1. Subject and incorporation into the contract
This Data Processing Addendum (“DPA”) forms part of the Terms of service, order form or other agreement governing use of Lytheron Cloud and connected products (“Contract”). It applies when Lytheron OÜ (“Lytheron” or “processor”) processes personal data on behalf of the customer (“customer” or “controller”) under Regulation (EU) 2016/679 (“GDPR”).
By accepting the Contract or using the service to process personal data, the customer also accepts this DPA. If the parties sign a specific DPA, it prevails for matters expressly governed by it.
2. Roles of the parties
The customer determines the purposes and essential means of processing data entered into products and acts as controller or, when processing for its own client, as processor. Lytheron processes that data to provide the service and acts as processor or subprocessor.
Lytheron remains an independent controller for processing needed to manage accounts, security, the commercial relationship, payments, invoices, abuse prevention and legal compliance, as described in the Privacy notice.
3. Documented instructions
The customer instructs Lytheron to process personal data to deliver, maintain, protect and support the service, implement customer configurations, comply with the Contract and follow further documented instructions compatible with service functionality and law.
Unless prohibited by law, Lytheron informs the customer if it considers an instruction contrary to applicable law and may suspend its execution pending clarification.
4. Customer obligations
- Ensure that processing and instructions are lawful, fair and transparent.
- Provide required notices to individuals and obtain consent where necessary.
- Limit data to what is adequate and necessary for the purpose.
- Configure roles, access, forms, fields and retention periods appropriately.
- Do not use the service for unanticipated or high-risk data categories without written agreement.
- Respond to individuals and authorities, with Lytheron's assistance where applicable.
5. Lytheron obligations
Lytheron undertakes to:
- process data only on the customer's documented instructions, except where legally required;
- ensure authorised persons are bound by confidentiality;
- adopt technical and organisational measures proportionate to risk;
- comply with the conditions for engaging subprocessors;
- reasonably assist the customer with individuals' requests;
- assist with security, breaches, impact assessments and prior consultations, taking account of the processing's nature;
- delete or return data on termination, subject to legal obligations;
- make reasonable information available to demonstrate compliance with this DPA.
6. Confidentiality and access
Data access is restricted to personnel and collaborators who need it for authorised duties. They are bound by contractual or legal confidentiality obligations. Privileged access must be restricted, protected and used only for support, maintenance, security or legal obligations.
7. Technical and organisational measures
Current measures are described on the Security page and include, in relation to risks and service capabilities:
- access control based on identity, organisation and role;
- data isolation through application and database authorisation rules;
- traffic encryption using HTTPS/TLS;
- separate secret management and least privilege;
- validation, rate limits and protection of sensitive operations;
- logging and auditing of relevant operations;
- vulnerability and incident management procedures;
- backup and recovery capabilities offered by active infrastructure services.
Lytheron may update these measures provided it does not materially reduce the overall protection level during the relationship.
8. Subprocessors
The customer grants general authorisation to engage subprocessors needed to provide the service. The principal list and purposes are published on the Subprocessors page.
Lytheron imposes substantially equivalent protection obligations appropriate to each delegated function and remains responsible to the customer for fulfilling its own obligations under this DPA.
Where reasonably possible, material changes are published before actual use. The customer may raise a reasoned data-protection objection within fifteen days of publication or notification. The parties will cooperate to find a reasonable solution; if none is possible, either may terminate only the affected function under the Contract.
9. International transfers
Lytheron and subprocessors may process data outside the European Economic Area only using a valid instrument under applicable law, such as an adequacy decision, the Data Privacy Framework where applicable, standard contractual clauses or another recognised safeguard.
Where necessary, the European Commission's standard contractual clauses adopted by Decision 2021/914 apply in the configuration consistent with the parties' roles. On reasonable request, Lytheron provides information about applicable safeguards, subject to confidentiality and security obligations.
10. Individuals' requests
If Lytheron directly receives a request concerning data processed for a customer, it forwards it to that customer where identifiable and does not respond on the merits except on instructions, under legal obligations or to acknowledge receipt. Lytheron provides features and reasonable assistance for access, rectification, erasure, restriction, portability and objection.
11. Authorities, impact assessments and consultations
Taking account of the processing's nature and available information, Lytheron reasonably assists with authority requests, impact assessments and prior consultations. Exceptional activities requiring significant work may incur reasonable costs agreed in advance, except where needed to remedy a breach attributable to Lytheron.
12. Personal data breaches
Lytheron informs the customer without undue delay after establishing a breach of personal data processed on its behalf. To the extent available, the notification includes the incident's nature, affected data and individual categories, possible consequences, measures taken or proposed and a contact point.
Notification is not an admission of liability. The customer is responsible for assessing and meeting its notification obligations to authorities and individuals, with Lytheron's reasonable assistance.
13. Return and deletion
During the relationship, the customer may export data using available features. On termination, Lytheron deletes or returns personal data according to customer instructions and service capabilities, subject to retention obligations. Backup copies are removed under normal technical cycles, remain protected and are not used for other purposes.
14. Information, audits and checks
Lytheron makes reasonable documentation available on measures, providers and controls. The customer may request a check no more than once per year, except following an incident or authority request, with reasonable notice, a proportionate scope and confidentiality obligations.
The parties prioritise available documents, questionnaires and reports. An on-site audit or system access is allowed only where those tools are insufficient, does not compromise security or other customers' data, and is conducted by an independent, non-competing auditor. The customer bears costs unless a material breach by Lytheron is established.
15. Data processed for the customer
| Subject | Delivery of Lytheron Cloud and products activated by the customer. |
|---|---|
| Duration | The Contract's duration and the technical period needed for return, deletion and backups. |
| Nature | Collection, recording, organisation, storage, consultation, transmission, publication on instruction, restriction, export and deletion. |
| Purpose | Providing menus, cards, feedback, catalogues, forms, public pages, dashboards, collaboration and related functions. |
| Individuals | Customer employees, collaborators, clients, prospects, guests, visitors, contacts and end users. |
| Data categories | Identity, contacts, professional role, content, images, files, responses, requests, technical data and metadata configured by the customer. |
| Special-category data | Not intended for ordinary use. The customer must not enter it without a legal basis, necessity, appropriate measures and a specific agreement where required. |
16. Liability and precedence
Liability under this DPA is subject to the Contract's limits and exclusions to the extent permitted by law. In a data-protection conflict, this DPA prevails; for international transfer clauses, the applicable standard clauses prevail.
17. Governing law
This DPA follows the law and forum stated in the Contract, subject to mandatory data-protection rules and supervisory authorities' powers.
18. Contact
Send DPA requests to legal@lytheron.com.
Supabase infrastructure attestations
Supabase states that it holds ISO/IEC 27001:2022 certification and a SOC 2 Type 2 report within its own control scope. These attestations concern the provider; they do not certify Lytheron OÜ, application code, configuration or the complete Lytheron Cloud service. See Supabase Security. Access to the certificate and report is subject to provider terms. These attestations do not establish an uptime commitment, recovery time or exclusively European data residency for Lytheron Cloud.
Lytheron remains responsible for application controls and configurations within its remit. The provider DPA does not replace the DPA between Lytheron and its customer.
Contact and document version
For legal, privacy, security or contractual requests, write to legal@lytheron.com. The version published at this address applies from the date shown at the beginning, unless specific conditions are agreed in writing.