Data Processing Addendum

Customer is the controller of Customer Personal Data (or a processor acting for its own clients), and LiteSurface is its processor (or subprocessor). Under the CCPA, LiteSurface is Customer’s service provider.

LiteSurface is an independent controller of account, billing, security, and usage data it needs to run its business, as described in the Privacy Policy. This DPA does not apply to that data.

When Customer uses its own AI Provider or other third-party credentials, that provider processes the data sent with those credentials under Customer’s own agreement with it. It is not our Subprocessor, and we transmit data to it on Customer’s instructions.

We process Customer Personal Data only on Customer’s documented instructions, unless the law requires otherwise (in which case we will tell Customer first, unless the law prohibits it). The Agreement, this DPA, and Customer’s configuration of the Service, including allowed AI Providers, sensitive field classifications, run modes, budgets, sharing, transfers, exports, and deletions, are Customer’s complete instructions.

We will promptly tell Customer if we believe an instruction infringes Data Protection Laws, and may suspend the affected processing until it is confirmed or changed.

Customer is responsible for the lawfulness of the processing it instructs, including its legal basis, the notices it gives, the accuracy of the data, and its right to use the sources it adds. Customer will not submit special categories of personal data unless necessary, and will mark any such fields as not for models.

We will not use Customer Personal Data to train or fine-tune AI models, sell or share it, or use it for any purpose other than providing the Service.

Customer authorizes us to engage the Subprocessors listed on our Subprocessors page. We impose data protection terms on each Subprocessor that are at least as protective as this DPA, and remain responsible for their performance.

We will give at least 30 days’ notice before a new Subprocessor processes Customer Personal Data, by updating the Subprocessors page and emailing workspace owners and anyone subscribed to updates. In an emergency, such as replacing a failed provider to keep the Service running, we may give shorter notice and will explain why.

Customer may object on reasonable data protection grounds within 15 days of notice by writing to privacy@litesurface.com. We will work in good faith to address the objection, for example by offering a configuration that avoids the Subprocessor. If we cannot, Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the unused term.

The Service lets Customer find, correct, export, and delete Customer Personal Data. If we receive a request from an individual about Customer Personal Data, we will refer them to Customer and will not respond ourselves unless Customer asks us to or the law requires. We will provide reasonable additional help where Customer cannot fulfill a request using the Service.

We will provide reasonable information to help Customer carry out data protection impact assessments and consult supervisory authorities where required, taking into account the information available to us.

We will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach, by email to workspace owners.

To the extent known, the notice will describe the nature of the breach, the categories and approximate numbers of individuals and records concerned, the likely consequences, the measures taken or proposed, and a contact for more information. We will provide further information as it becomes available.

We will take reasonable steps to contain and remedy the breach and to prevent a recurrence. Notifying Customer of a breach is not an admission of fault or liability.

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to a reasonable security questionnaire no more than once a year. We do not currently hold third-party certifications; when independent audit reports become available, we may provide them to satisfy audit requests.

If that information is insufficient, or a supervisory authority requires it, Customer (or an independent auditor bound by confidentiality) may audit our compliance once in any 12-month period, with at least 30 days’ notice, during business hours, and in a way that does not disrupt the Service or compromise other customers’ data. Customer bears its own costs. Audits after a Personal Data Breach are not limited to once a year.

Where Customer Personal Data subject to the EU GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA: Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor. Annexes I and II of this DPA complete the Clauses’ Annexes, and the list of Subprocessors completes Annex III.

For the Clauses: the optional docking clause (Clause 7) applies; Clause 9 Option 2 (general authorization) applies with the notice period in Section 6; the optional language in Clause 11 does not apply; and for Clauses 17 and 18 the parties choose the law and courts of Ireland. The supervisory authority is the one determined under Clause 13.

For UK transfers, the UK International Data Transfer Addendum applies, with its tables completed by the information in this DPA. For Swiss transfers, the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent authority.

We will make onward transfers to Subprocessors only under an appropriate transfer mechanism, and will provide reasonable information to support Customer’s transfer impact assessment.