Legal

Data processing agreement

Standard terms for customers who need a processor agreement under the GDPR or UK GDPR. Effective 30 September 2026. A signed copy on request: info@locomint.io.

1. Roles

For business data our products return on your request, you are the controller and Locomint is the processor from the moment the data is delivered to you. For the short-lived caches we hold to operate the service, Locomint acts as an independent controller under the legitimate-interest basis described in our privacy policy.

2. Subject matter and duration

Processing consists of fetching, normalising, caching for up to 30 days, and delivering business listing and business website data, for as long as you use the service and up to 90 days after for logs.

3. Nature and categories

Data subjects: business owners and staff whose work contact details the business publishes on its own website (for example a sole trader’s mailbox or a named agent on a staff page). Categories: business name, address, phone, website, opening hours, ratings, the email addresses the business publishes on its own website (company mailboxes, and the work addresses of named staff, which are marked as such), social profile URLs of the business and the profile links it publishes for its people, WhatsApp business numbers, and the phone numbers the business publishes on its own website as a number to call or in its structured data (for a sole trader this may be their own number; these are never kept in the permanent history and can be removed one at a time). No special categories; nothing from inside social media profiles; no owner names as a separate field, no home addresses, and no number the business has not itself published. Objections are honoured by a suppression list that every response is checked against.

4. Our obligations

  • Process only on your documented instructions (your API requests and actor inputs).
  • Keep the data confidential; staff with access are bound by confidentiality.
  • Apply appropriate security: encrypted transport, key-only server access, firewalling, least-privilege, nightly backups, security updates.
  • Assist with data subject requests: we honour removal requests within 7 days and forward relevant requests to you.
  • Notify you of a personal data breach affecting your data without undue delay and within 72 hours of becoming aware.
  • Delete or return your data at the end of the service; caches expire within 30 days, logs within 90 days.
  • Make available the information needed to demonstrate compliance and allow audits on reasonable notice.

5. Sub-processors

Contabo GmbH (hosting; the server is in Lauterbourg, France, EU); Apify Technologies s.r.o. (platform for the Apify products, Czech Republic); our residential proxy provider (traffic transit only, no data storage). We will notify you of changes to this list at least 14 days in advance and you may object on reasonable grounds.

6. International transfers

The business data covered by this agreement is processed in the European Union. Where you access it from elsewhere, the transfer is at your instruction.

7. Liability

Liability under this agreement is subject to the limits in the terms of service.