Data processing addendum

This addendum forms part of the terms of service when Lattix Technologies Corp processes personal data contained in Customer Content on behalf of a customer. The customer is the controller; Lattix is the processor.

1. Scope and instructions

Lattix processes Customer Content only to provide the Service and on the customer's documented instructions, which are the terms, this addendum and the customer's use of the Service's features. Lattix will tell the customer if it believes an instruction breaks the law.

2. Confidentiality

People authorized to process Customer Content are bound by confidentiality and have access only as needed.

3. Security

Lattix maintains the technical and organizational measures described on the security page, including tenant isolation, encryption of stored provider keys, hashed tokens, audited changes and a dependency provenance policy, and will not materially reduce them.

4. Subprocessors

The customer authorizes the subprocessors listed on the security page. Lattix will give notice before adding or replacing a subprocessor, and the customer may object on reasonable grounds. Lattix imposes data protection terms on each subprocessor no less protective than this addendum.

5. Assistance

Lattix will help the customer respond to data subject requests, carry out data protection impact assessments and meet security obligations, taking into account the nature of the processing. Customers can export and delete their own content in the Service.

6. Personal data breaches

Lattix will notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Content, with the information it has.

7. International transfers

Customer Content is processed in the United States. Where a transfer requires safeguards, the parties rely on the appropriate standard contractual clauses, which will be attached to the final version. A choice of EU data residency for organizations is planned.

8. Return and deletion

When the Service ends, the customer can export Customer Content. Lattix deletes it afterwards within the period stated in the final version, unless the law requires retention.

9. Audits

Lattix will make available the information needed to demonstrate compliance with this addendum, including its security documentation, and will allow reasonable audits on notice.