Snapshot 92836
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Addendum
This Data Processing Addendum (“DPA”) is an addendum to the Agreement entered into between Customer and
Lightedge. Any capitalized terms used but not defined in this DPA shall have the meanings set out in the
Agreement.
RECITALS
WHEREAS, under the Agreement, Lightedge may be required to process Personal Data provided and/ or
collected by Customer; and
WHEREAS, this DPA addresses each Party’s compliance obligations under Applicable Data Protection
Law, and applies solely where the provision of Services by Lightedge to Customer involves the Processing of
Customer Personal Data subject to Applicable Data Protection Law;
NOW, THEREFORE, in consideration of the mutual covenants and agreements hereinafter set forth and for other
good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties
hereto agree as follows:
1. Definitions.
“Business Purpose” means the services described in the Agreement between Customer and Lightedge or any
other specifically identified in Appendix A.
“Data Subject” means an individual who is the subject of Personal Data.
“GDPR” means REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April
2016 on the protection of natural persons with regard to the processing of personal data and on the free
movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
“Personal Data” means any information Lightedge processes for the Customer that (a) identifies or relates to an
individual who can be identified directly or indirectly from that data alone or in combination with other
information in Lightedge's possession or control or that Lightedge is likely to have access to, or (b) the relevant
Applicable Data Protection Law otherwise define as protected personal information.
“Processing, processes, or process” means any activity that involves the use of Personal Data or that the
relevant Applicable Data Protection Law may otherwise include in the definition of processing, processes, or
process. It includes obtaining, recording, or holding the data, or carrying out any operation or set of operations
on the data including, but not limited to, organizing, amending, retrieving, using, disclosing, erasing, or
destroying it. Processing also includes transferring Personal Data to third parties.
“Applicable Data Protection Law” means (i) all applicable federal, and state laws and regulations relating to the
processing, protection, or privacy of the Personal Data and (ii) the GDPR.
“Security Breach” means a breach of security arising at Lightedge’s level and leading to the accidental or
unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored
or otherwise processed.
“Standard Contractual Clauses (SCC)” means the European Commission's standard contractual clauses for the
transfer of personal data from the European Union to third countries (Module Two, when Customer is the
controller and Lightedge is the processor, and Module Three when Customer is the processor and Lightedge is
the sub-processor), as set out in the Annex to Commission Decision (EU) 2021/914, a completed copy of which
comprises Appendix B.
Data Processing Addendum Lightedge Solutions, LLC
v2 – 15 May 2025
2. Personal Data Types and Processing Purposes. The Customer retains control of the Personal Data and
remains responsible for its compliance obligations under the Applicable Data Protection Law, including:
- providing any required notices,
- obtaining any required consents, and
- for the processing instructions it gives to Lightedge.
3. Lightedge's Obligations.
3.1. Lightedge will only process, retain, use, or disclose the Personal Data to the extent, and in such a
manner, as is necessary for the Business Purposes in accordance with the Customer's instructions. Lightedge
will not process, retain, use, or disclose the Personal Data for any other purpose or in a way that does not
comply with this DPA or the Applicable Data Protection Law.
3.2. Lightedge must comply with any Customer request or instruction, subject to additional fees payable
by Customer to Lightedge for carrying out such request or instruction if outside of the Services scope,
requiring Lightedge to amend, transfer, or delete the Personal Data, or to stop, mitigate, or remedy any
unauthorized processing.
3.3. Lightedge will maintain the confidentiality of all Personal Data, will not sell it to anyone, and will not
disclose it to third parties unless the Customer or this DPA specifically authorizes the disclosure, or as
required by law. If a law requires Lightedge to process or disclose Personal Data, Lightedge must first inform
the Customer of the legal requirement and give the Customer an opportunity to object or challenge the
requirement, unless the law prohibits such notice.
3.4. The Customer acknowledges that Lightedge is under no duty to investigate the completeness,
accuracy, or sufficiency of any specific Customer instructions or the Personal Data other than as required
under the Applicable Data Protection Law.
3.5. Lightedge will limit Personal Data access to those employees who require Personal Data access to
conduct the Business Purpose; and the part or parts of the Personal Data that those employees strictly
require for the performance of their duties. LighEdge will ensure that all employees are informed of the
Personal Data's confidential nature and have undertaken training on the Applicable Data Protection Law
relating to handling Personal Data and how it applies to their particular duties.
4. Security.
4.1. Customer remains the primary system and account administrator and is responsible for the integrity,
security, maintenance and appropriate protection of Customer Personal Data including by: (i) properly
selecting, purchasing, and configuring the appropriate Services; (ii) implementing adequate controls to
maintain appropriate security, protection and deletion of Customer Personal Data; and (iii) ensuring that
Lightedge is not provided with any access to Customer Personal Data, except as otherwise set out in the
Agreement.
4.2. Taking into account the state of the art, the costs of implementation and the nature, scope, context
and purposes of processing, Lightedge shall implement appropriate technical and organizational measures
designed to safeguard Personal Data against unauthorized or unlawful destruction, loss or disclosure.
5. Security Breaches.
5.1. Lightedge will notify the Customer of a Security Breach that is determined to affect Customer’s
Personal Data without undue delay. Following a Security Breach, the parties will co-ordinate with each other
2
to investigate the matter. Lightedge shall further take such any reasonably necessary measures and actions
to remedy or mitigate the effects of the Security Breach and shall keep Customer informed of material
developments in connection with the Security Breach. Lightedge’s obligations under this sub-section 5.1
shall be limited to the extent consistent with the functionality of the Services and Lightedge's role as
processor, the monitoring and security Services purchased by Customer, and the parties’ respective security
obligations under the Agreement. Lightedge shall be under no obligation to notify routine security alerts
(including without limitation, pings on a firewall or edge servers, port scans, unauthorized vulnerability
scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing or other unauthorized access
to traffic data that does not result in access beyond IP addresses or headers, or similar incidents) save as
otherwise specifically set out in the Agreement. Lightedge’s remediation and mitigation obligations shall be
limited to Security Breaches arising out of breach by Lightedge of its security obligations set out in the
Agreement and Lightedge’s assistance shall be at the Customer’s expense save where the confirmed
Security Breach is caused by breach of Lightedge of its security obligations set out in the Agreement.
5.2. Lightedge will not inform any third party of a Security Breach without first obtaining the Customer's
prior written consent, except when law or regulation requires it. Lightedge agrees that the Customer has the
sole right to determine: (i) whether to provide notice of the Security Breach to any Data Subjects, regulators,
law enforcement agencies, or others, as required by law or regulation or in the Customer's discretion,
including the contents and (ii) delivery method of the notice; and whether to offer any type of remedy to
affected Data Subjects, including the nature and extent of such remedy.
6. Cross-Border Transfers of Personal Data.
6.1. If any Personal Data transfer between Lightedge and the Customer requires execution of Standard
Contractual Clauses in order to comply with the Applicable Data Protection Law, Customer shall notify
Lightedge and the Standard Contractual Clauses parties will complete all relevant details in, and execute,
the Standard Contractual Clauses contained in Appendix B, and take all other actions required to legitimize
the transfer.
7. Sub-processors.
7.1. Lightedge may use sub-processors to fulfill its obligations under the Agreement. Customer consents
to sub-processors listed in https://go.lightedge.com/legal/privacy/subprocessors. Any sub-processor will be
permitted to process Personal Data only to deliver the Services Lightedge has retained them to provide.
Lightedge shall impose contractual obligations on its sub-processors (including regarding confidentiality,
data protection and data security) as required by Applicable Data Protection Law. Lightedge shall impose
written data protection terms on any sub-processor (which shall be similar in substance, taking into account
the nature of the Services that require such sub-processing by the sub-processor) that require the sub-
processor to implement technical and organizational measures designed for the Processing by the sub-
processor to meet the requirements of Applicable Data Protection Law. Lightedge remains responsible for
any acts or omissions of a sub-processor that cause Lightedge to breach its obligations under this DPA.
8. Complaints and Data Subject Rights Requests.
8.1. Lightedge must notify Customer without undue delay if it receives any complaint, notice, or
communication that relates directly or indirectly to the processing of the Personal Data or to either party's
compliance with the Applicable Data Protection Law.
8.2. Lightedge shall respond to any Data Subject request to exercise their rights under the Applicable
Data Protection Law, by either asking the Data Subject to make their request to Customer or notifying
Customer of the same.
8.3. Lightedge must not disclose the Personal Data to any Data Subject or to a third party other than at
the Customer's request or instruction or as required by law.
3
9. Term and Termination.
9.1. This DPA will remain in full force and effect so long as the Agreement remains in effect; or Lightedge
retains any Personal Data related to the Agreement in its possession or control.
9.2. Any provision of this DPA that expressly or by implication should come into or continue in force on or
after termination of the Agreement in order to protect Personal Data will remain in full force and effect.
9.3. Lightedge's failure to comply with the terms of this DPA is a material breach of the Agreement. In
such event, the Customer may terminate the Agreement or any part of the Agreement authorizing the
processing of Personal Data] effective immediately upon written notice to Lightedge without further liability
or obligation.
9.4. If a change in any Applicable Data Protection Law prevents either party from fulfilling all or part of its
obligations under the Agreement, the parties will suspend the processing of Personal Data until that
processing complies with the new requirements. If the parties are unable to bring the Personal Data
processing into compliance with the Applicable Data Protection Law within sixty (60) days, they may
terminate the Agreement upon written notice to the other party.
10. Data Return and Destruction.
10.1. The Services provide Customer with controls that Customer may use to retrieve, correct or delete
Customer Personal Data prior to expiry or termination of the Agreement. Customer instructs Lightedge to
delete Customer Personal Data following expiry or termination of the Agreement; subject to any retention
requirements inherent in the technical configuration of the Services selected by Customer, or applicable to
Lightedge by law or good industry practice. Upon the request of Customer, Lightedge will certify in writing
that this has been done.
10.2. Upon Customer’s request prior to the expiration of the Agreement, Lightedge will use commercially
reasonable efforts, based on the functionality of the Services and at Customer’s expenses, to help Customer
retrieve Customer Personal Data.
11. Audit.
11.1. Lightedge will conduct regular audits of its Personal Data processing practices and the information
technology and information security controls for all facilities and systems used in complying with its
obligations under this DPA, including, but not limited to, obtaining a network-level vulnerability assessment
performed by a recognized third-party audit firm based on recognized industry best practices.
11.2. Lightedge will make all of the relevant audit reports available to the Customer for review through the
Service Portal, including as applicable: the following compliance reports or certifications: HIPAA; HITRUST;
Lightedge's latest Payment Card Industry (PCI) compliance report; Statement on Standards for Attestation
Engagements (SSAE) No. 18 audit report; SOC 1, 2, and 3 Type II; reports relating to its ISO/IEC 20000 & 27001
certification; and NIST 800-53. The Customer will treat such audit reports as Lightedge's Confidential
Information under this DPA.
12. General Provisions.
12.1. Interpretation. In the event of ambiguity, conflict or inconsistency among (i) the SCC; (ii) this DPA;
and (iii) the Agreement, the documents shall be given a descending order of precedence as follows (i) the
SCC as to the specific subject matter thereof; (ii) this DPA as to the specific subject matter hereof; (iii) and the
Agreement.
4
12.2. Limitation of Liability, No Warranty. This DPA shall not modify the Limitations of Liability,
indemnification clauses, warranties offered or disclaimed, Service Level Agreements or other terms and
conditions of the Agreement for Services between the parties.
12.3. Notices. Any notice permitted or required under this DPA shall be conveyed to the party in
accordance with the “Notices” Section of the Agreement.
12.4. No Third-Party Beneficiaries. Customer and Lightedge agree that, with the exception of the SCC to
which Data Subjects are third-party beneficiaries (with the exceptions set out under Clause 3 of the SCC),
this DPA is for the sole benefit of the parties hereto and their respective successors and permitted assigns
and nothing herein, express or implied, is intended to or shall confer upon any other person or entity any
legal or equitable right, benefit, or remedy of any nature whatsoever under or by reason of this Agreement.
[Remainder Page Intentionally Left Blank]
5
APPENDIX A – Processed Personal Data and Purposes
Purpose of processing: Information Technology (data center & cloud) services.
Scope of processing: Services listed in the Service Order(s).
Categories of Personal Data: Customer Personal Data embedded in Customer Content.
Special Categories of Data: None, unless otherwise identified by Customer.
6
APPENDIX B – SCC
Data exporter(s): Customer
Address: the address provided by Customer via the Service
Portal
Contact person’s name, position and contact details: The contact designated by Customer via the Service
Portal
Signature & Date: Customer’s signature and date of acceptance of the
Agreement or the Service Order
Role: Controller or Processor
Data importer(s): Lightedge Solutions, LLC
Address: 909 Locust Street, STE 301, Des Moines, IA 50309
Contact person’s name, position and contact details: Chief Security Officer, legal@lightedge.com
Activities relevant to the data transferred under these The provision of services to Customer described in
Clauses: the Agreement
Role: Processor or Sub-Processor
Categories of data subjects whose personal data is Data Subject may include Customer’s customers,
transferred employees, suppliers and End Users
Categories of personal data transferred Customer Personal Data
Sensitive data transferred (if applicable) and applied Not applicable
restrictions or safeguards that fully take into
consideration the nature of the data and the risks
involved, such as for instance strict purpose
limitation, access restrictions (including access only
for staff having followed specialised training),
keeping a record of access to the data, restrictions for
onward transfers or additional security measures.
The frequency of the transfer (e.g. whether the data is Continuous basis upon Customer’s discretion
transferred on a one-off or continuous basis).
Nature of the processing The provision of Services to Customer
Purpose(s) of the data transfer and further processing The provision of Services to Customer
The period for which the personal data will be For the duration of the Agreement
retained, or, if that is not possible, the criteria used to
determine that period
For transfers to (sub-) processors, also specify subject The nature and purpose of the Processing by sub-
matter, nature and duration of the processing processors is the provision of the Services to
Customer for the duration of the Agreement
Competent Supervisory Authority: the EU Member State in which Customer is established, or has appointed a
representative, or the data subjects whose personal data is transferred under these Clauses in relation to the
offering of goods or services to them, or whose behavior is monitored, are located.
7
Lightedge is responsible for the technical and organizational measures set out in the Security and Data
Protection Policy. Customer is responsible for implementing and maintaining privacy protections and security
measures set out in the Agreement, including for components that Customer provides or controls.
8