Data Processing Agreement

This Data Processing Agreement ("DPA") is between the business that uses Lynna (the "Customer", as controller) and Lynna Labs Ltd, a company registered in England and Wales (company number 17168299), whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("Lynna", as processor). It forms part of the Lynna Terms of Service and is accepted when the Customer accepts those terms.

It applies to personal data that Lynna processes on the Customer's behalf when providing the service, as required by Article 28 of the UK GDPR. Where the EU GDPR also applies, references to the UK GDPR include it.

• Subject matter: Providing an AI assistant on the Customer's website and hosted page, and the Questions inbox.
• Duration: Until the Customer's workspace is deleted, as described in section 10.
• Nature and purpose: Storing knowledge the Customer adds, answering visitors' questions from it, recording conversations, passing unanswered questions to the Customer's team, and emailing answers to visitors who ask for them.
• Data subjects: Visitors to the Customer's website and hosted page, and any individuals named in knowledge the Customer adds.
• Personal data: Conversation messages, the page viewed, a random visitor ID, answer ratings and, where a visitor chooses to leave them with consent, their name, email address and phone number; plus any personal data the Customer includes in its knowledge.
• Special category data: Not intended. The Customer should not add it to knowledge, and the assistant does not ask visitors for it.

Lynna will:

• Process the personal data only on the Customer's documented instructions, which are these terms and the Customer's use and configuration of the service, unless the law requires otherwise, in which case it will tell the Customer first unless the law forbids that.
• Tell the Customer if it believes an instruction breaks data protection law.
• Make sure everyone authorised to process the data is bound by confidentiality.
• Apply the security measures in section 6.
• Not use the data for any other purpose, sell it, or use it, or allow its AI providers to use it, to train AI models.

• Have a lawful basis for the processing and give visitors a privacy notice that covers the assistant. A link to it can be shown in the assistant's AI disclosure.
• Only add knowledge it is entitled to use, and remove other people's personal data from documents before uploading them unless it has a lawful basis to include it.
• Choose a conversation retention period that suits its purposes, and handle requests from visitors.

The Customer authorises Lynna to use the sub-processors listed on our Sub-processors page (/sub-processors). Lynna has a written agreement with each that gives at least the same protection as this DPA, and remains responsible for their performance.

Lynna will give at least 30 days' notice by email before adding or replacing a sub-processor that handles the Customer's personal data. If the Customer objects on reasonable data protection grounds and we cannot resolve the objection, the Customer may cancel and receive a pro rata refund of prepaid fees for the rest of the period.

Lynna maintains appropriate technical and organisational measures, including:

• Encryption in transit (TLS) and at rest.
• Strict separation of each business's data, with access checked on the server for every request.
• Short-lived cloud credentials and least-privilege access for every component; no long-lived production keys.
• Embedding restricted to the websites the Customer allows.
• Rate limiting, with IP addresses stored only as one-way hashes.
• Error monitoring that removes message content, email addresses and phone numbers.
• Production access limited to authorised staff, with administrative actions logged.

Data is stored in the UK (London). Answers are generated in the European Union, which the UK recognises as adequate, with zero data retention by the model provider. Where a sub-processor transfers data to a country without adequacy, Lynna ensures an appropriate safeguard is in place, such as the UK International Data Transfer Addendum or the UK-US data bridge.

Lynna will help the Customer meet its obligations, taking into account the nature of the processing. The service includes tools for this: exporting conversations, erasing a visitor's data by email address, deleting individual conversations and setting retention. Lynna will pass on any request it receives directly from a visitor, and will provide reasonable help with data protection impact assessments and consultations with the ICO.

Lynna will notify the Customer without undue delay, and aims to do so within 24 hours, after becoming aware of a personal data breach affecting the Customer's data. The notice will include what is known about the nature of the breach, the data and people affected, the likely consequences and the steps taken, and will be updated as more is learned.

Deleting the workspace from Settings deletes the Customer's personal data straight away. When the agreement ends without that, the Customer can delete the workspace at any time, or ask us at the address below and we will delete it within 30 days, unless the law requires the data to be kept. The Customer can export its conversations first.

Lynna will make available the information reasonably needed to show compliance with this DPA, by answering security and data protection questionnaires. Customers on the Scale plan may also carry out, or appoint an independent auditor to carry out, a reasonable audit once a year on 30 days' notice, at their own cost and subject to confidentiality.

The limits of liability in the Terms of Service apply to this DPA. If this DPA conflicts with the Terms of Service about the processing of personal data, this DPA takes precedence.

Questions about this DPA: hello@lynnalabs.com, or Lynna Labs Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.