Data processing addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of service between Lynt-X Global Tech Limited (“Processor”) and the Customer (“Controller”) and applies when we process Personal Data in Customer Data on the Customer’s behalf. Enterprise customers can sign a countersigned copy on request.

1. Definitions

“Data Protection Laws” means, as applicable, the DIFC Data Protection Law, DIFC Law No. 5 of 2020 (DIFC DPL), the EU General Data Protection Regulation 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the CPRA (CCPA), and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). “Personal Data”, “processing”, “controller”, “processor”, “data subject” and “supervisory authority” have the meanings given in those laws. Under the CCPA, Customer is the “business” and we are the “service provider”.

2. Scope and instructions

• Subject matter: providing the Service: reading content from connected CMSs, evaluating, holding, applying and undoing changes, and keeping an audit log.
• Duration: the term of the agreement, plus the deletion period in section 9.
• Data subjects: the Customer’s users; people named or described in content on the Customer’s sites.
• Categories of data: names, email addresses, user identifiers and any personal data contained in content the Customer connects. The Service is not designed for special category data; the Customer should not use it to process such data unless agreed in writing.
• We process Personal Data only on the Customer’s documented instructions, which are these terms, the Customer’s configuration of the Service, and any further written instruction. We will tell the Customer if an instruction appears to break Data Protection Laws.
• Under the CCPA, we will not sell or share Personal Data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, or combine it with data from other sources except as permitted.

3. Confidentiality

Everyone authorised to process Personal Data is bound by confidentiality obligations.

4. Security

We implement the technical and organisational measures described on our Security page (Annex 2), including encryption of CMS credentials at rest with AES-256-GCM, encryption in transit, hashed credentials and tokens, role-based access, a tamper-evident audit log and network protections. We may update the measures as long as they don’t reduce overall protection.

5. Subprocessors

The Customer authorises the subprocessors listed on our Subprocessors page. We impose data protection terms on each that are no less protective than this DPA and remain responsible for them. We will give 30 days’ notice of new subprocessors; the Customer may object on reasonable grounds, and if we can’t resolve the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for it.

6. Data subject requests

Taking into account the nature of processing, we will help the Customer respond to requests from data subjects, and forward to the Customer any request we receive directly.

7. Personal Data breaches

We will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data breach affecting Customer Data, with the information the Customer needs to meet its own obligations, and will take reasonable steps to contain it.

8. Assistance and audits

We will provide reasonable help with data protection impact assessments and consultations with supervisory authorities. We will make available information needed to demonstrate compliance and allow audits by the Customer or an independent auditor, on reasonable notice, no more than once a year (unless required by a supervisory authority or after a breach), at the Customer’s cost.

9. Return and deletion

On termination, the Customer can export its audit log. We will delete Customer Data within 30 days, and from backups within [90 days], unless the law requires us to keep it.

10. International transfers

• EU/EEA: transfers to countries without an adequacy decision are governed by the Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) and, where applicable, Module Three, which are incorporated by reference, with optional clause 7 included, option 2 in clause 9 (general authorisation, notice as in section 5), the optional language in clause 11 omitted, and clauses 17 and 18 governed by the law and courts of Ireland.
• UK: the International Data Transfer Addendum issued by the ICO applies to transfers from the UK.
• DIFC: transfers outside the DIFC are made only to jurisdictions with an adequate level of protection or subject to appropriate safeguards, as permitted by Articles 26 and 27 of the DIFC DPL.
• UAE: transfers outside the UAE are made only as permitted by the PDPL and its executive regulations, including to countries with adequate protection or under contractual safeguards.
• Where an Enterprise customer selects a hosting region, Customer Data stored by the Service is kept in that region, except as needed for subprocessors listed for global functions.

11. Liability and precedence

Liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms, this DPA prevails for the processing of Personal Data; the Standard Contractual Clauses prevail over both.

Annex 1: Details of processing

Parties: the Customer (data exporter, controller) and Lynt-X Global Tech Limited, Innovation One, Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates (data importer, processor). Nature and purpose, data subjects and categories of data: as set out in section 2. Frequency: continuous. Competent supervisory authority: [as determined under clause 13 of the SCCs].

Annex 2: Technical and organisational measures

As described on the Security page, as updated from time to time.

Annex 3: Subprocessors

As listed on the Subprocessors page.