1. Scope and Status

1.1 This Data Protection Policy is issued by Zyne Labs LLC-FZ, a free zone limited liability company having its registered office at M Floor, Business Center 1, The Meydan Hotel, Nad Al Sheba, Dubai, United Arab Emirates (“Zyne Labs”, “we” or “us”), operator of the Syphoon platform, and sets out the terms on which Zyne Labs processes Customer Data on behalf of Customers and the measures by which it protects that data.

1.2 This Data Protection Policy supplements, and shall be read together with, our Privacy Policy, which governs Personal Data processed by Zyne Labs as controller, and our Terms of Service.

1.3 Zyne Labs complies, as applicable, with Regulation (EU) 2016/679 (the “GDPR”), the UK GDPR, the Swiss Federal Act on Data Protection and Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data of the United Arab Emirates (together, “Data Protection Law”).

1.4 Status as data processing agreement. This Data Protection Policy constitutes the data processing agreement between Zyne Labs and each Customer required by Article 28(3) GDPR and the corresponding provisions of Data Protection Law. It is incorporated into the Terms of Service, is accepted by the Customer upon registration of an Account, and binds Zyne Labs and the Customer from the first processing of Customer Data, without any further step by either party. A Customer that requires a copy executed by both parties may request one at privacy@syphoon.com; such a copy has the same content as this Data Protection Policy.

2. Definitions

2.1 Capitalised terms not defined herein bear the meaning given to them in the Terms of Service or the Privacy Policy, and the terms “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” bear the meaning given to them in the GDPR. In addition:

• “Customer Data” means job inputs, uploaded files, output and traffic routed through a Proxy Login, in each case submitted by or on behalf of a Customer, to the extent they contain Personal Data;
• “DPA” means this Data Protection Policy in its capacity as the data processing agreement described in Section 1.4;
• “Standard Contractual Clauses” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission by Implementing Decision (EU) 2021/914, or any clauses adopted by the European Commission to replace or supplement them for the transfer concerned;
• “Sub-processor” means any third party engaged by Zyne Labs to process Customer Data; and
• “Scraping API”, “Async Jobs” and “Scheduler” mean, respectively, the Services by which a Customer retrieves web data by individual real-time requests, submits jobs of many inputs for asynchronous processing, and runs batches, recurring schedules and tracked products, each as presented in the Portal.

3. Allocation of Roles and Instructions

3.1 Instructions. The Customer instructs Zyne Labs to process Customer Data for the provision of the Services in accordance with the Terms of Service and this DPA. The jobs, requests, uploads, settings and proxy connections that the Customer submits through the API and the Portal constitute its documented instructions, and the Customer may give further instructions in writing provided that they are consistent with the Services. Zyne Labs shall process Customer Data only on such instructions, including with regard to transfers to a third country, unless required to do otherwise by a law to which Zyne Labs is subject, in which case Zyne Labs shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. Zyne Labs shall inform the Customer without delay if, in its opinion, an instruction infringes Data Protection Law.

3.2 No processing for Zyne Labs’ own purposes. Zyne Labs shall not process Customer Data for its own purposes, sell it, combine it with the data of other customers, or retain it for longer than is permitted by Section 12, save that Zyne Labs may, as controller,

1. use Customer Data to the extent necessary to secure the Services, to prevent and investigate abuse and to comply with law; and
2. compile statistics on the performance of the Services per website, which name no Customer or natural person.

4. Processing Principles

4.1 Zyne Labs processes data in accordance with the principles of Article 5 GDPR, namely:

1. lawfulness, fairness and transparency;
2. purpose limitation, such that data collected for a specified purpose is not further processed in a manner incompatible therewith;
3. data minimisation, such that, by way of example, the proxy request log records no cookies of destination websites and retains only a limited set of technical response headers;
4. storage limitation, each category of data being subject to the retention limit stated in Section 12 and in the Privacy Policy;
5. integrity and confidentiality, by means of encryption, access control and logging; and
6. accountability, Zyne Labs maintaining records of its processing activities sufficient to demonstrate compliance to Customers and supervisory authorities.

5. Details of the Processing

5.1 Customer Data comprises:

1. in respect of the Scraping API, Async Jobs and the Scheduler, the URLs, product identifiers, search terms and files submitted, and the pages and structured data returned;
2. in respect of proxy access, the connections made through Proxy Logins. Zyne Labs does not store the content of pages retrieved through the proxy service. As controller, Zyne Labs records for each request the time, the Proxy Login, the client IP address, the destination website, the data volume and technical details of the request and its outcome, for charging, the handling of disputes and the investigation of abuse, as described in the Privacy Policy, within the limits stated there; and
3. previews of job output, which form part of the output delivered to the Customer; and request and response previews kept for Zyne Labs’ support staff, in which values identified as e-mail addresses, credentials or personal data are masked prior to storage. The request history displayed in the Portal records the time, product, website and outcome of each request but not its content.

5.2 Subject matter, nature and purpose. The subject matter of the processing is the retrieval of web pages and data from websites selected by the Customer, the parsing and storage of the results, their delivery to the Customer, and the carriage of the Customer’s proxy connections. The nature of the processing is collection, storage, structuring, transmission and deletion by automated means. Its sole purpose is the provision of the Services to the Customer.

5.3 Types of Personal Data and categories of data subjects. Customer Data may incidentally contain Personal Data present on web pages selected by the Customer, such as names, user names, profile information, reviews and the contact details of sellers or authors, and any Personal Data in the Customer’s own inputs. The data subjects are the persons to whom such data relates. The Customer alone determines the nature of such data and the purposes for which it is collected, and shall not submit, or instruct the retrieval of, special categories of Personal Data or data relating to criminal convictions and offences except where it has a lawful basis therefor.

5.4 Duration. The processing continues for as long as the Customer uses the Services and thereafter until Customer Data has been deleted in accordance with Section 12.

6. Customer Obligations

6.1 The Customer is solely responsible for the lawfulness of its collection and use of Customer Data, including the existence of a legal basis for any processing of Personal Data, the provision of any information required to data subjects, any data protection impact assessment required of it, and compliance with the rights of data subjects. The obligations of the Customer in respect of acceptable use of the Services are set out in the Acceptable Use section of the Terms of Service.

7. Sub-processors

7.1 The Customer grants Zyne Labs general written authorisation to engage Sub-processors within the categories set out below. Zyne Labs shall impose upon each Sub-processor, by written contract, data protection obligations no less protective than those set out herein, in particular providing sufficient guarantees to implement appropriate technical and organisational measures, and shall remain fully liable to the Customer for the performance of each Sub-processor’s obligations. Each Sub-processor receives only such Customer Data as is necessary for its function.

7.2 Card payments are processed by Stripe, which processes card data in accordance with its own privacy notice, as described in the Privacy Policy, and is not a Sub-processor of Customer Data.

7.3 Zyne Labs shall give every Customer, by e-mail to the Account owner, not less than thirty (30) days’ prior notice of any intended addition or replacement of a Sub-processor, other than within the category of data retrieval and network providers, stating the category and function of the Sub-processor and the country in which it will process Customer Data. The Customer authorises data retrieval and network providers as a category, and additions and replacements within that category require no advance notice. Where a replacement is required without delay to protect the security or continuity of the Services, the notice shall be given as soon as practicable and shall state the reason. The Customer may object to a notified change on reasonable grounds relating to data protection by written notice to privacy@syphoon.com within the notice period. Should Zyne Labs be unable to resolve the objection within a reasonable period, the Customer may terminate the affected Service by written notice, and Zyne Labs shall refund, pro rata, any fees prepaid for that Service in respect of the period following termination. Zyne Labs names its hosting providers in Section 7.1 and describes its other Sub-processors by category.

8. Location of Processing and Transfers

8.1 Customer Data is hosted within the European Union. Zyne Labs is established in the United Arab Emirates, and its personnel access Customer Data from that jurisdiction solely for the purposes of operating and supporting the Services. Zyne Labs’ operations and support provider accesses Customer Data from India for the same purposes only. Certain Sub-processors, including data retrieval and network providers, may process Customer Data in other jurisdictions where necessary to fulfil a request. For proxy access, the country through which a connection exits is the one the Customer selects, where it selects one.

8.2 Safeguards. Where Personal Data originating in the European Economic Area, the United Kingdom or Switzerland is transferred to a country not recognised as providing an adequate level of protection, including by the access of Zyne Labs’ personnel from the United Arab Emirates and of its operations and support provider from India, the transfer is made subject to the Standard Contractual Clauses (together with the UK International Data Transfer Addendum, where applicable), which the Customer and Zyne Labs conclude by the Customer’s acceptance of this DPA, as completed in Sections 8.3, 8.4, 8.6 and 8.7, or to another transfer mechanism permitted by Data Protection Law. Zyne Labs shall impose equivalent safeguards on any Sub-processor located in such a country, as set out in Section 8.5.

8.3 Completion of the Standard Contractual Clauses. The Standard Contractual Clauses concluded under Section 8.2 are completed as follows:

1. Modules. Module Two (transfer controller to processor) applies where the Customer is a controller of the Customer Data, and Module Three (transfer processor to processor) applies where the Customer processes the Customer Data on behalf of another controller. In each case the Customer is the data exporter and Zyne Labs the data importer;
2. Clause 7. The optional docking clause does not apply;
3. Clause 9. Option 2 (general written authorisation) applies. The agreed list of sub-processors is the list of Sub-processors described by category in Section 7.1, and the time period for the notice of an intended addition or replacement is the period of thirty (30) days stated in Section 7.3, subject to the authorisation by category stated there;
4. Clause 11. The optional wording permitting a data subject to lodge a complaint with an independent dispute resolution body does not apply;
5. Clause 13. The competent supervisory authority is determined by the Customer’s position as data exporter: (i) where the Customer is established in a Member State of the European Union, the supervisory authority of that Member State; (ii) where the Customer is not so established but falls within the territorial scope of the GDPR in accordance with its Article 3(2) and has appointed a representative under Article 27(1) GDPR, the supervisory authority of the Member State in which that representative is established; and (iii) where the Customer is not so established and falls within Article 3(2) GDPR without having to appoint a representative under Article 27(2) GDPR, the supervisory authority of one of the Member States in which the data subjects whose Personal Data is transferred in relation to the offering of goods or services to them, or whose behaviour is monitored, are located;
6. Clause 17. Option 1 applies, and the Standard Contractual Clauses are governed by the law of the Netherlands; and
7. Clause 18. Any dispute arising from the Standard Contractual Clauses shall be resolved by the courts of the Netherlands, without prejudice to the right of a data subject under Clause 18(c) to bring legal proceedings before the courts of the Member State in which he or she has his or her habitual residence.

8.4 Annexes to the Standard Contractual Clauses. The Annexes to the Standard Contractual Clauses are completed by reference to this DPA, as follows:

1. Annex I.A (list of parties). The data exporter is the Customer, identified by the name, address and contact details held for its Account, and acting as controller or, where Module Three applies, as processor; its contact person is the Account owner. The data importer is Zyne Labs, identified in Section 1.1 and Section 16, acting as processor or, where Module Three applies, as sub-processor; its contact person is Tuba Khan, Chief of Operations, reachable at privacy@syphoon.com. The activities relevant to the transfer are the provision and use of the Services described in Section 5.2. Zyne Labs’ representative in the European Union under Article 27 GDPR is Instant EU GDPR Representative Ltd, Office 2, 12A Lower Main Street, Lucan, Co. Dublin, K78 X5P8, Ireland (contact: Adam Brogden, contact@gdprlocal.com, +44 1772 217 800, gdprlocal.com). Each party signs the Annex by the Customer’s acceptance of this DPA in accordance with Section 1.4, which takes effect on the date of that acceptance;
2. Annex I.B (description of the transfer). The categories of data subjects and of Personal Data are those set out in Section 5.3 and Section 5.1; no special categories of Personal Data are intended to be transferred, and Section 5.3 governs any that the Customer submits, to which the measures of Section 9 apply; the transfer is continuous, for as long as the Customer submits jobs, requests, uploads and proxy connections; the nature and purpose of the processing are those set out in Section 5.2 and Section 3.1; the Personal Data is retained within the limits set out in Section 12 and, as regards records that Zyne Labs keeps as controller, in the retention table of the Privacy Policy; and transfers to Sub-processors are made for the functions, and with the Customer Data, described in Section 7.1, for the duration of the processing stated in Section 5.4;
3. Annex I.C (competent supervisory authority). The authority determined in accordance with Section 8.3(e);
4. Annex II (technical and organisational measures). The measures set out in Section 9, together with the assistance described in Section 11; and
5. Annex III (list of sub-processors). The Sub-processors described by category in Section 7.1, the hosting providers being named there.

8.5 Onward transfers to Sub-processors. Where Zyne Labs engages a Sub-processor that processes Customer Data in, or accesses it from, a country not recognised as providing an adequate level of protection, including the operations and support provider described in Section 7.1, which accesses Customer Data from India, Zyne Labs shall conclude with that Sub-processor the Standard Contractual Clauses in Module Three (transfer processor to processor), with Zyne Labs as data exporter, together with the UK International Data Transfer Addendum where Personal Data from the United Kingdom is concerned, unless the transfer is covered by another transfer mechanism permitted by Data Protection Law, such as a certification of the Sub-processor under the EU–U.S. Data Privacy Framework. In those clauses the competent supervisory authority under Clause 13 is the Data Protection Commission of Ireland, the Member State in which Zyne Labs’ representative under Article 27(1) GDPR is established. This obligation is undertaken by Zyne Labs towards the Customer under this DPA and is not part of the Standard Contractual Clauses concluded between the Customer and Zyne Labs.

8.6 United Kingdom. In respect of transfers of Personal Data subject to the UK GDPR, the Standard Contractual Clauses apply as amended by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018 (the “UK Addendum”), which the Customer and Zyne Labs conclude by the Customer’s acceptance of this DPA. The tables of the UK Addendum are completed as follows:

1. Table 1 (parties): the parties, their details and their contacts as set out in Section 8.4(a), the start date being the date on which the Customer accepts this DPA;
2. Table 2 (selected Standard Contractual Clauses, modules and selected clauses): the Standard Contractual Clauses as completed in Section 8.3, in Module Two or Module Three as there provided;
3. Table 3 (appendix information): the information set out in Section 8.4; and
4. Table 4 (ending the UK Addendum when the approved addendum changes): either party may end the UK Addendum as provided in its Section 19.

In accordance with the mandatory clauses of the UK Addendum, the Information Commissioner is the competent supervisory authority for such transfers, and Clauses 17 and 18 refer, for such transfers, to the laws and the courts of England and Wales in place of those of the Netherlands.

8.7 Switzerland. In respect of transfers of Personal Data subject to the Swiss Federal Act on Data Protection (the “FADP”), the Standard Contractual Clauses apply with the following adaptations:

1. the competent supervisory authority under Clause 13 is the Swiss Federal Data Protection and Information Commissioner, insofar as the transfer is governed by the FADP, and the authority determined under Section 8.3(e) insofar as it is governed by the GDPR;
2. references to the GDPR are to be understood as references to the FADP insofar as the transfer is governed by the FADP;
3. the term “Member State” shall not be interpreted so as to exclude data subjects in Switzerland from the possibility of bringing legal proceedings for their rights in their place of habitual residence in accordance with Clause 18(c); and
4. Clauses 17 and 18 continue to refer to the law and the courts of the Netherlands.

9. Technical and Organisational Measures

9.1 Encryption.

1. The Portal and the API are served only over Transport Layer Security;
2. traffic between Zyne Labs’ servers is encrypted; and
3. backups are encrypted prior to leaving Zyne Labs’ servers.

The proxy service carries traffic as the Customer sends it, and traffic to websites that use HTTPS remains encrypted end to end.

9.2 Access control.

1. Account passwords and API keys are stored as one-way hashes, and two-factor authentication is available;
2. Account owners determine the permissions of each Team Member;
3. API keys and Proxy Logins may be revoked at any time, and a revoked key or login is refused promptly; and
4. access to production systems is restricted to authorised personnel, operators sign in to the administrative console with a second factor, and administrative actions are recorded in an audit trail.

9.3 Minimisation and retention. Data is retained within the limits stated in Section 12. In stored request and response previews, values identified as e-mail addresses, credentials or personal data are masked before storage.

9.4 Resilience. Backups are taken regularly and held separately from the production systems, and the Services are monitored with automated alerting.

9.5 Personnel. Zyne Labs ensures that all persons authorised to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and grants such access only to the extent required by their duties.

9.6 Review. Zyne Labs reviews these measures regularly and following any personal data breach. It may update them as technology and risks develop, provided that the overall level of protection of Customer Data is not reduced.

10. Personal Data Breaches

10.1 Upon becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data, Zyne Labs shall:

1. notify the affected Customers, by e-mail to the Account owner, without undue delay and in any event within forty-eight (48) hours of becoming aware of the breach;
2. provide in that notification, to the extent then known, a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed to address it, and provide the remaining information in phases, without undue further delay, as it becomes available;
3. designate a point of contact for the breach;
4. take reasonable steps to contain the breach and to remedy its cause; and
5. provide reasonable assistance to the Customer in meeting its own obligations to notify supervisory authorities and data subjects, which remain the Customer’s as controller.

10.2 A notification under Section 10.1 does not constitute an acknowledgement of fault or liability by Zyne Labs.

10.3 In respect of Personal Data for which Zyne Labs is controller, Zyne Labs shall notify the competent supervisory authority without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and shall notify the affected data subjects without undue delay where the breach is likely to result in a high risk to them.

10.4 An unsuccessful attempt is not a personal data breach. An unsuccessful attempt is one that does not result in unauthorised access to Customer Data or to the systems that store it, such as pings and other attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts and denial-of-service attacks.

11. Data Subject Requests and Assistance

11.1 Where Zyne Labs receives a request from a data subject relating to Customer Data, it shall refer the request to the Customer concerned and shall not respond to it directly save on the Customer’s instruction. Taking into account the nature of the processing, Zyne Labs shall assist the Customer by appropriate technical and organisational measures, namely the export, deletion and retention functions of the platform and, where those are insufficient, reasonable further assistance, in responding to requests to exercise data subject rights.

11.2 Taking into account the nature of the processing and the information available to it, Zyne Labs shall assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR, including by providing the information reasonably required for a data protection impact assessment or a prior consultation with a supervisory authority concerning the processing of Customer Data.

12. Retention, Return and Deletion

12.1 Customer Data is deleted no later than one hundred and eighty (180) days after its processing ends, except that:

1. records needed to keep the Services working are kept until the Account is erased;
2. tracked products and recurring schedules are kept for as long as the Customer keeps them, whether active, paused or stopped, and no longer than one hundred and eighty (180) days after they are deleted or reach their end date;
3. delivery settings and records of past deliveries are kept until they are deleted or the Account is erased; and
4. aggregate statistics and technical performance records derived from requests, which name no Customer or natural person, are retained without limit.

The proxy service does not store the content of retrieved pages.

12.2 In addition:

1. upon deletion of an Account by its owner, its Customer Data is erased upon expiry of a grace period of thirty (30) days, during which the owner may sign back in and cancel the deletion; while an invoice remains unpaid, a refund is owed to the Customer, a card dispute is open, a payment remains unreconciled, unused Balance awaits resolution or a technical check cannot yet be completed, the whole erasure is deferred until the matter is settled, because the data is needed for the establishment, exercise or defence of legal claims;
2. erased data may persist in encrypted backups within the limit stated in Section 12.1, and recorded erasures are applied again when a backup is restored; and
3. invoices and records of usage charges are retained by Zyne Labs as controller for seven (7) years after the end of the calendar year in which they were made, in compliance with tax and accounting obligations, and cease to identify the Customer’s personnel upon erasure of the Account.

12.3 Return and deletion upon termination. Upon termination of the Services, the Customer may, at its choice, obtain the return of Customer Data then held by means of the platform’s export and delivery functions, before requesting deletion of the Account. Zyne Labs shall thereafter delete all Customer Data in accordance with Section 12.2, save to the extent that applicable law requires its storage, and shall confirm the deletion in writing upon request.

12.4 The retention of Personal Data processed by Zyne Labs as controller is set out in the Privacy Policy.

13. Requests by Public Authorities

13.1 Zyne Labs shall disclose Customer Data to a public authority only where required by applicable law and following verification of the validity of the request, and shall limit any disclosure to that which the request strictly requires. Where lawfully permitted, Zyne Labs shall notify the Customer prior to disclosure so as to enable the Customer to contest it.

14. Reporting Misuse

14.1 Reports of misuse of the Services shall be sent to abuse@syphoon.com.

15. Audits and General Terms

15.1 Information. Zyne Labs shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and this DPA, including by responding to reasonable security and data protection questionnaires and by providing a summary of its records of processing and of its technical and organisational measures.

15.2 Audits. Zyne Labs shall allow for and contribute to audits conducted by the Customer or by an independent auditor mandated by the Customer and bound by confidentiality. Audits are conducted by means of the information provided under Section 15.1, written questionnaires, the review of documentation and remote sessions with Zyne Labs’ personnel, on not less than thirty (30) days’ written notice and not more than once in any period of twelve (12) months, save following a personal data breach or at the request of a supervisory authority. An inspection of Zyne Labs’ premises or systems takes place only where a competent supervisory authority requires it. Audits shall not disclose the data of other customers or compromise the security of the Services, and the Customer bears the costs of any audit, including Zyne Labs’ reasonable costs.

15.3 Precedence and liability. In respect of the processing of Customer Data, this DPA prevails over any conflicting provision of the Terms of Service, and the Standard Contractual Clauses, where they apply, prevail over both. The liability of each party under this DPA is governed by the Terms of Service, save that nothing therein limits the rights of data subjects under the Standard Contractual Clauses or Data Protection Law.

15.4 Amendment. Zyne Labs may amend this DPA in accordance with the Terms of Service, provided that no amendment reduces the protection afforded to Customer Data, save where required by Data Protection Law or by a decision of a competent authority.

16. Contact Details

Zyne Labs may amend this Data Protection Policy from time to time in accordance with Section 15.4. The effective date stated above identifies the current version.