Lacy logo – symbolizing Autonomous AI Customer Support that's Always On, Always Ready. Reflects Lacy’s dedication to innovative, seamless, and multi-channel customer engagement through advanced AI technology.

Data Processing Agreement

Last Updated October 2024

‍This Data Processing Addendum (“DPA”) forms part of, and is subject to, the agreement that Customer has with Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) (the “Agreement”) if: (i) the Customer is subject to the GDPR or UK GDPR; and (ii) Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai), in the course of providing the Services under the Agreement, Processes Personal Data (such terms defined below) on behalf of Customer. Where Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) Processes such Personal Data on behalf of Customer, the parties agree to comply with the terms and conditions in this DPA in connection with such Personal Data.

‍Table of Contents

‍1. Definitions
2. Processing of Personal Data
3. Rights of Data Subjects
4. Sub-processors
5. Security
6. Personal Data Incident Management and Notification
7. Government Access Requests
8. Return and Deletion of Personal Data
9. Limitation of Liability
10. European Specific Provisions
11. Legal Effect
12. Governing Law
13. Schedule 1: Transfer Mechanisms for European Data Transfers

‍1. Definitions“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

“Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai)” means Particle Automation, LLC with its principal office located at 8 The Green Ste A, Dover, DE 19901.

“Particle Automation, LLC” means Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) and its Affiliates engaged in the Processing of Personal Data.

“Controller” means the entity which determines the purposes and means of the Processing of Personal Data.

“Customer” means the customer party to the Agreement.

“Data Protection Laws” means all laws and regulations, including laws and binding regulations of the European Union, the European Economic Area (“EEA”) and their member states, Switzerland, and the United Kingdom, applicable to the Processing of Personal Data under the Agreement.

“Data Subject” means the identified or identifiable person to whom Personal Data relates.

“Europe” means the European Union, the EEA, Switzerland, and the United Kingdom.

“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

“Personal Data” means any Customer Data that relates to an identified or identifiable natural person, to the extent that such information is protected as personal data under applicable Data Protection Laws.

“Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

“Processor” means the entity which Processes Personal Data on behalf of the Controller.

“Public Authority” means a government agency or law enforcement authority, including judicial authorities.

“Security Practices Datasheet” means the security terms and/or security practices datasheet which are applicable to the Customer as published on Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai)’s website from time to time.

“Services” means the services which Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) provides to the Customer pursuant to the terms of the Agreement.

“Standard Contractual Clauses” means Standard Contractual Clauses for the transfer of Personal Data to third countries as set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

“Sub-processor” means any entity engaged by Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) or a member of the Particle Automation, LLC to Process Personal Data in connection with the Services.

“UK GDPR” refers to the version of the GDPR as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.

‍2. Processing of Personal Data

2.1 Roles of the Parties

‍The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is a Controller or a Processor, and Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) is a Processor. Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) or members of the Particle Automation, LLC may engage Sub-processors pursuant to the requirements set forth in section 4 below.

‍2.2 Customer’s Processing of Personal Data

‍Customer shall, in its use of the Services and provision of instructions, Process Personal Data in accordance with the requirements of applicable Data Protection Laws (including where the Customer is a Processor, by ensuring that the ultimate Controller does so). Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data.

‍2.3 Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai)’s Processing of Personal Data

‍As Customer’s Processor, Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall only Process Personal Data for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Document(s); (ii) Processing initiated by Users in their use of the Services; and (iii) Processing to comply with other reasonable instructions provided by Customer (e.g., via email) that are consistent with the terms of the Agreement (individually and collectively, the “Purpose”). Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) acts on behalf of and on the instructions of Customer in carrying out the Purpose.

‍2.4 Details of the Processing

‍The subject matter of Processing of Personal Data by Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) is described in the Purpose in Section 2.3. The duration of the Processing, the nature and purpose of the Processing, the types of Personal Data, and categories of Data Subjects processed under this DPA are further specified in Schedule 2 (Description of Processing/Transfer).

‍3. Rights of Data Subjects

3.1 Data Subject Requests

Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall, to the extent legally permitted, promptly notify Customer of any complaint, dispute, or request received from a Data Subject under applicable Data Protection Law in relation to Personal Data. These include rights of access, rectification, restriction of Processing, erasure (“right to be forgotten”), data portability, objection to the Processing, or rights related to automated individual decision-making (each, a “Data Subject Request”).

‍Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall not respond to a Data Subject Request itself, except where authorized to redirect the Data Subject Request to Customer. Taking into account the nature of the Processing, Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall assist Customer by appropriate technical and organizational measures, insofar as this is possible, to respond to a Data Subject Request as required by applicable Data Protection Laws.

If Customer is unable to address a Data Subject Request through its use of the Services, Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall, upon Customer’s request, assist in responding, provided such assistance is legally permissible. Customer shall be responsible for any costs arising from Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai)’s assistance, including fees for any additional functionality required.

‍4. Sub-processors

4.1 Appointment of Sub-processors

‍Customer acknowledges and agrees that Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai)’s Affiliates may be retained as Sub-processors, and that Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) and its Affiliates may engage third-party Sub-processors in connection with providing the Services. Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall ensure that any Sub-processors engaged by it will be bound by contractual obligations to provide at least the same level of data protection as is required by this DPA.

‍4.2 List of Current Sub-processors and Notification of New Sub-processors

‍The current list of Sub-processors engaged in Processing Personal Data for the performance of the Services is available upon request. Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall inform Customer of any intended changes to the use of new or replacement Sub-processors, giving Customer the opportunity to object.

‍4.3 Objection Right for New Sub-processors

‍Customer may reasonably object to the use of a new Sub-processor by notifying Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) in writing within ten (10) business days of receipt of such notice. The objection must provide reasonable grounds. If Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) cannot accommodate the objection within a reasonable period, either party may terminate the Agreement with respect to those Services that require the use of the new Sub-processor.

‍4.4 Liability

Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall be liable for the acts and omissions of its Sub-processors to the same extent Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) would be liable if performing the Services directly under the terms of this DPA.

‍5. Security

5.1 Audit

Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall maintain an audit program to help ensure compliance with the obligations set out in this DPA and shall make available to Customer, upon request, information necessary to demonstrate such compliance. If the scope of the requested audit exceeds typical information shared with other customers, Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) may charge Customer for the effort involved on a time and materials basis.

‍5.2 Controls for the Protection of Personal Data

Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall maintain appropriate technical and organizational measures for the protection of Personal Data against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss, alteration, damage, or disclosure, as set forth in the Security Practices Datasheet. Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) will not materially decrease the overall security of the Services during the term of this DPA.

‍5.3 Data Protection Impact Assessment

‍Upon Customer’s request, Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall assist Customer with reasonable cooperation and assistance in fulfilling Customer’s obligation under Data Protection Laws to carry out a data protection impact assessment related to Customer’s use of the Services, to the extent Customer does not otherwise have access to the relevant information.

‍6. Personal Data Incident Management and Notification

Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall notify Customer without undue delay of any breach relating to Personal Data (within the meaning of applicable Data Protection Laws) of which it becomes aware and that may require notification to a competent supervisory authority or Data Subject under applicable Data Protection Laws or that Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) is required to notify to Customer under applicable Data Protection Laws (a “Personal Data Incident”). PParticle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall provide commercially reasonable cooperation and assistance in identifying the cause of such a Personal Data Incident and take commercially reasonable steps to remediate the cause to the extent remediation is within its control.

‍7. Government Access Requests

‍In its role as a Processor, Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall maintain appropriate measures to protect Personal Data in accordance with the requirements of Data Protection Laws, including by implementing appropriate technical and organizational safeguards to protect Personal Data against any interference that exceeds what is necessary in a democratic society to safeguard national security, defense, and public security. If Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) receives a legally binding request to access Personal Data from a Public Authority, it shall, unless legally prohibited, promptly notify Customer and provide a summary of the nature of the request. Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall challenge the request if, after careful assessment, it considers that the request is unlawful. Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) will provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.

‍8. Return and Deletion of Personal Data

‍Upon termination of the Services for which Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) is Processing Personal Data, Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall, at Customer’s request, and subject to the limitations described in the Agreement and the Security Practices Datasheet, return all Personal Data in Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai)'s possession to Customer or securely destroy such Personal Data and demonstrate to Customer that it has taken such measures, unless applicable law prevents it from returning or destroying all or part of the Personal Data.

‍9. Limitation of Liability

‍The limitations and exclusions of liability provided for in the Agreement which are for the benefit of Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) shall apply to this DPA.

‍10. European Specific Provisions

‍For the purposes of this DPA, and the applicable Standard Contractual Clauses set out in Schedule 1, the parties agree to the following definitions:EU C-to-P Transfer Clauses refers to the Standard Contractual Clauses for Controller-to-Processor transfers.EU P-to-P Transfer Clauses refers to the Standard Contractual Clauses for Processor-to-Processor transfers.Customer, as the data exporter, and Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai), as the data importer, agree to the relevant Standard Contractual Clauses incorporated by reference in Schedule 1.

‍11. Legal Effect

‍This DPA shall only become legally binding between Customer and Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) when the Agreement is executed by the parties. For the avoidance of doubt, this DPA only applies if: (i) the Customer is subject to the GDPR or UK GDPR; and (ii) Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai), in the course of providing the Services under the Agreement, Processes Personal Data on behalf of Customer.

12. Governing Law

‍This DPA and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by, and construed in accordance with, the same laws applicable to the Agreement. This DPA shall be subject to the jurisdiction of the same courts as the Agreement.

13. Schedule 1: Transfer Mechanisms for European Data Transfers

‍For the purposes of the EU C-to-P Transfer Clauses and the EU P-to-P Transfer Clauses, Customer is the data exporter and Particle Automation, LLC, DBA Lacy Autonomous Intelligence (Lacy.ai) is the data importer. The Standard Contractual Clauses shall apply as outlined in the Agreement. 

‍