Data Processing Addendum

This Data Processing Addendum sets out Article 28 processor terms for Crime Data API customers. It covers customer instructions, processing obligations and the return or deletion of personal data at termination. Read the complete addendum below for the applicable provisions and contact the operator for requests about processing or an audit.

Last updated: 2026-11-04

This addendum is incorporated by reference into the Terms when Crime Data API, operated by Shahar Frish, Israel (processor), processes personal data on behalf of a customer (controller). It takes precedence for that processing. Our independent processing of account, billing and security data is described in the Privacy policy.

Scope and instructions: what should you know?

Subject matter: address lookup and API responses for the customer's application. Nature and purpose: receive, geocode, cache, query and return location data. Data: submitted addresses, matched addresses and coordinates, which may relate to residents, occupants or the customer's users. Duration: the service term plus the cache retention in the Privacy policy, unless earlier deletion is instructed. The customer determines lawful purposes, provides required notices, has authority to submit data and controls its instructions through API requests and written directions.

We process only on documented instructions, including for international transfers, unless law requires otherwise; we notify the customer of that requirement unless prohibited. We promptly tell the customer if an instruction appears unlawful. Do not submit special-category data or use the service for the prohibited uses in the Terms.

Confidentiality and security: what should you know?

We bind authorized personnel to confidentiality, limit access to those who need it and implement measures appropriate to risk under Article 32, including access controls, hashed API secrets, HTTPS transport, retention limits and incident handling. We assist the controller with security duties, data-subject requests, impact assessments and prior consultations, taking account of the processing and information available.

Subprocessors and transfers: what should you know?

The customer generally authorizes Vercel for hosting and Supabase (US) for database storage. Address lookup discloses submitted addresses to US Census Geocoder, an external public service under its own terms. The customer instructs that disclosure when requesting address lookup; use coordinates if it is unsuitable. We impose equivalent data-protection obligations on subprocessors and remain responsible for their performance. We give at least 30 days' notice of intended subprocessor additions or replacements, allowing objections on reasonable data-protection grounds; if unresolved, the customer may stop affected processing and terminate the affected service.

We transfer personal data only on documented instructions and with a valid Chapter V mechanism where required, including applicable adequacy decisions or standard contractual clauses and supplementary measures as necessary. This addendum alone is not a transfer mechanism; contact us to arrange required transfer terms before submitting data requiring them.

Incidents, rights and accountability: what should you know?

We notify the controller without undue delay after becoming aware of a personal-data breach and provide available details and updates to support its obligations. We promptly forward data-subject requests and assist the controller rather than responding independently unless instructed or required by law. We provide information needed to demonstrate compliance and allow and contribute to audits and inspections by the controller or its mandated auditor, with reasonable arrangements protecting other customers' data.

End of processing: what should you know?

At the controller's choice, we return or delete personal data at termination and delete copies unless law requires retention. Request return, earlier deletion, subprocessor notices or an audit at shaharfrish6@gmail.com. Customer instructions and this addendum do not authorize prohibited screening or housing steering.

Data comes from each city's open-data portal under the licence shown. It is police-reported incident data, not convictions, and can be revised by the source. Compared with the FBI API · Terms · Refunds · Privacy · DPA · Contact
Operated by Shahar Frish, Israel.