LuxSci uses a number of third-party sub-processors through which User Personal Data may flow or in which such data may be stored. These sub-processors include: Oracle, Rackspace, Amazon AWS, Proofpoint, Sonian, Sectigo, easyDNS, Authorize.net, PayPal, Neuvasync, AnswerConnect, and Google Analytics.
There are a few specific LuxSci services that are not GDPR compliant, as they are provided through arrangements with third-party vendors that are specifically focused on HIPAA compliance and US customers. These services include: SecureVideo and SecureChat. They are not available for use by organizations in the EU.
Can I modify this document? LuxSci does not accept customer modifications to or the removal of sections from its GDPR Agreement.
GDPR Data Privacy Addendum
Document Version 2018.05.22 (Download a PDF of this Document)
This Data Privacy Addendum (“Addendum”) is subject to the terms of, and fully incorporated and made part of, the Lux Scientiae, Incorporated, (“LuxSci”) Master Services Agreement, located at https://luxsci.com/extranet/legal.html (the “Agreement”). It applies in respect of the provision of the LuxSci Services to the Customer if the Processing of User Personal Data is subject to the GDPR, only to the extent the Customer is a Controller (or Processor, as applicable) of User Personal Data and LuxSci is a Processor or sub-Processor of User Personal Data (as defined below). This Addendum shall amend and supplement any provisions relating to the processing of User Personal Data contained in the Agreement and shall be effective for the term of the Agreement.
“User Personal Data” means Personal Data uploaded to or published, displayed or backed up through the LuxSci Services, as further described under Section 3 of this Addendum;
“GDPR” means the General Data Protection Regulation (EU) 2016/679, together with any national implementing laws in any Member State of the European Union, as amended, repealed, consolidated or replaced from time to time; and
“Personal Data”, “Personal Data Breach”, “Data Subject”, “Data Protection Authority”, “Data Protection Impact Assessment”, “Process”, “Processor” and “Controller” will each have the meaning given to them in Article 4 of the GDPR.
1.2. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.
2.2. Types of Personal Data. User Personal Data includes Personal Data, the extent of which is determined and controlled by Customer in its sole discretion, contained in any applications, files, data, information or other content uploaded to or published, displayed or backed up by Customer or its end users through the LuxSci Services.
3.2. LuxSci will only Process User Personal Data on behalf of and in accordance with the Customer’s prior written instructions and for no other purpose. LuxSci is hereby instructed to Process User Personal Data to the extent necessary to enable LuxSci to provide the LuxSci Services in accordance with the Agreement.
3.3. Each of the Customer and LuxSci will comply with their respective obligations under the GDPR, to the extent applicable to the Processing of any User Personal Data in the context of the provision of the LuxSci Services. Customer will (i) comply with all applicable privacy and data protection laws with respect to Customer’s Processing of User Personal Data and any Processing instructions that Customer issues to LuxSci, and (ii) ensure that Customer has obtained (or will obtain) all consents and rights necessary for LuxSci to Process User Personal Data in accordance with this Addendum.
3.4. Customer consents to the storage of User Personal Data in the United States. By uploading User Personal Data to the Services, Customer acknowledges that Customer may transfer and access User Personal Data from around the world, including to and from the United States.
3.5. For Customers located in the European Economic Area or Switzerland, Customer acknowledges that LuxSci may process User Personal Data in countries outside of the European Economic Area and Switzerland as necessary to provide the LuxSci Services and in accordance with the terms of this Addendum. Where this is the case, LuxSci will take such measures as are necessary to ensure that the transfer is in compliance with applicable data protection laws.
3.6. The Customer acknowledges that LuxSci is reliant on the Customer for direction as to the extent to which LuxSci is entitled to use and Process User Personal Data on behalf of Customer in performance of the LuxSci Services. Consequently, LuxSci will not be liable under the Agreement for any claim brought by a Data Subject arising from any action or omission by LuxSci, to the extent that such action or omission resulted directly from the Customer’s instructions or from Customer’s failure to comply with its obligations under the applicable data protection law.
3.7. If for any reason (including a change in applicable law) LuxSci becomes unable to comply with any instructions of the Customer regarding the Processing of User Personal Data, LuxSci will (a) promptly notify the Customer of such inability, providing a reasonable level of detail as to the instructions with which it cannot comply and the reasons why it cannot comply, to the greatest extent permitted by applicable law; and (b) cease all Processing of the affected User Personal Data (other than merely storing and maintaining the security of the affected User Personal Data) until such time as the Customer issues new instructions with which LuxSci is able to comply. If this provision applies, LuxSci will not be liable to Customer under the Agreement in respect of any failure to perform the LuxSci Services due to its inability to process User Personal Data until the Customer issues new instructions in regard to such Processing.
5.2. LuxSci will, at the Customer’s request and subject to the Customer paying all LuxSci’s fees at prevailing rates, and all expenses, provide the Customer with assistance necessary for the fulfillment of the Customer’s obligation to keep User Personal Data secure.
inform Customer of any intended changes concerning the addition or replacement of such sub-Processors, to the greatest extent permitted by applicable law, and Customer will have an opportunity to object to such changes on reasonable grounds within thirty (30) business days after being notified. Such notifications will be made on LuxSci’s web site, under https://luxsci.com/blog. If the parties are unable to resolve such objection, either party may terminate the Agreement by providing written notice to the other party;
keep the Customer informed via its web site if there is any change to the role or status of the sub-Processor; and
enter into a written agreement with the sub-Processor that imposes on the sub-Processor the same obligations that apply to LuxSci under this Addendum.
notify the Customer as soon as practicable, and within the time frame mandated by GDPR, after it becomes aware of any Personal Data Breach affecting any User Personal Data; and
at the Customer’s request and subject to the Customer paying all LuxSci’s fees at prevailing rates, and all expenses, promptly provide the Customer with all reasonable assistance necessary to enable the Customer to notify of relevant security breaches to the relevant Data Protection Authorities and/or affected Data Subjects.
the conduct of Data Protection Impact Assessments if the Customer is required to do so under the GDPR; and
consultation with Data Protection Authorities, if the Customer is required to engage in consultation under the GDPR, in each case solely to the extent that such assistance is necessary and relates to the Processing by LuxSci of the User Personal Data, considering the nature of the Processing and the information available to LuxSci.
1. Definitions
1.1. For the purposes of this Addendum:“User Personal Data” means Personal Data uploaded to or published, displayed or backed up through the LuxSci Services, as further described under Section 3 of this Addendum;
“GDPR” means the General Data Protection Regulation (EU) 2016/679, together with any national implementing laws in any Member State of the European Union, as amended, repealed, consolidated or replaced from time to time; and
“Personal Data”, “Personal Data Breach”, “Data Subject”, “Data Protection Authority”, “Data Protection Impact Assessment”, “Process”, “Processor” and “Controller” will each have the meaning given to them in Article 4 of the GDPR.
1.2. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.
2. Details of The Processing
2.1. Categories of Data Subjects. This Addendum applies to the Processing of User Personal Data relating to Customer’s clients or prospects, suppliers, business partners, vendors and other end users, the extent of which is determined and controlled by Customer in its sole discretion.2.2. Types of Personal Data. User Personal Data includes Personal Data, the extent of which is determined and controlled by Customer in its sole discretion, contained in any applications, files, data, information or other content uploaded to or published, displayed or backed up by Customer or its end users through the LuxSci Services.
3. Processing of User Personal Data
3.1. For purposes of this Addendum, Customer and LuxSci agree that Customer is the Controller of User Personal Data and LuxSci is the Processor of such data, or when Customer acts as a Processor of User Personal Data for a third-party Controller, LuxSci is a sub-Processor. Customer warrants that Customer’s instructions to LuxSci with respect to the User Personal Data, including Customer’s designation of LuxSci as a Processor or sub-Processor, have been authorized by itself or by the relevant third-party Controller.3.2. LuxSci will only Process User Personal Data on behalf of and in accordance with the Customer’s prior written instructions and for no other purpose. LuxSci is hereby instructed to Process User Personal Data to the extent necessary to enable LuxSci to provide the LuxSci Services in accordance with the Agreement.
3.3. Each of the Customer and LuxSci will comply with their respective obligations under the GDPR, to the extent applicable to the Processing of any User Personal Data in the context of the provision of the LuxSci Services. Customer will (i) comply with all applicable privacy and data protection laws with respect to Customer’s Processing of User Personal Data and any Processing instructions that Customer issues to LuxSci, and (ii) ensure that Customer has obtained (or will obtain) all consents and rights necessary for LuxSci to Process User Personal Data in accordance with this Addendum.
3.4. Customer consents to the storage of User Personal Data in the United States. By uploading User Personal Data to the Services, Customer acknowledges that Customer may transfer and access User Personal Data from around the world, including to and from the United States.
3.5. For Customers located in the European Economic Area or Switzerland, Customer acknowledges that LuxSci may process User Personal Data in countries outside of the European Economic Area and Switzerland as necessary to provide the LuxSci Services and in accordance with the terms of this Addendum. Where this is the case, LuxSci will take such measures as are necessary to ensure that the transfer is in compliance with applicable data protection laws.
3.6. The Customer acknowledges that LuxSci is reliant on the Customer for direction as to the extent to which LuxSci is entitled to use and Process User Personal Data on behalf of Customer in performance of the LuxSci Services. Consequently, LuxSci will not be liable under the Agreement for any claim brought by a Data Subject arising from any action or omission by LuxSci, to the extent that such action or omission resulted directly from the Customer’s instructions or from Customer’s failure to comply with its obligations under the applicable data protection law.
3.7. If for any reason (including a change in applicable law) LuxSci becomes unable to comply with any instructions of the Customer regarding the Processing of User Personal Data, LuxSci will (a) promptly notify the Customer of such inability, providing a reasonable level of detail as to the instructions with which it cannot comply and the reasons why it cannot comply, to the greatest extent permitted by applicable law; and (b) cease all Processing of the affected User Personal Data (other than merely storing and maintaining the security of the affected User Personal Data) until such time as the Customer issues new instructions with which LuxSci is able to comply. If this provision applies, LuxSci will not be liable to Customer under the Agreement in respect of any failure to perform the LuxSci Services due to its inability to process User Personal Data until the Customer issues new instructions in regard to such Processing.
4. Confidentiality
4.1. LuxSci will ensure that any person whom Customer authorizes to Process User Personal Data on its behalf is subject to confidentiality obligations in respect of that User Personal Data.5. Security Measures
5.1. LuxSci will implement appropriate technical and organizational measures to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to User Personal Data.5.2. LuxSci will, at the Customer’s request and subject to the Customer paying all LuxSci’s fees at prevailing rates, and all expenses, provide the Customer with assistance necessary for the fulfillment of the Customer’s obligation to keep User Personal Data secure.
6. Sub-processors
6.1. Customer authorizes LuxSci to engage sub-Processors to perform specific services on LuxSci’s behalf which may require such sub-Processors to Process User Personal Data. If LuxSci engages a sub-Processor to Process any User Personal Data, it willinform Customer of any intended changes concerning the addition or replacement of such sub-Processors, to the greatest extent permitted by applicable law, and Customer will have an opportunity to object to such changes on reasonable grounds within thirty (30) business days after being notified. Such notifications will be made on LuxSci’s web site, under https://luxsci.com/blog. If the parties are unable to resolve such objection, either party may terminate the Agreement by providing written notice to the other party;
keep the Customer informed via its web site if there is any change to the role or status of the sub-Processor; and
enter into a written agreement with the sub-Processor that imposes on the sub-Processor the same obligations that apply to LuxSci under this Addendum.
7. Data Subject Rights
7.1. LuxSci will, at the Customer’s request and subject to the Customer paying all LuxSci’s fees at prevailing rates, and all expenses, provide the Customer with assistance necessary for the fulfillment of the Customer’s obligation to respond to requests for the exercise of Data Subjects’ rights. Customer shall be solely responsible for responding to such requests.8. Security Breaches
8.1. LuxSci will:notify the Customer as soon as practicable, and within the time frame mandated by GDPR, after it becomes aware of any Personal Data Breach affecting any User Personal Data; and
at the Customer’s request and subject to the Customer paying all LuxSci’s fees at prevailing rates, and all expenses, promptly provide the Customer with all reasonable assistance necessary to enable the Customer to notify of relevant security breaches to the relevant Data Protection Authorities and/or affected Data Subjects.
9. Data Protection Impact Assessment; Prior Consultation
9.1. LuxSci will, at the Customer’s request and subject to the Customer paying all LuxSci’s fees at prevailing rates, and all expenses, provide the Customer with reasonable assistance to facilitate:the conduct of Data Protection Impact Assessments if the Customer is required to do so under the GDPR; and
consultation with Data Protection Authorities, if the Customer is required to engage in consultation under the GDPR, in each case solely to the extent that such assistance is necessary and relates to the Processing by LuxSci of the User Personal Data, considering the nature of the Processing and the information available to LuxSci.
