Data Processing Addendum

Roles

For customer data submitted to a workspace, the customer is generally the controller or business, and we act as a processor or service provider to provide the service. For account, billing, security, and operational data, we may act as an independent controller or business.

Processing details

Subject matter: operation of the LIT/AMS platform. Duration: the term of the customer relationship and any retention period. Nature and purpose: hosting, storage, workflow automation, reporting, support, security, backups, and service improvement.

Data categories may include account data, contact data, employee data, agent licensing data, prospect and customer information, sales records, service records, statement files, commission data, HR records, attendance records, training records, notes, documents, and technical logs.

Customer instructions

We process customer data according to the customer instructions reflected in the Terms, product configuration, user actions, and applicable order forms. Customers are responsible for the lawfulness of their data and instructions.

Security and confidentiality

We will use reasonable safeguards designed to protect customer data and require personnel with access to customer data to handle it confidentially.

Subprocessors

We may use subprocessors to provide hosting, infrastructure, email, payment, support, security, analytics, and related services. The Subprocessor List identifies expected categories and vendors.

Deletion, return, and assistance

Upon termination, customer data may be deleted, returned, exported, retained, or archived according to product functionality, backup practices, legal obligations, and legitimate business needs. We will provide reasonable assistance with data requests and security matters as required by applicable law.

HIPAA note

The service is not intended to create a HIPAA business associate relationship unless a separate written Business Associate Agreement is signed. Customers should not submit protected health information requiring HIPAA treatment unless an appropriate agreement is in place.