Data Processing Addendum

This Data Processing Addendum (DPA) supplements the Terms of Service between Lasques, Inc. and a customer where Lasques processes personal data in Customer Content on that customer's behalf and applicable law requires processor terms. It does not cover information Lasques controls for its own account, billing, security, or legal-administration purposes, which is addressed in the Privacy Policy.

1. Roles and scope

The customer determines the purposes and lawful basis for personal data it submits in workspace content and acts as controller, or as a processor authorized by its own controller. Lasques acts as processor or subprocessor for that content. The customer must have the rights, notices, permissions, and instructions needed to provide the content and use the Services.

The processing lasts for the provision of the Services and applicable deletion or legally required retention periods. It includes hosting, organizing, retrieving, searching, embedding, transmitting, analyzing, executing authorized research workflows, generating outputs, and deleting data as needed for the customer's use.

2. Processing details

Data subjects can include the customer's authorized users, collaborators, research participants whose data is lawfully included, and people identified in customer-supplied content. Data can include names, contact details, membership and attribution details, and personal data contained in documents, datasets, prompts, code, or research outputs.

The customer must not submit prohibited sensitive information, protected health information, or data outside the permitted scope in the Terms without an express written agreement. The Services are not a blanket authorization to process special-category data or regulated research data.

3. Documented instructions and confidentiality

Lasques will process covered personal data on the customer's documented instructions, including the customer's configuration and authorized use of the Services, unless law requires otherwise. Lasques will inform the customer of a legally required departure where permitted and notify the customer if an instruction appears to violate applicable data protection law.

Persons authorized to process covered data must be subject to appropriate confidentiality obligations. Access is limited to authorized service, support, security, and legal purposes.

4. Security and incidents

Lasques will maintain measures appropriate to the processing risk, including relevant access controls, tenant authorization, credential protection, and the isolation and storage arrangements used to operate the Services. No provision asserts an unverified certification or an absolute security guarantee.

Lasques will notify the customer without undue delay after becoming aware of a personal-data breach affecting covered data, provide available relevant information, and cooperate with reasonable mitigation and legally required notification efforts. Initial information may be supplemented as the investigation progresses.

5. Subprocessors

The customer authorizes use of the providers described in the Subprocessors list as needed for enabled features. Lasques will impose appropriate data protection obligations on subprocessors handling covered data and remains responsible for their processing to the extent required by applicable law.

Lasques will provide notice of intended additions or replacements and an opportunity to raise reasonable data-protection objections before the new processing where applicable law requires it. The parties will seek a reasonable resolution; if none is available, the affected processing must not continue on an unlawful basis.

6. Assistance and accountability

Taking account of the nature of processing and available information, Lasques will reasonably assist the customer with data-subject requests, security obligations, breach response, impact assessments, and required consultations. Lasques will direct requests concerning customer-controlled data to the customer where appropriate and will not independently disclose that data except on instruction or as law requires.

Lasques will make available information reasonably needed to demonstrate compliance and permit proportionate audits or inspections required by applicable law, with safeguards for other customers' data, security, confidentiality, and unnecessary disruption. Any separately agreed audit arrangements must not remove mandatory rights.

7. International transfers

Covered transfers must comply with applicable transfer law. The parties will put in place an applicable lawful safeguard where required before processing on that basis. This DPA does not assert that an unspecified transfer instrument has been executed, that a provider is certified under a particular framework, or that data stays in a particular country. Contact [email protected] for the processing and transfer details relevant to the proposed use.

8. Return and deletion

At the end of the covered Services, Lasques will return or delete covered personal data at the customer's choice as applicable law requires, subject to lawful retention requirements and the applicable backup-deletion lifecycle. Public licenses and research-provenance records do not override mandatory personal-data rights.

The customer must export material it needs and resolve ownership and access requirements before closing a workspace. Lasques will communicate any legally required retention that prevents immediate deletion where permitted.

9. Order of precedence and contact

For its data-processing subject matter, this DPA takes precedence as stated in the Terms, subject to any applicable signed agreement and mandatory transfer terms. It does not authorize unlawful instructions or override mandatory data protection rights. Contact [email protected] about customer processing, subprocessors, or rights requests.