Data Processing Addendum

This addendum applies where Lingows AI processes personal data on behalf of a client under a statement of work or master services agreement. It forms part of that agreement. Where this addendum conflicts with the agreement on the subject of data protection, this addendum controls; on all other subjects the agreement controls. A signed, client-specific version supersedes this published draft.

Controller, processor, subprocessor, personal data, processing, and personal data breach have the meanings given in applicable data protection law, including the Colorado Privacy Act, other United States state privacy laws, and the EU and UK General Data Protection Regulation where those apply to the client.

The client is the controller and determines the purposes and means of processing. Lingows AI is the processor and processes personal data only on documented instructions from the client. Where the client is itself a processor for a third party, Lingows AI acts as a subprocessor and the same obligations flow through.

• Subject matter. Design, development, and operation of AI systems, automations, and integrations.
• Duration. The term of the applicable statement of work, plus any agreed deletion period.
• Nature and purpose. Collection, structuring, storage, retrieval, inference, evaluation, and deletion as required to deliver the services.
• Categories of data subject and personal data. Determined by the client and specified per engagement in the statement of work.

Special categories of personal data are not processed unless expressly agreed in writing in advance.

Lingows AI processes personal data only as instructed, including with regard to transfers, unless required otherwise by law, in which case it will inform the client unless the law prohibits that notice. Lingows AI will inform the client if, in its opinion, an instruction infringes applicable data protection law. Lingows AI does not sell personal data, does not share it for cross-context behavioral advertising, and does not retain, use, or disclose it for any purpose other than performing the services.

Access to client personal data is limited to personnel who need it to deliver the services. Those personnel are bound by written confidentiality obligations that survive the end of their engagement.

Lingows AI maintains technical and organizational measures appropriate to the risk, including least-privilege access, per-engagement credentials issued and revocable by the client, encryption in transit, and removal of working copies of client data at the end of an engagement. Current practices, and the areas still being documented, are described on the security page. Lingows AI does not hold a security certification and makes no such representation in this addendum.

The client provides general authorization for Lingows AI to engage subprocessors, including AI model providers, cloud hosting, and observability providers. The subprocessors applicable to an engagement are identified in the system design document before production data flows. Lingows AI will give notice before adding a subprocessor that processes client personal data and the client may object on reasonable data protection grounds, in which case the parties will work in good faith to find an alternative architecture. Lingows AI remains responsible for its subprocessors' performance of these obligations.

Personal data may be transmitted to model providers as part of inference. Lingows AI will configure provider accounts and tiers with the intent that client data is not used to train or fine-tune provider models, and will record the applicable provider terms for the engagement. Fine-tuning on client data occurs only on written instruction. Full detail is in the AI data policy, which is incorporated by reference.

Taking into account the nature of processing, Lingows AI will assist the client with responses to data subject requests, with data protection impact assessments, and with consultations with supervisory authorities. Requests received directly from a data subject will be forwarded to the client without undue delay and will not be answered by Lingows AI unless instructed.

Lingows AI will notify the client without undue delay after becoming aware of a personal data breach affecting client personal data, and will provide the information reasonably available to support the client's own notification obligations, including the nature of the breach, categories and approximate volumes affected where known, likely consequences, and measures taken. Notice is not an acknowledgment of fault.

On termination or expiry, and on request, Lingows AI will return or delete client personal data in its possession and delete existing copies, except where retention is required by law. Backups are deleted on their ordinary cycle. The deletion timeline for a given engagement is set in the statement of work.

Lingows AI will make available information reasonably necessary to demonstrate compliance with this addendum and will contribute to audits conducted by the client or an auditor it mandates, on reasonable notice, no more than once per twelve months absent a breach or regulatory requirement, and subject to confidentiality. Because Lingows AI holds no third-party audit report, no such report can be offered in place of this right.

Processing takes place in the United States. Where the client transfers personal data subject to EU or UK law, the parties will put an appropriate transfer mechanism in place, including the European Commission Standard Contractual Clauses and the UK International Data Transfer Addendum as applicable, which will be incorporated into the signed version of this addendum.

To request an executable copy of this addendum, contact Lingows AI, 400 E Simpson St #210-B, Lafayette, CO 80026, or call (720) 330-5721. If your organization has its own addendum, send it and we will work from your paper.