Data processing addendum

This addendum applies when CrawlPanel processes personal data on behalf of a customer while providing monitoring, evidence, incident, notification or reporting services. The customer acts as controller and CrawlPanel acts as processor, unless applicable law assigns different roles.

The customer is responsible for having a lawful basis, providing required notices and configuring checks so they collect only data necessary for the intended monitoring purpose.

CrawlPanel processes personal data only to provide, secure, support and improve the contracted service, according to the customer's documented configuration and instructions in the agreement.

If an instruction appears to violate applicable data protection law, CrawlPanel may pause the affected processing and notify the customer where legally permitted.

People authorized to process customer data are subject to appropriate confidentiality obligations. Access is limited according to operational need.

Technical and organizational measures include tenant-scoped access controls, encrypted secret storage, evidence redaction, SSRF protections, audit records and controlled artifact retention. Current controls and certification posture are described on the Security page.

CrawlPanel may use infrastructure, email, payment and other service providers as subprocessors where they are needed to deliver the service. Subprocessors must be bound by data protection obligations appropriate to the processing they perform.

A current subprocessor list and a process for material-change notices will be published before this addendum is offered as a final contractual document.

Where personal data is transferred outside its originating jurisdiction, the parties will use a lawful transfer mechanism required by applicable law, which may include the European Commission Standard Contractual Clauses and supplementary safeguards.

CrawlPanel will notify the customer without undue delay after becoming aware of a confirmed personal-data breach affecting customer data and will provide available information reasonably needed for the customer's response.

Notification does not constitute an admission of fault or liability. The customer remains responsible for regulatory and data-subject notifications required of the controller.

Taking into account the nature of processing, CrawlPanel will provide reasonable assistance with data-subject requests, impact assessments and regulator consultations where the customer cannot complete the request through available product controls.

CrawlPanel will not respond to a data-subject request concerning customer-controlled data except on the customer's instructions or where required by law.

At the end of the service, customer data will be returned or deleted according to product capabilities, plan retention windows and applicable legal obligations. Backup copies may remain until overwritten under the normal backup lifecycle.

CrawlPanel will make information reasonably necessary to demonstrate compliance available to the customer. Any audit process must protect other customers, confidential information and service security, and should begin with existing documentation.

Subject matter and purpose: operating customer-configured availability, API and browser monitoring; storing run evidence; managing incidents; delivering alerts; producing reports; and providing support.

Data subjects may include customer users, personnel, clients and people whose data appears in authorized monitored pages or test flows. Data may include account identifiers, contact details, IP and request metadata, configured test values, page content, screenshots, console and network evidence, incident records and support communications.

Processing continues for the service term and applicable retention or legal periods. Customers should use dedicated test accounts and synthetic data wherever practical.

Questions and requests relating to this addendum can be sent to privacy@crawlpanel.com.

This document is a launch draft pending legal review, final company details, governing-law terms, a complete subprocessor schedule and execution mechanics. It should not be represented as a signed DPA.