Statement: ''Bright Data complies with applicable U.S. state privacy laws (including CCPA/CPRA) and does not sell or rent our customers’ data. We act as a service provider/processor under customer contracts and provide a “Do Not Sell or Share” mechanism. See Privacy Policy and CCPA Notice. CCPA/CPRA notice and rights (within the same Privacy Policy, “Privacy notice for California Residents”): https://brightdata.com/privacy DPA (data processing addendum): https://brightdata.es/static/Bright_Data_Data_Protection_Addendum.pdf?md5=189111-a9a4cf7a “Don’t Sell My Personal Info” page: https://brightdata.com/check_your_data''

CSA register

More information here: https://cloudsecurityalliance.org/star/registry/bright-data/

Certificate attached.

Valid Until: 11/08/2025

Certificate of PCI DSS Merchant Compliance

Last Passing Scan Date: 05 Jan 2024

Self Assessment Questionnaire (SAQ A-EP 3.2.1 ) Compliant Date: 06 Dec 2023

Bright Data has a SOC 2 Audit Report which they will be sharing with customers upon request.

System and Organization Controls Report

(SOC 3 Report)

Relevant to Security, Availability, Confidentiality and Privacy

March 1, 2023 – May 31, 2023

Bright Data SOC3 Report - 2024