Legal

Data processing agreement

Standard terms for customers who need a processor agreement under the GDPR or UK GDPR. Effective 7 September 2026. A signed copy on request: hello@locomint.io.

1. Roles

For business data our products return on your request, you are the controller and Locomint is the processor from the moment the data is delivered to you. For the short-lived caches we hold to operate the service, Locomint acts as an independent controller under the legitimate-interest basis described in our privacy policy.

2. Subject matter and duration

Processing consists of fetching, normalising, caching for up to 30 days, and delivering business listing and business website data, for as long as you use the service and up to 90 days after for logs.

3. Nature and categories

Data subjects: business owners and staff only insofar as a business contact point identifies them (for example a sole trader’s role mailbox). Categories: business name, address, phone, website, opening hours, ratings, role email addresses, social profile URLs of the business, WhatsApp business numbers. No special categories; no data from social media profiles; no owner names.

4. Our obligations

  • Process only on your documented instructions (your API requests and actor inputs).
  • Keep the data confidential; staff with access are bound by confidentiality.
  • Apply appropriate security: encrypted transport, key-only server access, firewalling, least-privilege, nightly backups, security updates.
  • Assist with data subject requests: we honour removal requests within 7 days and forward relevant requests to you.
  • Notify you of a personal data breach affecting your data without undue delay and within 72 hours of becoming aware.
  • Delete or return your data at the end of the service; caches expire within 30 days, logs within 90 days.
  • Make available the information needed to demonstrate compliance and allow audits on reasonable notice.

5. Sub-processors

Contabo GmbH (hosting, Germany/EU); Apify Technologies s.r.o. (platform for the Apify products, Czech Republic); our residential proxy provider (traffic transit only, no data storage). We will notify you of changes to this list at least 14 days in advance and you may object on reasonable grounds.

6. International transfers

Data is processed in the European Union. Where you access it from elsewhere, the transfer is at your instruction.

7. Liability

Liability under this agreement is subject to the limits in the terms of service.