Data Processing Addendum

Effective date: 31 August 2026

This Data Processing Addendum (DPA) forms part of the agreement between Lydmera Limited, company number 78292 (Lydmera) and the Customer that has accepted the Lydmera Terms of Service (Customer). Customer is a Controller or Processor, and Lydmera is its Processor or Subprocessor, as applicable to the processing.

It applies only where Lydmera processes personal data on Customer’s behalf in Customer Content. It does not govern data for which Lydmera or Paddle acts as an independent controller, as described in the Privacy Notice.

1. Definitions and interpretation

In this DPA:

• Applicable Data Protection Law means the Data Protection (Bailiwick of Guernsey) Law, 2017 and, to the extent applicable to the processing, the UK GDPR, Data Protection Act 2018, EU GDPR, another applicable data-protection law, and implementing or replacement legislation;
• Customer Personal Data means personal data contained in Customer Content that Lydmera processes as Processor on Customer’s behalf under the agreement;
• Data Subject, Personal Data Breach, personal data, process/processing, processor and controller have the meanings given by Applicable Data Protection Law;
• Restricted Transfer means a transfer of personal data that requires an adequacy decision, appropriate safeguard or other transfer mechanism under Applicable Data Protection Law;
• Subprocessor means another processor appointed by Lydmera to process Customer Personal Data; and
• Terms means the Lydmera Terms of Service, including the relevant Order.

Capitalised terms not defined here have the meaning in the Terms. A reference to law includes an amendment or replacement. If several data-protection regimes apply, the requirement offering the relevant person the greater protection applies to the extent the requirements can operate together.

2. Scope, roles and hierarchy

Customer determines the purposes and essential means of processing Customer Personal Data, or has authority from the relevant Controller to pass its instructions to Lydmera. Lydmera processes the data as Processor or Subprocessor only to provide, secure, support and terminate the Service and to comply with Customer’s documented instructions.

Each party is separately responsible for personal data it processes as controller. Lydmera is a controller for Account administration, authentication, Subscription reconciliation, service security, support, legal compliance and its own business records. Paddle is an independent controller for buyer and transaction activity as reseller/Merchant of Record.

If this DPA conflicts with the Terms on processing Customer Personal Data, this DPA controls. A signed Order controls only where it expressly identifies the DPA provision it changes. Mandatory law and an applicable transfer mechanism prevail over conflicting contract wording.

3. Customer instructions and responsibilities

The Terms, Order, Customer’s configured use of the Service and documented support requests are Customer’s complete instructions at the effective date. Customer may give additional lawful instructions that are consistent with the Service. A material change in scope, cost or technical operation may require a written agreement, but Lydmera will not charge merely for complying with a non-excludable legal duty.

Lydmera will:

• process Customer Personal Data only on documented instructions, including for a Restricted Transfer, unless law binding on Lydmera requires otherwise;
• where legally permitted, inform Customer before processing required by law; and
• tell Customer promptly if, in Lydmera’s reasonable opinion, an instruction infringes Applicable Data Protection Law, and pause the affected processing where necessary while the parties clarify it.

Customer is responsible for:

• having authority, a lawful basis and appropriate notices for Customer Personal Data and the instructions;
• where Customer is a Processor, ensuring that its Controller authorises Customer to appoint Lydmera and the listed Subprocessors and that the instructions reflect that Controller’s documented instructions;
• collecting and uploading only data needed for the project;
• the accuracy and legality of the data and any response to a Data Subject;
• obtaining any consent or authorisation required for AI-assisted processing or international transfers;
• configuring access and removing users who no longer need it; and
• not submitting prohibited or highly regulated data contrary to the Terms or AUP unless the parties first agree a suitable written workflow.

Customer must not instruct Lydmera to process data in a manner that infringes law or another person’s rights.

4. Confidentiality and people

Lydmera will ensure that each person authorised to process Customer Personal Data:

• has access only to the extent needed for assigned duties;
• is bound by an appropriate statutory or contractual confidentiality obligation;
• receives relevant privacy and security instructions; and
• processes the data only in accordance with this DPA, except where law requires otherwise.

The confidentiality duty continues after access or employment ends.

5. Security

Taking account of the state of the art, implementation cost and the nature, scope, context and purposes of processing, Lydmera will maintain technical and organisational measures appropriate to the likelihood and severity of risk to people.

The current minimum measures are described in Schedule 2. Lydmera may update a measure where the change does not materially reduce the overall protection of Customer Personal Data. A public Security Overview is only a summary and does not replace Schedule 2.

Customer acknowledges that security is shared: Customer remains responsible for its devices, email accounts, user permissions, input minimisation, exports and any systems to which it sends an Output.

6. Subprocessors

Customer gives Lydmera general written authorisation to use the Subprocessors listed in the current Subprocessor Register for the services and locations stated there.

Before a new or replacement Subprocessor begins processing Customer Personal Data, Lydmera will:

• carry out proportionate diligence on privacy, security and transfer risks;
• enter a binding written agreement imposing data-protection obligations that provide an equivalent level of protection for the relevant processing;
• update the Subprocessor Register; and
• give affected Customer administrators reasonable advance notice, aiming for at least 30 days for a material non-emergency change.

Customer may object during the notice period on reasonable and documented data-protection grounds. The parties will work in good faith on a commercially reasonable solution. If no solution is reasonably available, Lydmera may choose not to appoint the Subprocessor or either party may terminate only the affected Service before that Subprocessor begins processing. The transaction refund, credit or other financial consequence will be handled through Paddle or the signed Order as applicable; this clause does not create a direct Lydmera refund mechanism for a Paddle transaction.

An urgent change needed for security, provider failure or law may take effect sooner. Lydmera will notify Customer as soon as reasonably practicable and preserve the objection process to the extent still meaningful.

Lydmera remains responsible to Customer for a Subprocessor’s performance of the obligations Lydmera delegates to it, subject to the agreement and Applicable Data Protection Law.

7. Data-subject requests

Taking account of the nature of the processing, Lydmera will provide appropriate technical and organisational assistance reasonably needed for Customer to respond to a request to exercise a data-protection right.

If Lydmera receives a request relating to Customer Personal Data, it will not respond on the merits except on Customer’s documented instruction or where law requires. It will refer the request to Customer without undue delay where Customer can be identified. Customer is responsible for the response and statutory deadline.

Lydmera may require proportionate verification before acting on an instruction and will not disclose another customer’s data.

8. Personal-data breaches

Lydmera will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will include, as information becomes reasonably available:

• the nature of the breach, systems and approximate categories/number of affected people and records;
• likely consequences;
• measures taken or proposed to contain, investigate and mitigate it;
• information reasonably needed for Customer’s risk assessment and notifications; and
• a contact for follow-up.

Information may be provided in phases. Notification is not an admission of fault or liability. Lydmera will take reasonable steps to contain and remediate the breach, preserve appropriate records and cooperate with Customer’s legally required response.

Customer decides whether and when it must notify a regulator or Data Subject for processing where it is controller. Lydmera will not notify them on Customer’s behalf unless Customer instructs it or law requires Lydmera to do so.

The phrase “without undue delay” is deliberate. This DPA does not promise a fixed 24- or 72-hour customer-notification period; Customer’s regulator deadline may run from Customer’s own awareness, so both parties must escalate immediately.

9. Compliance assistance

Taking account of the nature of processing and information available to it, Lydmera will provide reasonable assistance with Customer’s obligations concerning:

• security of processing;
• breach assessment and notification;
• data-protection impact assessments; and
• prior consultation with a supervisory authority.

Customer remains responsible for deciding whether a DPIA or consultation is required and for its content. Lydmera may provide standard documentation first. Work that is bespoke, extensive and not required because of Lydmera’s breach may be subject to a mutually agreed reasonable fee.

10. Information and audits

Lydmera will make available information reasonably necessary to demonstrate compliance with this DPA. This may include the DPA, Subprocessor Register, current security summaries, independent assurance reports held by Lydmera or its providers, and answers to proportionate questionnaires.

If that material is reasonably insufficient, Customer may audit the relevant processing itself or through an independent auditor that is not a competitor and is bound by confidentiality. Unless a suspected breach, regulator request or material non-compliance justifies more, an audit is limited to once in any 12 months and must:

• be requested on at least 30 days’ written notice;
• occur during normal business hours with minimal disruption;
• be scoped to Customer Personal Data and this DPA;
• avoid access to another customer’s data, provider-confidential information, source code, vulnerability details or systems where access would create a security risk; and
• comply with reasonable site, safety and security rules.

The requesting Customer bears its audit costs. Lydmera bears its own ordinary cooperation costs, but the parties may agree a reasonable fee for disproportionate work. This does not restrict a regulator’s powers or a non-excludable audit right.

Lydmera will inform Customer if, in its opinion, an instruction under this section infringes Applicable Data Protection Law.

11. Return and deletion

During the Subscription, Customer may use available export and deletion functions. On termination or expiry, and at Customer’s choice, Lydmera will return Customer Personal Data in a reasonable standard machine-readable format or delete it and existing copies, unless law requires retention. Customer should communicate a return instruction before termination or promptly afterwards so that the data remains available for export. This DPA return right is not restricted by a commercial report-export feature or plan tier.

If Customer gives no contrary instruction, deletion is the default. Lydmera will complete active-system deletion without undue delay through its documented account-closure and deletion process.

Data remaining temporarily in restricted disaster-recovery backups will be protected, not used for another purpose and deleted through the ordinary overwrite cycle. If restored for disaster recovery, it will be placed back under the deletion instruction. Lydmera may retain limited controller records required for transactions, security, legal claims and proof of compliance; those records are not Customer Personal Data processed solely on Customer’s behalf.

On request, Lydmera will confirm completion of deletion to the extent reasonably verifiable.

12. International transfers

Lydmera will not make a Restricted Transfer of Customer Personal Data unless a lawful mechanism applies and the parties comply with it. Depending on the flow, this may include:

• an adequacy decision or regulation covering the recipient and data;
• the European Commission Standard Contractual Clauses, using the controller-to-processor or processor-to-processor module as appropriate;
• the UK International Data Transfer Addendum or another UK-approved mechanism;
• the European Commission clauses used with the Bailiwick of Guernsey Addendum, or another authorised mechanism under Guernsey law; or
• a valid exception used only where its conditions are met.

Where Customer’s transfer to Lydmera is covered by Guernsey adequacy, no separate SCC is required for that transfer within the adequacy decision’s scope. Adequacy for Guernsey does not automatically cover Lydmera’s onward transfer to a provider in another country.

For an onward Restricted Transfer, Lydmera will conduct the assessment required by the applicable regime, implement proportionate supplementary measures and require the relevant Subprocessor to comply with the selected mechanism.

Transfers into Guernsey from the UK or EEA ordinarily do not require standard clauses while the applicable adequacy recognition remains in force and covers the transfer. If a Customer-to-Lydmera Restricted Transfer is not covered by adequacy or another valid mechanism, the parties will complete the appropriate official clauses, module and mandatory appendices before that processing begins. Schedule 3 records the intended approach and does not replace a mandatory field that must be selected for the actual exporter and data flow.

13. Government and third-party demands

Unless prohibited by law, Lydmera will notify Customer before disclosing Customer Personal Data in response to a binding demand. Lydmera will review the demand, disclose only data it reasonably believes is legally required and challenge or seek clarification of a demand where there are reasonable grounds and law permits.

Lydmera will maintain a record of legally compelled disclosures as required by Applicable Data Protection Law.

14. Records and cooperation

Each party will maintain records for its own legal duties and cooperate in good faith with a competent supervisory authority. Lydmera will make its processing records concerning Customer Personal Data available to the authority where legally required.

Customer will promptly give Lydmera accurate contact details for privacy and incident notices. Notices to Customer may be sent to the Account administrator or privacy contact on the Order. Notices to Lydmera go to privacy@lydmera.com.

15. Liability, term and termination

This DPA begins when the Terms bind Customer and continues while Lydmera processes Customer Personal Data. The liability provisions of the Terms apply to this DPA, subject to mandatory Applicable Data Protection Law.

An obligation that by nature must continue—including confidentiality, deletion, audit of pre-termination processing and transfer protection—survives termination.

16. Governing law

The governing-law and dispute provisions in the Terms apply to this DPA, without restricting a Data Subject’s rights or the powers of a competent supervisory authority.

Schedule 1 — Processing details

Schedule 2 — Technical and organisational measures

Schedule 3 — Restricted-transfer details

This Schedule applies only to a transfer that requires the relevant clauses. The applicable module and jurisdiction-specific terms are determined by the parties’ roles, the exporter and the data flow.