Last updated: 22 August 2026 | Version: 2026-08-22
This Data Processing Agreement (DPA) forms part of the Lyniti Terms of Service or another written agreement that incorporates it (Agreement) between the customer identified in the Agreement (Customer) and Lyniti. It applies whenever Lyniti processes Customer Personal Data on Customer's behalf, regardless of plan, purchase channel, or whether an Enterprise Order exists.
By accepting the Agreement for an organization or entering another Agreement that incorporates this DPA, Customer enters this DPA on behalf of that organization. If Lyniti does not process Customer Personal Data on Customer's behalf, the processor obligations in this DPA do not apply.
Customer is the controller and Lyniti is the processor for Customer Personal Data. If Customer processes that data on behalf of another controller, Customer is a processor and appoints Lyniti as its subprocessor. In that case, Customer confirms that the relevant controller has authorized Customer to appoint Lyniti and to give the instructions described in this DPA.
Each party will comply with Data Protection Laws applicable to its role. Lyniti will process Customer Personal Data only to provide, secure, support, and maintain the contracted service as permitted by the Agreement and Customer's documented instructions.
Customer Personal Data means personal data contained in Customer content that Lyniti processes on Customer's behalf under the Agreement. Data Protection Laws means the GDPR and other privacy or data-protection laws applicable to that processing. Controller, processor, data subject, personal data, processing, Personal Data Breach, and supervisory authority have the meanings given by applicable Data Protection Laws. Subprocessor means a third party Lyniti appoints to process Customer Personal Data.
If this DPA conflicts with the Agreement on processing Customer Personal Data, this DPA controls. If applicable Standard Contractual Clauses conflict with this DPA, those clauses control.
Customer instructs Lyniti to process Customer Personal Data as needed to provide the service, carry out Customer's use and configuration of the service, respond to support requests, comply with the Agreement, and follow other lawful written instructions agreed by the parties. These instructions include transfers permitted by Section 12.
Lyniti will process Customer Personal Data only on Customer's documented instructions unless applicable law requires other processing. If law requires other processing, Lyniti will inform Customer before processing unless that law prohibits notice for important public-interest reasons. Lyniti will immediately inform Customer if, in Lyniti's opinion, an instruction infringes applicable Data Protection Laws and may suspend the affected processing until the parties resolve the issue.
Customer is responsible for the lawfulness, accuracy, and quality of Customer Personal Data and instructions, including providing required notices, establishing a lawful basis, obtaining required authorizations, and responding to data subjects. Customer will not instruct Lyniti to process data in violation of Data Protection Laws or use the service for processing that the Agreement does not permit.
Lyniti ensures that persons authorized to process Customer Personal Data are subject to an appropriate duty of confidentiality and access that data only as needed for their assigned duties.
Taking account of the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, as well as risks to individuals, Lyniti implements and maintains appropriate technical and organizational measures designed to protect Customer Personal Data in accordance with Article 32 GDPR. Annex 2 describes current measures. Lyniti may update those measures without materially reducing the overall level of protection during the term.
Customer grants Lyniti general written authorization to use the Subprocessors listed in the Subprocessor Register. Lyniti will impose data-protection obligations on each Subprocessor that provide substantially the same protection required by this DPA for the processing it performs. Lyniti remains responsible to Customer for a Subprocessor's performance of those obligations.
Lyniti will provide advance notice of an intended addition or replacement before the new Subprocessor begins processing Customer Personal Data. Notice may be sent to Customer's account contact, provided through the service, or published through the Subprocessor update subscription. Customer may object on reasonable data-protection grounds within the period stated in the notice.
If Customer makes a timely objection, the parties will work in good faith on a commercially reasonable alternative. If none is available, either party may terminate the affected service without penalty for the unused prepaid period. Lyniti may appoint a Subprocessor sooner when necessary to address an urgent security, legal, or service-continuity issue, but will notify Customer without undue delay and preserve Customer's right to object.
Taking account of the nature of processing, Lyniti will assist Customer through appropriate technical and organizational measures, insofar as possible, with Customer's obligation to respond to requests to exercise data-subject rights. If Lyniti receives a request relating to Customer Personal Data, Lyniti will promptly forward it to Customer unless prohibited by law and will not respond except on Customer's instructions or as required by law.
Lyniti will notify Customer without undue delay after becoming aware of a Personal Data Breach concerning Customer Personal Data. Lyniti will provide reasonably available information required for Customer's notification and documentation duties and will provide further information in phases as it becomes available. Notification is not an admission of fault or liability.
Taking account of the nature of processing and information available to Lyniti, Lyniti will reasonably assist Customer with obligations under Articles 32 through 36 GDPR, including security, breach assessment and notification, data-protection impact assessments, and prior consultation with a supervisory authority. The parties will agree in advance on fees for extraordinary assistance outside the service's standard functionality, except where the assistance is required because Lyniti breached this DPA.
At Customer's choice and subject to available service functionality, Lyniti will return or delete Customer Personal Data after the Agreement ends and delete existing copies, unless applicable law requires retention. Customer must request return before account or workspace deletion and use available export tools where provided. Data retained by law remains protected under this DPA and is processed only for the required purpose.
Customer Personal Data in protected backups is isolated from ordinary use and deleted through Lyniti's backup rotation unless law requires longer retention.
Lyniti will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA. Lyniti may satisfy requests first through current security documentation, certifications, or independent audit reports.
If that information is insufficient, Customer or an independent auditor bound by confidentiality may conduct an audit once in any 12-month period on reasonable advance notice and during normal business hours. Additional audits are permitted after a confirmed Personal Data Breach affecting Customer Personal Data or when required by a supervisory authority. Audits must avoid unreasonable disruption and access to another customer's data. Customer bears its audit costs unless the audit identifies a material breach of this DPA by Lyniti. Lyniti will inform Customer if, in its opinion, an audit instruction infringes Data Protection Laws.
Lyniti will not transfer Customer Personal Data from the European Economic Area to a country lacking an applicable adequacy decision unless the transfer uses a valid safeguard under Chapter V GDPR, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required. Lyniti will make reasonably available information about relevant transfer mechanisms, subject to confidentiality duties.
Where a restricted transfer between Customer and Lyniti requires the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, those clauses are incorporated into this DPA by reference. Module Two applies when Customer is a controller and Module Three when Customer is a processor. Clause 7 applies; Clause 9 uses Option 2 and the notice process in Section 7; the optional language in Clause 11 does not apply; Clause 17 uses Option 1 and Finnish law; and Helsinki, Finland courts apply under Clause 18. The competent supervisory authority is determined under Clause 13 and, where Clause 13(b) applies, is the Office of the Data Protection Ombudsman of Finland. Agreement details and Annex 1 complete Annex I, Annex 2 completes Annex II, and the Subprocessor Register completes Annex III. Acceptance of the Agreement constitutes signature of those clauses where legally permitted.
This DPA takes effect with the Agreement and remains in force while Lyniti processes Customer Personal Data. The Agreement's liability, governing-law, and dispute provisions apply to this DPA except where Data Protection Laws or applicable Standard Contractual Clauses require otherwise.
Lyniti may update this DPA under the Agreement's changes provision. Lyniti will provide advance notice of a material change that reduces Customer's data-protection rights. A negotiated DPA may be changed only as that signed agreement permits. If a translation conflicts with the English version, the English version controls unless mandatory law requires otherwise.
This annex states the subject matter, duration, nature, purpose, and scope of processing required by Article 28 GDPR.
Customer is the organization identified in the Agreement. Lyniti is the service provider identified in the Terms of Service. Contact details are those in the Agreement and Customer account.
Processing Customer Personal Data to host, operate, secure, support, maintain, and provide the Lyniti collaboration, workspace, communication, file, project, business-management, and related contracted services.
The term of the Agreement and any limited period afterward needed to return or delete data, complete backup rotation, resolve security issues, or satisfy legal retention duties.
Collection, recording, organization, structuring, storage, retrieval, consultation, transmission, alignment, support access, security monitoring, backup, restoration, export, restriction, and deletion as needed to provide and protect the service on Customer's instructions.
Customer's authorized users, workforce members, contractors, applicants, clients, prospective clients, suppliers, business contacts, collaborators, and other individuals whose personal data Customer submits to the service.
Identity and contact data; account and authentication data; professional and employment data; workspace, project, task, message, document, file, calendar, client, financial-business, and collaboration content; device, network, audit, and usage metadata; support records; and other personal data Customer chooses to submit.
Not intentionally required by Lyniti. Customer may submit special-category or criminal-conviction data only where the Agreement permits it, the processing is lawful, and Customer gives appropriate instructions and safeguards.
Continuous or as initiated by Customer and its authorized users during use of the service.
Primary service processing is in the European Economic Area. Subprocessor locations and transfer mechanisms are listed in the Subprocessor Register and governed by Section 12.
Instructions are described in Section 3. Customer retains the rights and responsibilities of a controller, or of a processor acting for another controller, under applicable Data Protection Laws.
Measures are selected according to risk and evolve with the service. Current measures include:
These current documents support and form part of the processing description where this DPA refers to them:
Send DPA questions, data-protection instructions, audit requests, or Subprocessor objections to:
Email: support@lyniti.com