BROWSER USE

- Browser Use Agents: give Browser Use a task and receive completed work. API V4 is current for new integrations.
- Browser Infrastructure: connect your agent or automation to managed browsers through SDK, REST, or CDP. Starts at $0.02/browser-hour.
- Developer tools: Open Source, Browser Harness, SDK, and MCP support the two products above.

[Developer Index](https://browser-use.com/index.md)
[Product Map](https://browser-use.com/llms.txt)
[Full Product Context](https://browser-use.com/llms-full.txt)
[Pricing](https://browser-use.com/pricing.md)
[Cloud Docs](https://docs.browser-use.com/cloud/quickstart)
[Open Source Docs](https://docs.browser-use.com/open-source/introduction)

---

# Browser Use - Enable AI to control your browser

## Browser Use Data Processing Addendum[](https://browser-use.com/dpa#browser-use-data-processing-addendum)

_Last updated: July 30, 2026_

This Data Processing Addendum ("DPA") forms part of, and is subject to, the terms and conditions of the Master Subscription Agreement (or its equivalent (e.g., the Terms of Service, etc.)) between Browser Use Inc. (together with its affiliates, collectively, "Browser Use"), and the customer identified in the applicable Order ("Customer") in connection with the right to access and use the Browser Use Services (collectively, the "Agreement") to reflect the parties' agreement with regard to the processing of Personal Data. All capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement.

The DPA is effective as of the effective date of the Agreement.

Customer enters into this DPA on behalf of itself and, to the extent required under the applicable Privacy Laws, in the name and on behalf of its Affiliates permitted to access and use the Browser Use Services pursuant to the Agreement and provided that such Affiliates have not signed their own separate agreement with Browser Use. For purposes of this DPA only, and except where otherwise indicated, the term "Customer" shall include Customer and such Affiliates.

Browser Use may amend this DPA as may be necessary from time to time, for example, to comply with changes in applicable laws and/or to reflect changes to the Browser Use Services. Browser Use shall notify Customer electronically of any updates to this DPA. Customer's continued access or use of the Browser Use Services thereafter shall constitute acceptance of, and consideration for, such amendments.

In the course of providing the Browser Use Services to Customer pursuant to the Agreement, Browser Use may process Customer Personal Data and thus the parties agree to comply with the following provisions with respect to any Customer Personal Data.

## 1\. Definitions[](https://browser-use.com/dpa#1-definitions)

**(a)** "**Affiliate**" means any entity under the control of a party where "control" means ownership of or right to control greater than 50% of the voting securities of such entity.

**(b)** "**Browser Use Services**" means the Browser Use Services (as defined in the Agreement) that Customer may access and use, pursuant to and as more particularly described in, the Agreement.

**(c)** "**Customer Personal Data**" means any Personal Data contained in Customer Data that is provided by or on behalf of Customer to Browser Use through the Browser Use Services, as more particularly described in Schedule A to this DPA.

**(d)** "**Controller**" has the meaning given to it in the applicable Privacy Law or if such term is not defined in the relevant Privacy Laws, then it means the entity which determines the purposes and means of the processing of Personal Data.

**(e)** "**Data Subject**" has the meaning given to it in the relevant Privacy Laws or, where there is no meaning, means in any case the individual natural person to whom the Personal Data relates in that case.

**(f)** "**Europe**" means for the purposes of this DPA, the European Economic Area (which comprises the member states of the European Union, Norway, Iceland and Liechtenstein) ("EEA"), Switzerland and the United Kingdom.

**(g)** "**Personal Data**" means any "personal information" or "personal data" as that term is defined in the applicable Privacy Laws which is processed in connection with Customer's access and use of the Browser Use Services.

**(h)** "**Privacy Laws**" means all laws relating to privacy and applicable to the processing of Customer Personal Data that may exist in any relevant jurisdiction, including the following, without limitation and as amended or replaced from time to time: (a) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ("GDPR"); (b) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; (c) applicable national implementations of (a) and (b); and (d) the UK General Data Protection Regulation ("UK GDPR") and Data Protection Act 2018.

**(i)** "**processing**" or "**process**" has the meaning given to it in the relevant Privacy Laws or if such term is not defined in the relevant Privacy Laws, then it shall mean any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, accessing, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

**(j)** "**Processor**" has the meaning given to it in the applicable Privacy Law or such equivalent term under applicable Privacy Law such as "data intermediary" and "service provider" or if such term is not defined in the relevant Privacy Laws, then it means the entity which processes Personal Data on behalf of the controller.

**(k)** "**Restricted Transfer**" means: (a) where the GDPR applies, a transfer of personal data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; (b) where the UK GDPR applies, a transfer of personal data from the United Kingdom to any other country which is not subject based on adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018; and (c) where the Swiss Federal Act on Data Protection applies, a transfer of personal data to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protection and Information Commissioner.

**(l)** "**Security Incident**" means a confirmed accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise provided by or on behalf of Customer to Browser Use through the Browser Use Services that compromises the confidentiality, integrity, or availability of Customer Personal Data. This does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems or an incident that is caused by Customer or Customer's End Users.

**(m)** "**Standard Contractual Clauses**" or "**EU SCCs**" means where the GDPR applies, the standard contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

**(n)** "**Sub-processor**" means any third party engaged by Browser Use or its Affiliates that processes Customer Personal Data to assist in fulfilling Browser Use's obligations with respect to providing the Browser Use Services pursuant to the Agreement or this DPA.

## 2\. Scope[](https://browser-use.com/dpa#2-scope)

This DPA applies where and only to the extent that Browser Use processes Customer Personal Data (and for clarity for Personal Data from Europe and any other jurisdictions whose Privacy Laws recognize the concept of a data processor, where Browser Use is a Processor) and such Customer Personal Data is subject to such Privacy Laws.

## 3\. Role of the Parties[](https://browser-use.com/dpa#3-role-of-the-parties)

Customer and Browser Use agree that Browser Use is a Processor, or Sub-processor where applicable, and Customer is the Controller or Processor, as the case may be. Any processing of Customer Personal Data under the Agreement shall be performed in accordance with the applicable Privacy Laws. However, Browser Use is not responsible for compliance with any Privacy Laws applicable to Customer or Customer's industry that is not generally applicable to Browser Use in its provision of the Browser Use Services.

## 4\. Customer Obligations[](https://browser-use.com/dpa#4-customer-obligations)

Customer shall comply with its obligations under the applicable Privacy Laws with respect to the Customer Personal Data, including,

**(a)** Customer's instructions for the processing of Customer Personal Data shall comply with the applicable Privacy Laws.

**(b)** Customer shall have sole responsibility for determining the types of Personal Data and categories of Data Subjects it provides to Browser Use under the Agreement, ensuring the accuracy, quality, and legality of Customer Personal Data.

**(c)** Customer shall ensure that all Customer Personal Data that it provides in connection with its access and use of the Browser Use Services shall be collected and transferred to Browser Use in accordance with the applicable Privacy Laws. For the avoidance of doubt, it shall be Customer's responsibility to (i) ensure that it provides a privacy notice to the Data Subjects, which shall comply with the applicable Privacy Laws including in particular any processing information requirements relating to the processing of the Customer Personal Data by Browser Use, (ii) ensure it obtains, where required, all necessary and appropriate consents from the Data Subjects for the processing of the Customer Personal Data, and (iii) to ensure it has a legal basis for the processing of the Customer Personal Data by Browser Use.

**(d)** Customer Personal Data shall not include any sensitive or special data (e.g., personal health information, social security numbers, biometric data, financial data, bank or credit card data, etc.) that imposes specific data security or data protection obligations on Browser Use in addition to or different from those specified in any Browser Use documentation or which are not provided as part of the Browser Use Services. Browser Use does not require and does not request any sensitive or special data to provide the Browser Use Services.

## 5\. Browser Use Processing of Customer Personal Data[](https://browser-use.com/dpa#5-browser-use-processing-of-customer-personal-data)

**(a)** Browser Use shall process Customer Personal Data only for the following purposes: (i) processing in connection with Customer's access and use of the Browser Use Services in accordance with the Agreement; (ii) processing to perform any steps necessary for the performance of the Agreement; (iii) processing initiated by End Users in connection with their use of the Browser Use Services; (iv) processing to comply with other reasonable instructions provided by Customer (e.g. via email or support tickets) that are consistent with the terms of this DPA and the Agreement and only in accordance with Customer's documented lawful instructions; and (v) otherwise in accordance with the instructions included in the Agreement (individually and collectively, the "Purpose"). The parties agree that the Agreement (including this DPA and each Order and Statement of Work) set out Customer's complete and final instructions to Browser Use in relation to the processing of Customer Personal Data and processing outside the scope of these instructions (if any) shall require prior written agreement between Customer and Browser Use. Browser Use will notify Customer if, in Browser Use's opinion, an instruction for the processing of Customer Personal Data given by Customer infringes applicable Privacy Laws without undue delay after becoming aware of such infringement; provided that Browser Use is not responsible for performing legal research for Customer and any such notifications do not constitute legal advice. Browser Use shall not be liable for any liabilities or damages arising from or in connection with any processing in accordance with Customer's instructions following Browser Use's notification to Customer in accordance with the foregoing.

**(b)** Browser Use is prohibited from (i) selling or sharing (as such terms may be defined in the applicable Privacy Laws) Customer Personal Data; (ii) retaining, using or disclosing Customer Personal Data for any purpose other than providing Browser Use Services under the Agreement; (iii) processing Customer Personal Data outside of the direct business relationship between Browser Use and Customer; and (iv) combining Customer Personal Data with Personal Data of another customer or otherwise obtained outside of the scope of Browser Use Services unless permitted by the applicable Privacy Laws. Except as otherwise expressly provided in the Agreement, no Customer Personal Data is processed by Browser Use as consideration for any service provided to Customer. As set forth in Section 12, Customer may take reasonable and appropriate steps to help to ensure that Browser Use uses Customer Personal Data in a manner consistent with Browser Use's obligations. As required by the applicable Privacy Laws, Browser Use will notify Customer if it makes a determination that Browser Use can no longer meet its obligations under the applicable Privacy Laws. Customer may, upon written notice to Browser Use and as set forth in Section 12, take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

## 6\. Details of Data Processing[](https://browser-use.com/dpa#6-details-of-data-processing)

The subject matter of the processing of Customer Personal Data in connection with Customer's access and use of the Browser Use Services is the Purpose. Unless otherwise agreed in writing between the parties, with respect to the Customer Personal Data, the duration of processing, the nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects processed under the Agreement are further specified in Schedule A to this DPA.

## 7\. Sub-processing[](https://browser-use.com/dpa#7-sub-processing)

**(a) Authorized Sub-processors.** Customer agrees that Browser Use may engage Sub-processors to process Customer Personal Data on Customer's behalf for purposes of providing the Services. For the avoidance of doubt, this authorization constitutes Customer's prior written consent to the sub-processing of Customer Personal Data for purposes of Clause 9, Option 2 of the Standard Contractual Clauses and any similar requirements of other data transfer mechanisms. The Sub-processors currently engaged by Browser Use and authorized by Customer are available at [https://app.vanta.com/browser-use.com/trust/663ixwje3dj0nrvd17sfs/subprocessors](https://app.vanta.com/browser-use.com/trust/663ixwje3dj0nrvd17sfs/subprocessors). Browser Use shall notify Customer via the Browser Use Platform or the Browser Use Services if it adds or replaces Sub-processors at least ten (10) days prior to authorizing any new Sub-processor to process Customer Personal Data. Notwithstanding the foregoing, Browser Use may replace a Sub-processor without advance notice where the reason for the change is outside of Browser Use's reasonable control and prompt replacement is required for security or other urgent reasons. In such a case, Browser Use will inform Customer of the replacement Sub-processor as soon as possible following its appointment.

**(b) Objection to Sub-processors.** If granted by the applicable Privacy Laws, then Customer reserves the right to object in writing to Browser Use's appointment of a new Sub-processor on reasonable grounds relating to data protection by notifying Browser Use promptly in writing within five (5) calendar days of receipt of Browser Use's notice in accordance with Section 7(a) above. Such notice shall explain the reasonable grounds for the objection. In such event, the parties shall discuss such concerns in good faith with a view to achieving commercially reasonable resolution. If no such resolution can be reached, then Browser Use will, at its sole discretion, either not appoint Sub-processor, or permit Customer, as its sole remedy, to suspend or terminate the affected Services in accordance with the termination provisions in the Agreement without liability to either party (but without prejudice to any fees incurred by Customer prior to suspension or termination). If no objection has been raised by Customer within such five (5) day period, then Customer will be deemed to have authorized the new Sub-processor or updated Sub-processor, as applicable.

**(c) Sub-processor obligations.** Browser Use shall: (i) enter into a written agreement with each Sub-processor containing data protection obligations that provide at least the same level of protection for Customer Personal Data as those in this DPA, to the extent applicable to the nature of the Browser Use Services provided by such Sub-processor; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause Browser Use to breach any of its obligations under this DPA.

## 8\. Security[](https://browser-use.com/dpa#8-security)

**(a) Security Measures.** Browser Use will implement and maintain appropriate and reasonable technical and organizational measures to protect Customer Personal Data against Security Incidents and to preserve the security and confidentiality of Customer Personal Data in accordance with the Browser Use security standards described in Schedule C ("Security Measures").

**(b) Updates to Security Measures.** Customer acknowledges that the Security Measures are subject to technical progress and development and that Browser Use may update or modify the Security Measures from time to time, provided that such updates and modifications do not degrade the overall security of the Service provided to Customer.

**(c) Confidentiality of Processing.** Browser Use shall ensure that any person that it authorizes to process Customer Personal Data (including Browser Use's staff, agency and Sub-processors) shall be subject to a duty of confidentiality (whether a contractual duty or a statutory duty), and shall not permit any person to process Customer Personal Data who is not under such a duty of confidentiality.

**(d) Customer Responsibilities.** Notwithstanding the above, Customer agrees that except as provided by this DPA, Customer is responsible for its secure use of the Browser Use Services, including securing its account authentication credentials, protecting the security of Customer Personal Data when in transit to and from the Browser Use Services (as applicable) and taking any appropriate steps to securely encrypt or backup any Customer Personal Data processed in connection with the Browser Use Services.

## 9\. Rights of Data Subjects and Cooperation[](https://browser-use.com/dpa#9-rights-of-data-subjects-and-cooperation)

**(a)** To the extent required under the applicable Privacy Laws, Browser Use shall provide reasonable assistance to Customer with any data protection impact assessments or prior consultations to any supervisory authority of Customer, in each case solely in relation to processing of Customer Personal Data and taking into account the nature of the processing and information available to Browser Use. Such cooperation and assistance are provided to the extent Customer does not otherwise have access to the relevant information, and to the extent such information is available to Browser Use. Browser Use may fulfill its above obligations by providing Customer with documentation regarding its processing operations.

**(b)** Browser Use will promptly inform Customer in writing if it receives: (i) a request from a Data Subject concerning the processing of Customer Personal Data, to the extent the Data Subject identifies Customer as its Controller; or (ii) a complaint, communication, or request relating to Customer's obligations under the applicable Privacy Laws. Browser Use shall not respond to such request, complaint or communication directly (except to direct the Data Subject to contact Customer) without Customer's prior authorization, unless legally compelled to do so. For the avoidance of doubt, Browser Use may communicate, without restriction, with a regulatory or judicial body or a Data Subject if it is not reasonably apparent on the face of the request to which customer of Browser Use the request relates.

## 10\. Return and Deletion of Personal Data[](https://browser-use.com/dpa#10-return-and-deletion-of-personal-data)

Browser Use shall not retain or process Customer Personal Data for longer than necessary to carry out the Purpose unless otherwise instructed by Customer. Upon termination of the Browser Use Services, Browser Use will securely destroy all Customer Personal Data (including copies) in its possession or control within 90 days of termination. This requirement shall not apply to the extent Browser Use is required or permitted by applicable law to retain some or all of the Customer Personal Data or to Customer Personal Data it has archived on back-up systems, which Customer Personal Data Browser Use shall securely isolate and protect from any further processing and subsequently delete or anonymize in accordance with Browser Use's deletion policies, except to the extent required or permitted by applicable law.

## 11\. Data Transfers[](https://browser-use.com/dpa#11-data-transfers)

**(a) Location of Processing.** Customer Personal Data may be processed in any country in which Browser Use, its Affiliates and authorized Sub-processors maintain facilities to provide the Browser Use Services. With respect to Customer Personal Data subject to the applicable Privacy Laws of Europe, Browser Use shall not transfer (directly or via onward transfer) or otherwise process Customer Personal Data outside of the country where it was collected unless it first takes such measures as are necessary to ensure the transfer complies with the applicable Privacy Laws.

**(b) Europe.** The parties agree that when the transfer of Customer Personal Data from Customer (as "data exporter") directly to Browser Use (as "data importer") is a Restricted Transfer and the applicable Privacy Laws require that appropriate safeguards are put in place, then the Standard Contractual Clauses shall be deemed incorporated by reference and form an integral part of this DPA as set out in Schedule B to this DPA.

**(c) Alternative Transfer Arrangements.** If Browser Use adopts an alternative data export mechanism (including any new version of or successor to the Standard Contractual Clauses adopted pursuant to the applicable Privacy Laws) for the transfer of Customer Personal Data not described in this DPA ("Alternative Transfer Mechanism"), then the Alternative Transfer Mechanism shall apply instead of any applicable transfer mechanism described in this DPA (but only to the extent such Alternative Transfer Mechanism complies with the applicable Privacy Laws and extends to the territories to which Customer Personal Data is transferred) and Customer agrees to execute such other and further documents and take such other and further actions as may be reasonably necessary to give legal effect to such Alternative Transfer Mechanism.

## 12\. Security Audits[](https://browser-use.com/dpa#12-security-audits)

**(a) Audit Rights.** Browser Use shall make available to Customer all information reasonably necessary to demonstrate compliance with this DPA, including the Reports described in Section 12(b), and, if such information is not reasonably sufficient to address Customer's inquiries, either (i) provide written responses (on a confidential basis) to all reasonable requests for information made by Customer, including responses to information security and audit questionnaires or (ii) allow for and participate in audits, including inspections, by Customer solely in order to assess Browser Use's compliance with this DPA ("Audit"). Audits are subject to the following terms:

    **(i)** Customer may, upon at least 30 days' advance written notice, conduct an Audit (either by itself or using independent third-party auditors). Browser Use shall reasonably assist with any audits conducted in accordance with this Section 12(a). Such Audits may be carried out once per year, or more often if required by the applicable Privacy Laws or Customer's applicable supervisory authority.

    **(ii)** Any third party engaged by Customer to conduct an Audit must be pre-approved by Browser Use (such approval not to be unreasonably withheld or delayed) and sign Browser Use's confidentiality agreement. Customer must provide Browser Use with a proposed Audit plan at least two weeks in advance of the Audit, after which Customer and Browser Use shall discuss in good faith and finalize the Audit plan prior to commencement of Audit activities.

    **(iii)** Audits may be conducted only during regular business hours, in accordance with the finalized Audit plan and Browser Use's security and other policies and may not unreasonably interfere with Browser Use's regular business activities. Browser Use is not required to grant access to its premises or systems for the purposes of such an Audit to any individual unless they produce reasonable evidence of identity and authority. Customer shall reimburse Browser Use for any costs or expenses incurred by Browser Use in connection with the Audit or with granting access to its data processing facilities.

    **(iv)** Information obtained or results produced in connection with an Audit are Browser Use's Confidential Information.

    **(v)** In lieu of Customer's auditing a Sub-processor, Customer may request that Browser Use audit a Sub-processor or provide confirmation that such an audit has occurred (or, where available, obtain or assist Customer in obtaining a third-party audit report concerning the Sub-processor's operations) to verify compliance with the Sub-processor's obligations.

    **(vi)** Without prejudice to the rights granted in Section 12(a)(i) above, if the requested Audit scope is addressed in a Report issued by a qualified third party auditor within the prior twelve (12) months and Browser Use provides such Report to Customer confirming there are no known material changes in the controls audited, Customer agrees to accept the findings presented in the Report in lieu of requesting an Audit of the same controls covered by the Report.

**(b) Security Reports.** Customer acknowledges that Browser Use is regularly audited against SSAE 18 SOC 2, type 2 standards by independent third-party auditors and/or internal auditors respectively. Upon written request, Browser Use shall supply (on a confidential basis) a summary copy of its most current audit report(s) ("Report") to Customer, so that Customer can verify Browser Use's compliance with the audit standards against which it has been assessed.

## 13\. Security Incident Response[](https://browser-use.com/dpa#13-security-incident-response)

**(a)** In the event of a Security Incident, Browser Use shall: (a) notify Customer without undue delay (but no later than seventy-two (72) hours after becoming aware of the Security Incident); (b) provide Customer with timely information relating to the Security Incident as it becomes known or as is reasonably requested by Customer; and (c) promptly take all reasonable steps to contain, investigate, and mitigate the Security Incident. Browser Use's notification of or response to a Security Incident will not constitute an acknowledgment or admission by Browser Use of any fault or liability with respect to the Security Incident. Browser Use's contact point for additional details regarding a Security Incident is [support@browser-use.com](mailto:support@browser-use.com).

**(b)** Browser Use shall not make any Security Incident notification under this Section 13 directly to the competent supervisory authority or Data Subject (except to direct the Data Subject to contact Customer) without Customer's prior authorization, unless legally required to do so.

**(c)** Except as required by the applicable Privacy Laws, the notification obligations set out in Section 13 shall not apply to Security Incidents caused by Customer.

**(d)** Customer is solely responsible for fulfilling any Security Incident notification obligations applicable to Customer. Customer and Browser Use shall work together in good faith within the timeframes for Customer to provide Security Incident notifications in accordance with the applicable Privacy Laws to finalize the content of any notifications to Data Subjects or supervisory authorities, as required by the applicable Privacy Laws. Browser Use's prior written approval shall be required for any statements regarding, or references to, Browser Use, Browser Use's systems, or details of the Security Incident made by Customer in any such notifications.

## 14\. Miscellaneous[](https://browser-use.com/dpa#14-miscellaneous)

**(a)** Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict or inconsistency between this DPA and the Agreement, then the provisions of the following documents (in order of precedence) shall prevail: (a) for Customer Personal Data from Europe, the Standard Contractual Clauses (where applicable); then (b) this DPA; and then (c) the main body of the Agreement.

**(b)** This DPA shall be deemed a part of and incorporated into the Agreement so that references in the Agreement to "Agreement" shall be interpreted to include this DPA.

**(c)** This DPA shall be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement, unless required otherwise by the applicable Privacy Laws.

**(d)** Browser Use may disclose Customer Personal Data and other data of Customer in connection with, or during the negotiation of, any merger, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of Browser Use's business by or to another company, including the transfer of contact information and data of customers, partners and end users.

## Schedule A[](https://browser-use.com/dpa#schedule-a)

### Description of the Processing Activities / Description of the Transfer / Annex I of Standard Contractual Clauses[](https://browser-use.com/dpa#description-of-the-processing-activities--description-of-the-transfer--annex-i-of-standard-contractual-clauses)

This schedule describes the processing of Personal Data by the parties in connection with the Browser Use Services. To the extent the Standard Contractual Clauses apply as described in Section 11 of this DPA, the information in this schedule shall also be used to populate Annex I of the Standard Contractual Clauses.

#### Annex 1(A) List of Parties

Data Exporter

Data Importer

Name: Customer as defined in the Order Form

Name: Browser Use entity as defined in the Order Form

Address: As identified in the Order Form

Address: As identified in the Order Form

Contact Person's Name, position and contact details: As identified in Customer's Order Form

Contact Person's Name, position and contact details: Johannes Dittrich, Security Officer, [johannes@browser-use.com](mailto:johannes@browser-use.com)

Activities relevant to the transfer: See Annex 1(B) below

Activities relevant to the transfer: See Annex 1(B) below

Role: Controller

Role: Processor

#### Annex 1(B) Description of Processing / Transfer

Categories of Data Subjects

Customer may submit Personal Data to Browser Use, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of Data Subjects: Customer's personnel, users, or other individuals as Customer may determine.

Categories of Personal Data

Customer may submit Personal Data to Browser Use, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to, contact information, device identifiers, and other personal data Customer elects to provide.

Sensitive data (if appropriate)

None.

Frequency of the transfer (one-off or continuous)

One-off in connection with the applicable task in connection with Customer's use of the Browser Use Services

Nature and subject matter of the processing

Performance of the Browser Use Services pursuant to the Agreement, and as further instructed by Customer in its use of the Browser Use Services.

Purposes of the transfer and further processing

The transfer is made for the Purpose (as defined in the DPA).

Duration of processing

The duration of the processing is the term of the Agreement plus the period from expiration of the Agreement until the return or deletion of the personal data by Browser Use in accordance with the DPA.

Retention period (or, if not possible to determine, the criteria used to determine that period)

The duration of the Agreement plus the period from the expiry of the Agreement until deletion of the Customer Personal Data in accordance with Section 10 of the DPA.

The competent supervisory authority, in accordance with Clause 13 of the EU SCCs, must be (a) the supervisory authority applicable to the data exporter in its EEA country of establishment or, (b) where the data exporter is not established in the EEA, the supervisory authority applicable in the EEA country where the data exporter's EU representative has been appointed pursuant to Article 27(1) of the GDPR, or (c) where the data exporter is not obliged to appoint a representative, the supervisory authority applicable to the EEA country where the Data Subjects relevant to the transfer are located.

#### Annex II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA:

See Schedule C.

#### Annex III

LIST OF SUB-PROCESSORS

The list of sub-processors engaged by Browser Use is available at the link set forth in Section 7(a) above.

## Schedule B[](https://browser-use.com/dpa#schedule-b)

### Standard Contractual Clauses[](https://browser-use.com/dpa#standard-contractual-clauses)

In relation to the Standard Contractual Clauses, the parties agree as follows:

**(a)** In relation to transfers of Customer Personal Data protected by the EU GDPR, the EU SCCs shall apply, completed as follows: (i) Module Two (Controller to Processor) or Module Three (Processor to Sub-processor) terms will apply; (ii) in Clause 7, the optional docking clause will not apply; (iii) in Clause 9, Option 2 will apply and the time period for prior notice of Sub-processor changes will be as set out in Section 7(a) of this DPA; (iv) in Clause 11, the optional language will not apply; (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Dutch law; (vi) in Clause 18(b), disputes shall be resolved before the courts of the Netherlands; (vii) Annex I of the EU SCCs shall be deemed completed with the information set out in Schedule A to this DPA; and (viii) subject to Section 8 of this DPA, Annex II of the EU SCCs shall be deemed completed with the information set out in the Security Measures. If Module Three applies, Customer hereby notifies Browser Use that it is a Processor and the instructions shall be as set forth in this DPA. Additional provisions applicable to Customer Personal Data transferred pursuant to the EU SCCs are set forth in Schedule D.

**(b)** In relation to transfers of Customer Personal Data protected by the UK GDPR, the EU SCCs shall apply as amended by Part 2 of the UK Addendum and Part 1 of the UK Addendum applies as follows: (i) in Table 1, the details of the parties are set out in Schedule A to this DPA and the "Start date" is the Effective Date or other similar date of the Agreement; (ii) in Table 2, the selected modules and clauses are set out in paragraph (a) above; (iii) in Table 3, the appendix information is set out in Schedule A to this DPA, and (iv) in Table 4, "Importer" and "Exporter" are selected. The term "UK Addendum" means the United Kingdom Information Commissioner's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses Version B1.0 in force 21 March 2022.

**(c)** In relation to transfers of Customer Personal Data protected by the Swiss Federal Act on Data Protection, the EU SCCs shall also apply in accordance with paragraph (a) above, with the following modifications: (i) any references in the EU SCCs to "Directive 95/46/EC" or "Regulation (EU) 2016/679" shall be interpreted as references to the Swiss Federal Act on Data Protection; (ii) references to "EU", "Union", "Member State" and "Member State law" shall be interpreted as references to Switzerland and Swiss law, as the case may be; (iii) references to the "competent supervisory authority" and "competent courts" shall be interpreted as references to the Swiss Federal Data Protection and Information Commissioner and competent courts in Switzerland; (iv) Clause 13(a) and Part C of Annex I are not used and the "competent supervisory authority" is the Swiss Federal Data Protection Commissioner; (v) in Clause 17, the Standard Contractual Clauses shall be governed by the laws of Switzerland; and (vi) Clause 18(b) shall state that disputes shall be resolved before the applicable courts of Switzerland.

It is not the intention of either party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses and, accordingly, if and to the extent the Standard Contractual Clauses conflict with any provisions of the Agreement (including this DPA) the Standard Contractual Clauses shall prevail to the extent of such conflict.

## Schedule C[](https://browser-use.com/dpa#schedule-c)

### Technical and Organizational Security Measures[](https://browser-use.com/dpa#technical-and-organizational-security-measures)

Browser Use will maintain and keep an updated security policy aligned to industry standards that contains procedures designed to protect the security of Customer Personal Data in electronic form while under Browser Use's possession, custody or control that cover the areas below:

**a) Information Security Policy.** Maintain, update, and monitor policies that are designed to protect Browser Use's information systems from loss, damage, unauthorized disclosure or disruption of business, which includes the physical and logical protection of information systems, including Customer Personal Data that is processed or transmitted.

**b) Organization of Information Security.** Maintain an information security organization to coordinate the implementation of security.

**c) Asset Management.** Maintain procedures to identify, control, and maintain the security of Browser Use assets and Customer Personal Data.

**d) Physical and Environmental Security.** Implement measures which are designed to protect all Browser Use information systems and the Customer Personal Data contained thereon with an appropriate level of physical security and suitable environmental controls. Provide measures for physical security surrounding information and information systems, as well as the supporting infrastructure, e.g. routers, switches, network cabling, end user systems, power, and environmental systems. Restrict the use of USB ports, thumb drives and other portable drives / devices on employee laptops.

**e) Communications and operations management.** Operation of information systems and information processing facilities which contain Customer Personal Data using appropriate security measures. Maintenance of communications network and systems infrastructure including:

-   Change management
-   Third party Services delivery management
-   Protection against malicious code
-   Backup
-   Network security management including controls including industry standard intrusion detection and countermeasures that will detect unauthorized activity prior to entering the firewall maintained by Browser Use
-   Media handling
-   Exchange of information via mutually agreed methods and appropriate use of encryption
-   Monitoring and audit logging

**f) Access Control.** Procedures which are designed to restrict access to information systems and Customer Personal Data, including providing user identification and access controls designed to limit access to Customer Personal Data to authorized users who require such access to carry out their role.

**g) Information Security Incident Management.** Develop and maintain procedures which provide an incident response plan and program designed to address an adverse event related to the security of Browser Use's information systems.

**h) Compliance.** Maintain procedures designed to ensure that Browser Use's information systems comply with local laws and regulatory requirements.

**i) Specific Measures.**

Measure

Description

Measures of pseudonymisation and encryption of personal data

Browser Use uses encryption to protect personal data, both while in transit and while at rest. All data in transit is secured using HTTPS TLS 1.2 (or greater). Browser Use also encrypts data at rest using the industry standard AES-256 algorithm.

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services

An Infrastructure vulnerability assessment and penetration testing is performed to identify and remediate any vulnerabilities.

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

Browser Use Services and applications are primarily hosted in Amazon Web Services (AWS). Additional details on AWS's security best practices and industry-recognized certifications and audits are available at aws.amazon.com/security/. A periodic disaster recovery test is performed to test the recovery point objectives (RPO) and recovery time objectives (RTO). In addition, a backup integrity test is performed to validate the data backup at least once annually.

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processing

Browser Use undergoes an external Service Organization Controls 2 (SOC 2, Type 2) audit annually to evaluate the effectiveness of the security controls that have been designed and implemented.

Measures for user identification and authorization

Two-factor authentication (2FA) is enforced to the extent possible.

Measures for the protection of data during transmission

Browser Use uses HTTPS with TLS 1.2 (or greater) to protect data in transit.

Measures for the protection of data during storage

Browser Use uses industry standard AES-256 encryption to protect data at rest.

Measures for ensuring physical security of locations at which personal data are processed

Browser Use is a 100% SaaS company. Even though Browser Use has a few limited office locations, there are no Browser Use physical locations where personal data could be stored. All data is either stored in the cloud or with our SaaS providers that support our business (e.g. AWS, SalesForce, HRIS systems, etc.).

Measures for ensuring data minimization

Browser Use itself collects very minimal personal information and restricts access to any such personal data. Browser Use has no control over the personal data that is processed in connection with Customer's access and use of the Browser Use Services.

Measures for ensuring data quality

All Browser Use releases are rigorously tested. Browser Use software releases are subject to automated testing in continuous integration pipelines, including unit and integration tests. Changes are verified in a staging environment prior to production deployment via a gated promotion workflow.

Measures for ensuring limited data retention

Browser Use retains customer data in accordance with the applicable Order. Browser Use also has the capability to retain customer data in an archive format, per customer requirements.

## Schedule D[](https://browser-use.com/dpa#schedule-d)

### Additional EU SCCs Provisions[](https://browser-use.com/dpa#additional-eu-sccs-provisions)

**1\. Government Disclosure Requests.**

    **a.** Browser Use shall, unless otherwise prohibited by law or a legally binding order of an applicable body or agency, promptly notify Customer or the applicable data subject of any request for the disclosure of Customer Personal Data by a governmental or regulatory body or law enforcement authority (including any supervisory authority) ("Disclosure Request") without responding to such request, unless otherwise required by applicable law (including to provide acknowledgement of receipt of the request). If applicable laws prohibit Browser Use from informing Customer or the applicable data subject of the Disclosure Request, Browser Use shall use reasonable efforts to obtain a waiver of such restrictions and shall in any event provide such notification as soon as any relevant restrictions are lifted.

    **b.** Browser Use will review applicable law to evaluate any Disclosure Request and to challenge the Disclosure Request if, after a careful assessment, it concludes that there are grounds under applicable law to do so. When challenging a Disclosure Request, Browser Use shall seek interim measures to suspend the effects of the Disclosure Request until an applicable court or other authority has decided on the merits. Browser Use shall not disclose Customer Personal Data requested until required to do so under applicable law. Browser Use shall only provide the minimum amount of Customer Personal Data permissible when responding to the Disclosure Request, based on a reasonable interpretation of the Disclosure Request.

    **c.** If the Disclosure Request is incompatible with the EU SCCs or other data transfer mechanism utilized in accordance with the DPA, Browser Use will so notify the requesting authority and, if permitted by applicable law, notify the competent EEA government authority with jurisdiction over the Customer Personal Data subject to the Disclosure Request.

    **d.** Browser Use will maintain a record of Disclosure Requests and its evaluation, response, and handling of the requests. Browser Use will provide Customer with such records relevant to Customer Personal Data except as prohibited by applicable law or legal process or in the interest in protecting Browser Use's legal rights in connection with threatened, pending, or current litigation.

    **e.** Browser Use will maintain internal policies and/or procedures related to the handling of Disclosure Requests.

**2.** Browser Use has, as of the effective date of the Agreement, not received any national security orders under Foreign Intelligence Surveillance Act ("FISA") Section 702.

**3.** As of the effective date of the Agreement, no court has found Browser Use to be the type of entity defined in 50 U.S.C § 1881(b)(4) eligible to receive process issued under FISA Section 702.

**4.** Browser Use has not purposefully created "back doors" or similar programming in its systems that provide Browser Use Services that could be used to access the systems and/or Customer Personal Data, nor has Browser Use purposefully created or changed its business processes in a manner that facilitates access to Customer Personal Data or its systems that provide the Browser Use Services. To the best of Browser Use's knowledge, United States Privacy Laws do not require Browser Use to create or maintain "back doors" or to facilitate access to Customer Personal Data or systems that provide Browser Use Services or for Browser Use to possess or provide the encryption key in connection with a United States Disclosure Request.

**5.** The parties shall each monitor Privacy Laws, and upon any changes to the same, either party may request to amend the DPA in such a manner as it determines necessary to comply with such amended Privacy Laws and the parties shall thereafter negotiate in good faith an amendment to this DPA. If the parties are unable to agree on an amendment within thirty (30) days, (i) either party may terminate the DPA as set forth in the Agreement, (ii) the parties may explore options to further protect the Customer Personal Data or alter the processing so as to mitigate certain risks identified by the parties, or (iii) request the destruction and/or return of Customer Personal Data as set forth in the DPA.

**6.** Browser Use will maintain internal policies and/or procedures related to transfers of Personal Data of customers. Browser Use has procedures for applicable personnel to receive information, as appropriate, regarding applicable transfers of Customer Personal Data, where such information may include an explanation of the necessity of the transfer and any data protection safeguards in scope. Personnel responsible for reviewing requests to transfer Personal Data of customers may include IT, security, compliance, and legal personnel.