This Data Processing Addendum (“DPA”) forms part of the applicable agreement between LMTE Group LLC d/b/a Protocol Studio (“Processor”) and the business client identified in an Order Form (“Client” or “Controller”). It applies only when Processor processes Personal Data on Client’s documented instructions in connection with the Services. It does not authorize processing of PHI; a separate written Business Associate Agreement is required before any PHI is processed.
1. Roles and instructions
Client is the controller/business and Processor is the processor/service provider for Client Personal Data, to the extent those roles apply under privacy law. Processor will process Client Personal Data only to provide, secure, support, and improve the Services; comply with Client’s documented lawful instructions; comply with applicable law; and as otherwise permitted by the underlying agreement. Client instructs Processor to process Client Personal Data for those purposes during the term of the Services.
2. Client obligations
Client is responsible for determining that its instructions are lawful; providing required privacy notices; establishing a lawful basis; obtaining necessary consents; honoring applicable data-subject requests; and ensuring that Client Personal Data is accurate and appropriately minimized. Client will not instruct Processor to process sensitive or regulated information, including PHI, unless the parties have separately agreed in writing and Processor has confirmed appropriate capability and safeguards.
3. Confidentiality and security
Processor will ensure that personnel authorized to process Client Personal Data are bound by confidentiality obligations and will implement reasonable administrative, technical, and organizational measures appropriate to the nature of the processing and Services. Client acknowledges that no security measure eliminates all risk. Processor may use Client-approved or commercially reasonable service providers to deliver the Services.
4. Subprocessors
Client authorizes Processor to use subprocessors that provide hosting, storage, CRM, analytics, communications, automation, payment, advertising, security, professional, and support services necessary to deliver the Services. Processor will require subprocessors to protect Client Personal Data through written obligations appropriate to their role. Client remains responsible for accounts, vendors, and integrations it independently selects or controls.
5. Assistance and incidents
Taking into account the nature of processing, Processor will reasonably assist Client with privacy requests and compliance obligations to the extent required by law and reasonably feasible. Processor will notify Client without undue delay after confirming a security incident involving unauthorized access to Client Personal Data in Processor’s systems, and will provide information reasonably available to support Client’s legal obligations. Processor’s notice of an incident is not an admission of fault.
6. Return and deletion
Upon termination and Client’s written request, Processor will reasonably return or delete Client Personal Data in its active systems, unless retention is required by law, needed to resolve a dispute, or retained in routine backups until overwritten under normal backup cycles. Client is responsible for exporting Client Data from Client-controlled platforms before access ends.
7. Processing details
- Subject matter: business marketing, analytics, CRM, automation, reporting, and related professional services in the applicable Order Form.
- Duration: the term of the applicable Services plus any permitted retention period.
- Nature and purpose: collection, access, organization, analysis, transmission, configuration, support, and reporting as necessary to provide Services under Client’s instructions.
- Categories of data subjects: Client personnel, prospects, leads, customers, vendors, website visitors, and other individuals whose data Client lawfully provides.
- Categories of Personal Data: business contact information, communications, website or campaign activity, CRM and marketing records, and other data Client instructs Processor to process. Excludes PHI unless a separate BAA states otherwise.
8. Priority and liability
If this DPA conflicts with the underlying agreement regarding privacy processing, this DPA controls only for that conflict. The liability limitations and other limitations in the underlying agreement apply to this DPA to the maximum extent permitted by law.