Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (“DPA”) forms part of the Terms between LolaDesk and Customer. It applies when LolaDesk processes Client Data on Customer’s behalf. Customer is the controller (or “business”); LolaDesk is the processor (or “service provider”/“contractor”).

2. Instructions

LolaDesk processes Client Data only to provide the Service, on Customer’s documented instructions (the Terms, Customer’s settings and use of the Service), and as required by law. LolaDesk will inform Customer if it believes an instruction violates law.

3. Service-provider commitments (U.S. state privacy laws)

LolaDesk will not: sell or share Client Data; retain, use or disclose it for any purpose other than the business purposes in the Terms; retain, use or disclose it outside the direct business relationship; or combine it with personal information from other sources except as permitted by law. LolaDesk will comply with applicable obligations, provide the same level of protection the law requires, and notify Customer if it can no longer meet them.

4. Confidentiality

Personnel with access to Client Data are bound by confidentiality obligations and access it only as needed.

5. Security measures

• Encryption in transit (TLS) and encryption at rest by our hosting providers.
• Logical separation of each Customer’s data (tenant isolation) and role-based access.
• Two-step verification for account owners; least-privilege access for staff and systems.
• Logging, monitoring and secure software development practices; secrets kept server-side.
• Backups and recovery procedures with our infrastructure providers.

6. Subprocessors

Customer authorizes the subprocessors listed at /subprocessors. LolaDesk imposes data protection terms on each subprocessor and remains responsible for their performance. We will update the list at least 15 days before adding a new subprocessor; Customer may object on reasonable data-protection grounds, and if we cannot resolve it, Customer may terminate the affected Service.

7. Data subject requests

Taking into account the nature of the processing, LolaDesk will provide reasonable assistance (including Service features to access, export, correct and delete data) so Customer can respond to requests from individuals.

8. Security incidents

LolaDesk will notify Customer without undue delay, and where feasible within 72 hours, after becoming aware of a breach of security leading to unauthorized access to Client Data, and will provide information reasonably needed for Customer’s obligations.

9. Deletion and return

Upon termination, Customer may export Client Data for 30 days. After that, LolaDesk will delete Client Data within 90 days, except where retention is required by law or backups are overwritten on their normal cycle.

10. Audits

On written request no more than once a year, LolaDesk will provide information reasonably necessary to demonstrate compliance with this DPA, such as a security summary and subprocessor list.

11. International transfers

Client Data is processed in the United States. Where the law requires a transfer mechanism, the EU Standard Contractual Clauses (and UK Addendum) are incorporated by reference, with Customer as exporter and LolaDesk as importer.

12. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Terms. This DPA controls over the Terms for the processing of Client Data.