account’s address and on this page. The Customer may object on reasonable data protection grounds within that time; if the parties cannot resolve it, the Customer may stop using the part of Intercrawl concerned and delete its account.

Intercrawl binds every sub-processor to data protection terms that protect Customer Personal Data at least as well as this agreement, and remains responsible to the Customer for them.

Taking into account the nature of the processing, Intercrawl helps the Customer answer requests from data subjects exercising their rights, and gives the information the Customer reasonably needs for data protection impact assessments and consultations with authorities. If a data subject writes to Intercrawl directly about Customer Personal Data, Intercrawl refers them to the Customer.

Intercrawl tells the Customer of a personal data breach affecting Customer Personal Data without undue delay, and no later than 48 hours after becoming aware of it, with what it knows: what happened, the data and data subjects concerned, the likely consequences, and what has been done. Intercrawl adds information as it learns it, and takes reasonable steps to contain the breach and reduce its effects.

Most Customer Personal Data is deleted automatically within 30 days of being collected (Annex 1). When the Customer deletes a site or its account, Intercrawl deletes the Customer Personal Data that belongs to it within 30 days, unless the law requires it to keep some. Before deleting its account, the Customer can ask for a copy of data Intercrawl still holds.

Intercrawl makes available the information reasonably needed to show that it meets this agreement, including answers to a reasonable security questionnaire once a year. Where Data Protection Law gives the Customer a right to audit that this information cannot satisfy, the Customer may audit Intercrawl, or have an independent auditor bound to confidentiality do so, with 30 days’ notice, during business hours, at the Customer’s cost and no more than once a year unless a breach or an authority requires it.

Customer Personal Data is stored in the United States and processed on a global network.

For personal data transferred from the European Economic Area, the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914) are incorporated into this agreement: Module 2 where the Customer is a controller and Module 3 where it is a processor. The optional clause 7 does not apply; under clause 9, option 2 (general written authorisation) applies with the notice period in section 6; the optional wording in clause 11 does not apply; clauses 17 and 18 choose the law and courts of Ireland. Annexes 1, 2 and 3 of this agreement complete the Clauses’ Annexes I, II and III, with the Customer as data exporter and Intercrawl as data importer.

For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner (version B1.0) is incorporated, completed with the details above. For transfers from Switzerland, the Clauses apply with the changes the Swiss Federal Act on Data Protection requires, and references to the GDPR read as references to that Act.

For transfers from Malaysia, Intercrawl applies the safeguards in this agreement so that the transfer meets section 129 of the Personal Data Protection Act 2010.

As a service provider or processor, Intercrawl does not sell or share Customer Personal Data; does not keep, use or disclose it for any purpose other than providing Intercrawl to the Customer, or outside its direct business relationship with the Customer; and does not combine it with personal data it receives from anyone else, except as those laws allow. Intercrawl tells the Customer if it can no longer meet these obligations, and the Customer may then take reasonable steps to stop and remedy unauthorised use.

Each party’s liability under this agreement is subject to the limits in the Terms of Service, to the extent Data Protection Law allows. This agreement lasts for as long as Intercrawl processes Customer Personal Data. On data protection, it prevails over the Terms of Service; the Clauses incorporated in section 11 prevail over the rest of this agreement.

This agreement is governed by the laws of Malaysia, and the courts of Kuala Lumpur, Malaysia have jurisdiction over any dispute about it, except where the Clauses incorporated in section 11 provide otherwise.