Data Processing Agreement

This Data Processing Agreement (DPA) is between the merchant that has accepted the Terms of Service (Customer) and Lianda Labs LLC (Processor). It forms part of those Terms and applies whenever Processor processes personal data on Customer’s behalf. A DPA that the parties have signed separately takes priority over this one.

For the processing described here, Customer determines the purposes and provides lawful instructions. If Customer itself acts for another controller, it must have that controller’s authority. Mandatory transfer clauses prevail where required; this DPA prevails over conflicting service terms on personal-data processing.

Subject and purpose: operate Customer’s store, links, public pages and assistant; store authorised materials, messages, attachments, customer records, orders and bookings; generate replies, translations, summaries and conversation analyses (including automated analyses that estimate an end customer’s stage, intent or whether a visitor appears to be a prospect, a bot or a competitor); send the notifications Customer’s service requires; facilitate payments through Customer’s own payment account and obtain shipping quotes; and provide support. Operations include receiving, organising, storing, indexing (including vector embeddings), analysing, translating, retrieving, transmitting, returning and deleting information. No internal model configuration or proprietary implementation is specified by this agreement.

Individuals: Customer’s staff, end customers, visitors, prospects and people whose information Customer is authorised to submit. Data: names, email addresses, telephone numbers and other contact details, delivery addresses, order, booking and payment-status details, notes, conversation and attachment content, uploaded materials, analysis results and related service metadata. Sensitive data is excluded unless separately agreed and lawfully supported; if an end customer includes it in a message, Processor protects it as entrusted data and Customer remains responsible for its lawful basis.

Location: Customer Content is stored in Google Cloud’s United States region. Some sub-processors process data in other countries, including AI requests that Google may serve outside the United States and traffic carried by Cloudflare’s global network; section 8 applies to restricted transfers. Processing continues for the service term and the return and deletion period in section 9.

Processor shall process personal data only on Customer’s documented instructions, including for transfers, unless law requires otherwise. Where permitted, Processor shall inform Customer of a legal requirement before processing. Processor shall promptly inform Customer if it considers an instruction unlawful and seek a lawful resolution.

Customer instructs Processor: to make each conversation available to the end customer who took part in it, including in the end customer portal; to delete a conversation for both parties when that end customer permanently deletes it; to delete archived conversations 90 days after archiving; and to give an agent that Customer connects to its workspace the access Customer grants to that agent, such as reading conversations and order cards, replying to end customers or confirming orders. When an end customer saves a conversation to a portal account, Processor also processes that conversation as a controller to provide the portal and its assistant to that end customer, as the Privacy Policy describes; that processing, like the portal account itself, is not covered by this DPA. Data an agent reads passes to that agent’s provider under Customer’s own arrangement with it, and that provider is not Processor’s sub-processor.

Processor shall not sell the entrusted data, use it for cross-context behavioural advertising, or use it to train or fine-tune any AI model. Processor engages a sub-processor that provides AI model services only under terms that do not permit the entrusted data to be used to train models.

Processor shall limit access to authorised personnel bound by confidentiality and implement measures appropriate to the processing risk. The measures in place include encryption in transit and at rest; access controls that limit data to authorised accounts; staff access through Leptex’s administration console, which is limited to named staff accounts and logged; direct database access restricted to the owners of Processor’s cloud project; and investigation of incidents with notice to Customer as section 7 provides. Processor gives Customer a fuller description on request, in confidence. Processor may change the measures but shall not materially reduce the protection they give.

Customer gives Processor general written authorisation to engage sub-processors in the following categories, including backup providers in the same categories: cloud hosting, storage and databases; AI model services; network delivery and security; email delivery; mobile push-notification delivery; identity providers chosen by users; payment processing; and shipping-rate lookups. Processor keeps a current list of its sub-processors and their locations and sends it to Customer on request. Processor shall notify Customer by email at least 30 days before adding or replacing a sub-processor, and Customer may object on reasonable data-protection grounds before the new processing starts.

Processor shall impose equivalent applicable protection obligations on each sub-processor and remain responsible for each sub-processor’s performance under this DPA. If an objection cannot be resolved, Customer may end the affected service and receive a refund of prepaid fees for the unused period.

Taking account of the processing and information available, Processor shall assist Customer with access, correction, deletion, restriction, portability and other applicable rights requests, and with security obligations, impact assessments and regulatory consultation. Requests concerning Customer-controlled data shall be forwarded to Customer unless law requires another response.

Processor shall notify Customer of a personal data breach affecting entrusted data immediately following discovery and in any event without undue delay. The notice shall describe known affected information and individuals, likely consequences, measures taken or proposed, and an incident contact. Information may be supplied in phases; the initial notice must not wait for a complete investigation.

Processor shall cooperate on containment and legally required notifications. Customer remains responsible for its controller notifications unless law provides otherwise. Processor sends incident notices to the email address of Customer’s workspace owner; Customer reaches Processor about an incident at privacy@leptex.com.

Where Customer’s transfer of personal data to Processor is restricted by the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection, the standard contractual clauses adopted by the European Commission in Decision (EU) 2021/914 are incorporated into this DPA: Module Two where Customer is a controller and Module Three where Customer is a processor. Customer is the data exporter and Processor the data importer; sections 2, 4 and 5 of this DPA supply the content of the annexes; the clauses are governed by the law of Ireland and disputes go to the courts of Ireland. For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies to those clauses; for transfers from Switzerland, references to the GDPR are read as references to Swiss law. Accepting the Terms of Service is the parties’ signature of these clauses.

For these clauses: Clause 7 applies; in Clause 9, Option 2 applies, with the notice period in section 5; the optional wording in Clause 11 does not apply; the competent supervisory authority is determined under Clause 13(a); Annex I lists Customer (as identified in its workspace and store details) and Lianda Labs LLC, Bellevue, WA 98007, United States, privacy@leptex.com; Annex II is the description of measures in section 4 together with the fuller description Processor provides on request; and Annex III is the sub-processor list in section 5. In the UK Addendum, Tables 1 to 3 are completed with the information in this DPA, and neither party may end the Addendum under its Table 4. For transfers from Switzerland, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and individuals in Switzerland may bring claims under Clause 18(c) where they habitually reside.

During the service term Customer can, in the workspace, download each uploaded document, view its conversations and delete its content. On Customer’s written request made during the term or within 30 days after the agreement ends, Processor shall return the entrusted personal data (conversations, customer records, orders and bookings) in a commonly used machine-readable format within 30 days of the request.

When the agreement ends, Processor closes Customer’s workspace unless Customer has asked in writing to keep it open under a new agreement. Processor shall delete the entrusted personal data from its running systems no later than 90 days after the workspace is closed, unless applicable law requires retention; any required retention shall be limited and protected. Database backups are kept for up to 14 days after deletion, are not used for any other purpose, and then expire. An archived conversation is deleted automatically 90 days after it is archived, and an end customer may permanently delete a conversation they took part in, as described in the Privacy Policy.

Processor shall make available information necessary to demonstrate compliance with this DPA and allow and contribute to lawful audits by Customer or its independent auditor. Reasonable confidentiality and security arrangements may protect other customers and trade secrets but must not prevent required verification or regulatory access.

Where California law treats Processor as a service provider or contractor, processing shall be limited to specified business purposes in this agreement. Processor shall not sell or share the data, use it outside the permitted relationship, or combine it with other sources except as law permits. Processor shall provide the legally required level of privacy protection, notify Customer if it can no longer comply, and permit reasonable compliance checks and steps to stop and remediate unauthorised use.

This DPA takes effect when Customer accepts the Terms of Service or signs a Private agreement that refers to them, whichever is earlier. Processor records the date and the version of the Terms accepted; the version of this DPA published on that date applies, subject to section 18 of the Terms. The limits and exclusions of liability in the Terms of Service apply to this DPA, except where the law or the standard contractual clauses do not allow a limit as against individuals.

Section 18 of the Terms applies to changes to this DPA; a change may not reduce the protection required by applicable data-protection law or the standard contractual clauses.