Data processing agreement

This data processing agreement applies between the customer, as controller, and Ulixes Consulting, as processor, for the personal data that the customer and its users put into Lisso. It is part of the terms of service. Terms defined there have the same meaning here.

1. Subject and duration

This agreement sets out how we process personal data on behalf of the customer when we provide Lisso. It applies for as long as we process such data for the customer, and therefore at least for the duration of the agreement under the terms of service.

2. Nature and purpose of the processing

We process personal data only to provide Lisso: helping the customer manage its suppliers and products, prepare orders, send them to its suppliers and keep their history. This includes storing, organising, displaying and sending the data, making backups, and supporting the customer.

3. Types of personal data

Users: name, email address, login and security data (password stored hashed, two-factor authentication and passkey data), preferences such as language.
Sessions: IP address and browser of active sessions.
Contact persons at suppliers: name, email address, phone number.
Orders: contents and history of orders, including the names of the users who created, changed, sent or confirmed them.

4. Categories of data subjects

The customer's staff and other users of Lisso.
Contact persons at the customer's suppliers.

5. Our obligations as processor

We:

process the personal data only on the customer's documented instructions, which are set out in the terms of service, this agreement and the customer's use of Lisso, unless the law requires otherwise; in that case we inform the customer first, unless the law forbids it;
tell the customer if we believe an instruction breaks the GDPR or other data protection law;
make sure that the people who have access to the personal data are bound by confidentiality;
take appropriate technical and organisational security measures (see section 8);
help the customer, as far as reasonably possible, to respond to requests from data subjects who exercise their rights;
help the customer with data protection impact assessments, prior consultations and the handling of personal data breaches, taking into account the nature of the processing and the information available to us;
notify the customer of a personal data breach without undue delay [and within ... hours] after becoming aware of it, with the information available at that moment.

6. Subprocessors

The customer gives a general authorisation for us to use subprocessors. The current list is on the subprocessors page.

We inform the customer in advance of any intended addition or replacement of a subprocessor. The customer can object to the change on reasonable grounds. If we cannot meet the objection, the customer can terminate the agreement before the change takes effect.

We impose the same data protection obligations on each subprocessor as in this agreement, and remain responsible towards the customer for their performance.

7. Transfers

We process the personal data in the European Union or the European Economic Area. We do not transfer personal data outside the EEA without appropriate safeguards as required by the GDPR.

8. Security measures

The following measures are in place:

all traffic to and from Lisso is encrypted with HTTPS (TLS);
passwords are stored hashed, never in a readable form;
users can turn on two-factor authentication and use passkeys;
the data of each location is strictly separated: this is enforced in the database itself and checked by automated tests;
access within Lisso is based on roles per location (owner, manager, employee);
access by Ulixes Consulting staff is limited to what is needed to operate and support the service;
the servers are hosted at Hetzner in [to be completed];
the database is backed up [backup frequency and retention to be set].

We may update these measures, as long as the level of security does not decrease.

9. Audits

On request, we provide the customer with the information needed to show that we comply with this agreement. The customer may have an audit carried out, at its own cost, with reasonable notice, during office hours and without unnecessarily disrupting our operations. The auditor is bound by confidentiality.

10. End of processing

At the end of the agreement, we delete or return the personal data, at the customer's choice, within [period], unless the law requires us to keep it.

11. Liability

Liability under this agreement is subject to the liability section of the terms of service.

A signed PDF version of this agreement is available on request. Write to [to be completed].