Snapshot 112444
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Lob Data Processing Agreement
This Data Processing Addendum (“DPA“) forms part of, and is subject to, the Terms of Service, Primary Services Agreement, or
other written or electronic terms of service or subscription agreement between Lob.com, Inc. (“Lob“) and the legal entity
defined as ‘Customer’ thereunder (for purposes of this DPA, “Customer”, and together with Lob, the “Parties“) (such
agreement, the “Agreement“). All capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement.
1. Definitions.
“Account” means Customer’s account in the Service in which Customer stores and processes Customer Data.
“California Consumer Privacy Act“ or “CCPA“ means the California Consumer Privacy Act of 2018, as may be amended from
time to time.
“Customer Data” has the meaning set forth in the Agreement.
“Customer Personal Data” means any Customer Data that is Personal Data.
“Data Controller” means an entity that determines the purposes and means of the Processing of Personal Data.
“Data Processor” means an entity that Processes Personal Data on behalf of a Data Controller.
“Data Protection Laws” means all data protection and privacy laws applicable to the respective party in its role in the
Processing of Personal Data under the Agreement, including, where applicable, EU & UK Data Protection Law and the CCPA.
“Data Subject” means the identified or identifiable natural person to whom Customer Personal Data relates.
“EU & UK Data Protection Law” means (i) Regulation 2016/679 of the European Parliament and of the Council on the
protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General
Data Protection Regulation) (“GDPR“); and (ii) the GDPR as it forms part of United Kingdom law pursuant to Section 3 of the
European Union (Withdrawal) Act 2018 (“UK GDPR“) and the Data Protection Act 2018.
“Personal Data” means any information, including opinions, relating to an identified or identifiable natural person and includes
similarly defined terms in Data Protection Laws, including, but not limited to, the definition of “personal information” in the
CCPA.
“Processing” shall mean any operation or set of operations which is performed on Personal Data or on sets of Personal Data,
whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination and “Process“, “Processes” and “Processed” will be
interpreted accordingly.
“Purposes“ shall mean (i) Lob’s provision of the Services as described in the Agreement, including Processing initiated by Users
in their use of the Services; and (ii) further documented, reasonable instructions from Customer agreed upon by the Parties.
“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized
disclosure of or access to Customer Personal Data.
“Services” means the generally available Lob software-as-a-service offering described in the Documentation and procured by
Customer, and any other services provided by Lob as described under the Agreement, including but not limited to support and
technical services.
Lob - DPA (September 2025)
1
“SCCs“ means the standard contractual clauses for the transfer of personal data to third countries approved pursuant to
Commission Decision (EU) 2021/914 of 4 June 2021, found at ec.europa.eu/info/law/law-topic/data-protection/international-
dimension-data-protection/standard-contractual-clauses-scc_en.
“Sub-Processor” means any other Data Processors engaged by Lob to Process Customer Personal Data.
2. Scope and Applicability of this DPA. This DPA applies where and only to the extent that Lob Processes Customer Personal
Data on behalf of Customer as Data Processor in the course of providing the Services.
3. Roles and Scope of Processing.
3.1. Role of the Parties. As between Lob and Customer, Lob shall Process Customer Personal Data only as a Data Processor (or
sub-processor) acting on behalf of Customer and, with respect to CCPA, as a “service provider” as defined therein, in each case
regardless of whether Customer acts as a Data Controller or as a Data Processor on behalf of a third-party Data Controller
(“Third-Party Controller“) with respect to Customer Personal Data. To the extent any usage data is considered Personal Data
under applicable Data Protection Laws, Lob is the Data Controller of such data and shall Process such data in accordance with
the Agreement and applicable Data Protection Laws. Lob, in its role as a Data Processor, shall only Process Customer Personal
Data as required to provide the Services under the Agreement or as otherwise permitted under applicable Data Protection
Laws. Lob does not sell Customer Personal Data, or disclose Customer Personal Data other than to provide the Services under
the Agreement. The exchange of personal information is not part of the consideration between the parties.
3.2. Customer Instructions. Lob will Process Customer Personal Data only for the Purposes. Customer shall ensure its
Processing instructions are lawful and that the Processing of Customer Personal Data in accordance with such instructions will
not violate applicable Data Protection Laws. The Parties agree that the Agreement (including this DPA) sets out the exclusive
and final instructions to Lob for all Processing of Customer Personal Data, and (if applicable) include and are consistent with all
instructions from Third-Party Controllers. Any additional requested instructions requires the prior written agreement of Lob.
Lob shall promptly notify Customer if, in Lob’s opinion, such an instruction violates EU & UK Data Protection Law. Where
applicable, Customer shall be responsible for any communications, notifications, assistance and/or authorizations that may be
required in connection with a Third-Party Controller
3.3. Customer Processing of Personal Data. Customer agrees that it: (i) will comply with its obligations under Data Protection
Laws with respect to its Processing of Customer Personal Data; (ii) will make appropriate use of the Services to ensure a level of
security appropriate to the particular content of the Customer Personal Data, such as pseudonymizing and backing-up
Customer Personal Data; and (iii) has obtained all consents, permissions and rights necessary under Data Protection Laws for
Lob to lawfully Process Customer Personal Data for the Purposes, including, without limitation, Customer’s sharing and/or
receiving of Customer Personal Data with third-parties via the Services.
3.4. Details of Data Processing.
(a) Subject Matter: The subject matter of the Processing under this DPA is the Customer Personal Data.
(b) Frequency and duration: Notwithstanding expiry or termination of the Agreement, Lob will Process the Customer Personal
Data continuously and until deletion of all Customer Personal Data as described in this DPA.
(c) Purpose: Lob will Process the Customer Personal Data for the Purposes, as described in this DPA.
(d) Nature of the Processing: Lob will perform Processing as needed for the Purposes, and to comply with Customer’s
Processing instructions as provided in accordance with the Agreement and this DPA.
(e) Retention Period. The period for which Customer Personal Data will be retained and the criteria used to determine that
period shall be determined by Customer during the term of the Agreement via its use and configuration of the Service. Upon
termination or expiration of the Agreement, Customer may retrieve or delete all Customer Personal Data as set forth in the
Agreement. Any Customer Personal Data not deleted by Customer shall be deleted by Lob promptly upon the later of (i) 30 days
after the expiration or termination of the Agreement and (ii) expiration of any post-termination “retrieval period” set forth in
the Agreement.
Lob - DPA (September 2025)
2
(f) Categories of Data Subjects: The categories of Data Subjects to which Customer Personal Data relate are determined and
controlled by Customer in its sole discretion, and may include, but are not limited to:
(i) Prospects, customers, business partners and vendors of Customer (who are natural persons);
(ii) Employees or contact persons of Customer’s prospects, customers, business partners and vendors; and/or
(iii) Employees, agents, advisors, freelancers of Customer (who are natural persons).
(g) Categories of Personal Data: The types of Customer Personal Data are determined and controlled by Customer in its sole
discretion, and may include, but are not limited to:
(i) Identification and contact data (name, address, title, contact details);
(ii) Financial information (credit card details, account details, payment information);
(iii) Employment details (employer, job title, geographic location, area of responsibility); and/or
(iv) IT information (IP addresses, cookies data, location data).
(h) Special Categories of Personal Data (if applicable): Subject to any applicable restrictions and/or conditions in the
Agreement or Documentation, Customer may also include “special categories of personal data” or similarly sensitive Personal
Data (as described or defined in Data Protection Laws) in Customer Personal Data, the extent of which is determined and
controlled by Customer in its sole discretion, and which may include, but is not limited to Customer Personal Data revealing
racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric
data Processed for the purposes of uniquely identifying a natural person, data concerning health and/or data concerning a
natural person’s sex life or sexual orientation.
4. Sub-Processing.
4.1. Authorized Sub-Processors. Customer provides Lob with a general authorization to engage Sub-processors as of the
effective date of this DPA.
4.2. Sub-Processor Obligations. Lob shall: (i) enter into a written agreement with each Sub-processor imposing data protection
obligations no less protective of Customer Personal Data as Lob’s obligations under this DPA to the extent applicable to the
nature of the services provided by such Sub-processor; and (ii) remain liable for each Sub-processor’s compliance with the
obligations under this DPA. Upon written request, and subject to any confidentiality restrictions, Lob shall provide Customer all
relevant information it reasonably can in connection with its applicable Sub-processor agreements where required to satisfy
Customer’s obligations under Data Protection Laws.
5. Security.
5.1. Security Measures. Lob shall implement and maintain appropriate technical and organizational security measures designed
to protect Customer Personal Data from Security Incidents and to preserve the security and confidentiality of the Customer
Personal Data in accordance with Lob’s Trust & Security page found at https://www.lob.com/security (“Security Page”). Lob
may review and update its Security Page from time to time, provided that any such updates shall not materially diminish the
overall security of the Services or Customer Personal Data.
5.2. Confidentiality of Processing. Lob shall ensure that any person who is authorized by Lob to Process Customer Personal
Data (including its staff, agents and subcontractors) shall be under an appropriate obligation of confidentiality (whether a
contractual or statutory duty).
5.3. No Assessment of Customer Personal Data by Lob. Lob shall have no obligation to assess the contents or accuracy of
Customer Personal Data, including to identify information subject to any specific legal, regulatory, or other requirement.
Customer is responsible for reviewing the information made available by Lob relating to data security and making an
independent determination as to whether the Services meet Customer’s requirements and legal obligations under Data
Protection Laws.
Lob - DPA (September 2025)
3
6. Customer Audit Rights.
6.1. Upon written request and at no additional cost to Customer, Lob shall provide Customer, and/or its appropriately qualified
third-party representative (collectively, the “Auditor“), access to reasonably requested documentation evidencing Lob’s
compliance with its obligations under this DPA in the form of the relevant audits or certifications listed in the Security Page
(collectively, “Reports”).
7. Data Transfers.
7.1. Transfer Mechanisms. For any transfers by Customer of Customer Personal Data from the European Economic Area and its
member states, United Kingdom and/or Switzerland (collectively, “Restricted Countries”) to Lob in a country which does not
ensure an adequate level of protection (within the meaning of and to the extent governed by the applicable Data Protection
Laws of the Restricted Countries) (collectively, “Third Country”), such transfers shall be governed by a valid mechanism for the
lawful transfer of Customer Personal Data recognized under applicable Data Protection Laws, such as those directly below in
7.1.1. For clarity, for transfers from the United Kingdom and Switzerland, references in the SCCs shall be interpreted to include
applicable terminology for those jurisdictions (e.g., “Member State” shall be interpreted to mean “United Kingdom” for
transfers from the United Kingdom).
7.1.1. SCCs. Each party agrees to abide by and transfer Customer Personal Data from the Restricted Countries in accordance
with the SCCs, which are incorporated into this DPA by reference. Each party is deemed to have executed the SCCs by entering
into this DPA.
(a) The below shall apply to the SCCs, including the election of specific terms and/or optional clauses as described in more detail
in (i)-(x) below, and any optional clauses not expressly selected are not included:
(i) The Module 2 terms apply to the extent Customer is a Data Controller and the Module 3 terms apply to the extent Customer
is a Data Processor of the Customer Personal Data;
(ii) For purposes of Clause 9 of the SCCs, Option 2 (“General written authorization”) is selected and the process and time period
for the addition or replacement of Sub-processors shall be as described in Section 4 (Sub-processing) of this DPA;
(iii) For purposes of Clause 13 and Annex 1.C of the SCCs, Customer shall maintain accurate records of the applicable Member
State(s) and competent supervisory authority, which shall be made available to Lob on request;
(iv) For purposes of Clause 17 and Clause 18 of the SCCs, the Member State for purposes of governing law and jurisdiction shall
be the Netherlands;
(v) For purposes of Annex 1.A, the “data importer” shall be Lob and the “data exporter” shall be Customer;
(vi) For purposes of Annex 1.B, the description of the transfer is as described in Section 3.5 (Details of Data Processing) of this
DPA;
(vii) For purposes of Annex 2, the technical and organization measures are as follows: (i) Those measures implemented by Lob
shall be as described in Section 5.1 (Security Measures) of this DPA; and
(viii) The Sub-processors for Annex III shall be as described in Section 4.1 (Authorized Sub-processors) of this DPA.
8. Security Incident Response.
8.1. Security Incident Reporting. If Lob becomes aware of a Security Incident, Lob shall notify Customer without undue delay,
and in any case, where feasible, notify Customer within seventy-two (72) business hours after becoming aware of an incident
involving Customer’s PII, but not before verifying such, to prevent unnecessary alarm. Lob’s notification shall be sent to the
Lob - DPA (September 2025)
4
email registered by Customer within the Service for such purposes, and where no such email is registered, Customer
acknowledges that the means of notification shall be at Lob’s reasonable discretion and Lob’s ability to timely notify shall be
negatively impacted. Lob shall promptly take reasonable steps to contain, investigate, and mitigate any Security Incident.
8.2. Security Incident Communications. Lob shall provide Customer timely information about the Security Incident, including,
but not limited to, the nature and consequences of the Security Incident, the measures taken and/or proposed by Lob to
mitigate or contain the Security Incident, the status of Lob’s investigation, a contact point from which additional information
may be obtained, and the categories and approximate number of data records concerned. Communications by or on behalf of
Lob with Customer in connection with a Security Incident shall not be construed as an acknowledgment by Lob of any fault or
liability with respect to the Security Incident.
9. Cooperation.
9.1. Data Subject Requests. Lob shall promptly notify Customer if Lob receives a request from a Data Subject that identifies
Customer Personal Data or otherwise identifies Customer, including where the Data Subject seeks to exercise any of its rights
under applicable Data Protection Laws (collectively, “Data Subject Request”). The Service provides Customer with a number of
controls that Customer may use to assist it in responding to Data Subject Requests and Customer will be responsible for
responding to any such Data Subject Requests. To the extent Customer is unable to access the relevant Customer Personal Data
within the Services using such controls or otherwise, Lob shall (upon Customer’s written request and taking into account the
nature of the Processing) provide commercially reasonable cooperation to assist Customer in responding to Data Subject
Requests.
9.2. Data Protection Impact Assessments. Lob shall provide reasonably requested information regarding the Services to enable
Customer to carry out data protection impact assessments or prior consultations with data protection authorities as required
by Data Protection Laws, so long as Customer does not otherwise have access to the relevant information.
9.3. Government, Law Enforcement, and/or Third Party Inquiries. If Lob receives a demand to retain, disclose, or otherwise
Process Customer Personal Data for any third party, including, but not limited to law enforcement or a government authority
(“Third-Party Demand”), then Lob shall attempt to redirect the Third-Party Demand to Customer. Customer agrees that Lob can
provide information to such third-party as reasonably necessary to redirect the Third-Party Demand. If Lob cannot redirect the
Third-Party Demand to Customer, then Lob shall, to the extent legally permitted to do so, provide Customer reasonable notice
of the Third-Party Demand as promptly as feasible under the circumstances to allow Customer to seek a protective order or
other appropriate remedy. This section does not diminish Lob’s obligations under the SCCs with respect to access by public
authorities.
10. Relationship with the Agreement.
10.1. The Parties agree that this DPA shall replace and supersede any existing data processing addendum, attachment, exhibit
or standard contractual clauses that Lob and Customer may have previously entered into in connection with the Services. Lob
may update this DPA from time to time; provided, however, that no such update shall materially diminish the privacy or
security of Customer Personal Data.
10.2. Except as provided by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict
between this DPA and the Agreement, this DPA shall prevail to the extent of that conflict in connection with the Processing of
Customer Personal Data. Notwithstanding the foregoing, and solely to the extent applicable to any Customer Personal Data
comprised of patient, medical or other protected health information regulated by HIPAA or any similar U.S. federal or state
health care laws, rules or regulations (“HIPAA Data”), if there is any conflict between this DPA and a business associate
agreement between Customer and Lob (“BAA”), then the BAA shall prevail solely with respect to such HIPAA Data.
10.3. Notwithstanding anything to the contrary in the Agreement or this DPA, each party’s and all of its affiliates’ liability, taken
together in the aggregate, arising out of or relating to this DPA, the SCCs, and any other data protection agreements in
Lob - DPA (September 2025)
5
connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement.
Without limiting the Parties’ obligations under the Agreement, each party agrees that any regulatory penalties incurred by one
party (the “Incurring Party”) in relation to the Customer Personal Data that arise as a result of, or in connection with, the other
party’s failure to comply with its obligations under this DPA or any applicable Data Protection Laws shall count toward and
reduce the Incurring Party’s liability under the Agreement as if it were liability to the other party under the Agreement.
10.4. In no event shall this DPA benefit or create any right or cause of action on behalf of a third party (including a Third-Party
Controller), but without prejudice to the rights or remedies available to Data Subjects under Data Protection Laws or this DPA
(including the SCCs).
10.5. This DPA will be governed by and construed in accordance with governing law and jurisdiction provisions in the
Agreement.
THIS DPA IS EXECUTED BY THE PARTIES AUTHORIZED REPRESENTATIVE AS OF THE DATE OF THE LAST SIGNATURE BELOW.
Lob.com, Inc. Customer:
2261 Market Street STE 5668
San Francisco, CA 94114
________________________________ ________________________________
Signature Signature
Printed Name: Printed Name:
Title: Title:
Date: Date:
Lob - DPA (September 2025)
6