Data Processing Agreement

1. Parties and scope

The customer is the controller and Lysia is the processor where the customer determines the purposes of processing and instructs Lysia to process personal data through supported Lysia features.

This DPA supplements the applicable Lysia Terms of Use. It does not apply to separate processing for which Lysia independently determines the purposes and means and therefore acts as controller, such as account administration, service security, fraud and abuse prevention, legal compliance, or other processing expressly described as Lysia-controlled processing in the Privacy Notice. Any such controller processing must have its own lawful basis and transparency and does not convert customer personal data processed under this DPA into data Lysia may freely use for its own purposes.

2. Documented instructions and purpose limitation

Lysia will process customer personal data only on documented instructions from the controller, including instructions expressed through the customer's use and configuration of Lysia, except where processing is required by applicable Union or Member State law. Where legally permitted, Lysia will inform the controller before processing required by such law.

Lysia will not sell customer personal data, use it for unrelated advertising or marketing, build an independent commercial customer dataset from it, or use identifiable customer communications or records to train or improve models or products for Lysia's own independent purposes merely because that data is available through the service. If Lysia proposes processing for a separate purpose for which it would act as controller, that processing must be separately identified, supported by an appropriate lawful basis, and described transparently as required by applicable law.

The controller is responsible for ensuring that its instructions comply with applicable data-protection law and that it has a lawful basis for the personal data it provides to Lysia. If Lysia believes an instruction infringes applicable data-protection law, Lysia will inform the controller as required by Article 28 GDPR.

3. Confidentiality and access

Lysia will ensure that persons authorised to process customer personal data are subject to appropriate confidentiality obligations. Access to customer personal data will be limited to persons and systems that reasonably require access to carry out the controller's documented instructions, provide the requested service, secure the processing, provide authorised support or maintenance, or comply with applicable law.

This may include Lysia employees, contractors or other personnel acting under Lysia's authority, such as personnel performing security, engineering, support or maintenance work. Such access will be limited to what is reasonably necessary for assigned duties, subject to confidentiality and appropriate access controls, and removed when it is no longer required. If a separate provider processes customer personal data on Lysia's behalf as an independent processor rather than merely acting under Lysia's authority, that provider will be treated as a subprocessor under Section 5.

4. Security of processing

Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risks to individuals, Lysia will maintain technical and organisational measures designed to provide a level of security appropriate to the risk.

The current categories of measures are described in Annex B and on the Security & Data Protection page. No description of security measures is a guarantee that security incidents can never occur.

5. Subprocessors

Lysia may engage subprocessors only in accordance with Article 28 GDPR and the controller's applicable authorisation. Where general written authorisation is used, the controller will be informed of intended additions or replacements in a manner that gives the controller a meaningful opportunity to object where required.

Lysia will impose data-protection obligations on each subprocessor that provide an appropriate level of protection for the processing delegated to that subprocessor. Lysia remains responsible for the performance of its subprocessor obligations to the extent required by applicable law and the applicable agreement.

The controller gives Lysia general written authorisation to use the subprocessors listed in Annex C. Lysia will provide notice of intended additions or replacements before the new subprocessor begins processing customer personal data where required by Article 28, giving the controller a reasonable opportunity to object on data-protection grounds.

6. Assistance with data-subject rights

Taking into account the nature of the processing, Lysia will provide reasonable assistance to the controller, through appropriate technical and organisational measures where possible, so that the controller can respond to requests from individuals exercising rights under applicable data-protection law.

Depending on the request and the features in use, this assistance may include helping the controller locate, access, export, correct, restrict or delete customer personal data held in the controller's workspace; providing information about relevant processing; and promptly forwarding a data-subject request received by Lysia where the request concerns data processed only on the controller's behalf. The controller remains responsible for deciding whether and how the request must be fulfilled.

7. Security incidents and regulatory assistance

Lysia will notify the controller without undue delay after becoming aware of a personal-data breach affecting customer personal data processed under this DPA and will provide information reasonably available to Lysia that the controller may need to meet applicable notification obligations.

Taking into account the nature of processing and the information available to Lysia, Lysia will provide reasonable assistance with security obligations, data-protection impact assessments and consultations with supervisory authorities where Article 28 requires such assistance. For a personal-data breach, Lysia will provide reasonably available information about the nature of the incident, affected data or data subjects where known, likely consequences, containment or remediation measures, and a contact point for follow-up, and will supplement that information as material facts become available.

8. International transfers

Lysia will not intentionally transfer customer personal data to a third country or international organisation except on documented controller instructions or where otherwise permitted by applicable law and supported by a lawful transfer mechanism where one is required.

Current transfer information and safeguards for subprocessors used within this DPA scope are documented in Annex D.

9. Return and deletion

At the end of the relevant processing services, and subject to the controller's choice and applicable law, Lysia will delete or return customer personal data and delete remaining copies unless Union or Member State law requires continued storage.

The product's active-workspace deletion process is described on the Company Data Deletion page. Residual copies may remain in protected backups until the applicable backup lifecycle removes them, where deletion from those backups is not immediately practicable and continued retention is otherwise lawful and appropriately protected.

10. Compliance information and audits

Lysia will make available information reasonably necessary to demonstrate compliance with the processor obligations applicable under Article 28 GDPR. This may include relevant security documentation, processing and subprocessor information, transfer information, and other evidence reasonably available to Lysia.

Lysia will allow for and contribute to audits or inspections required by Article 28. Where appropriate, the parties should first use current independent reports, documentation, questionnaires or a remote review if those materials can reasonably demonstrate compliance. If an additional audit or inspection is reasonably necessary, it will be arranged on reasonable notice, during normal business hours where practicable, and in a way that protects other customers, confidential information and system security while still allowing the controller to exercise its Article 28 rights.

11. Controller responsibilities and lawful data

The controller remains responsible for the lawfulness of its processing, including providing required notices to individuals, identifying and maintaining an appropriate legal basis, responding to data-subject requests, configuring access appropriately, and ensuring that personal data uploaded, entered or connected to Lysia is necessary, proportionate and lawful for the controller's purposes.

The controller must have the right and lawful basis to collect, use and provide the personal data to Lysia and must give Lysia only lawful documented instructions. This DPA allocates processor obligations to Lysia; it does not create a lawful basis for the controller, cure unlawful collection or disclosure, or make an otherwise unlawful processing purpose lawful.

The controller must not instruct Lysia to process personal data in a manner that violates applicable data-protection law. Where Lysia becomes aware that an instruction infringes applicable data-protection law, Lysia will inform the controller as required by Article 28 GDPR and may decline or suspend the affected processing where necessary to avoid unlawful processing.

12. Duration and precedence

Once made effective, this DPA will apply for as long as Lysia processes customer personal data as processor on behalf of the controller. If this DPA conflicts with the Terms of Use regarding processor obligations for customer personal data, this DPA will control to the extent of that conflict.