Personal Data Processing Agreement
This Personal Data Processing Agreement (the “Agreement”) is the data processing agreement referred to in Section 11 of the Public Offer and Section 12 of the Terms of Service. It forms part of the agreement between Logos Data LLC, a Wyoming limited liability company, and the Client, and applies automatically from the moment Logos Data processes Client Personal Data on the Client’s behalf, where a data processing agreement is required by applicable law or requested by the Client.
Capitalized terms not defined here have the meaning given in the Offer. This Agreement should be read together with our Privacy Policy.
Scope and Roles
This Agreement applies only where Logos Data LLC (the “Processor”) processes personal data on behalf of the Client (the “Controller”) in providing the Services under the Public Offer or the Terms of Service (“Client Personal Data”). It does not apply to personal data that Logos Data collects and uses for its own purposes as an independent controller, such as website visitors, account holders and business contacts; that processing is described in the Privacy Policy.
The Client decides why and how Client Personal Data is processed. The Processor processes it only to provide the Services.
Legal Framework
Logos Data LLC is a Wyoming limited liability company. Wyoming has not enacted a comprehensive consumer data privacy statute, so the Parties' data-protection duties arise primarily from this Agreement, from the Wyoming breach notification law (Wyo. Stat. §§ 40-12-501 to 40-12-502), from the Wyoming Consumer Protection Act (Wyo. Stat. § 40-12-101 et seq.), and from any other law that applies to the Client's data.
Where the GDPR, UK GDPR, the Swiss FADP or a US state privacy law applies to Client Personal Data, the Parties will also comply with the requirements of that law that apply to their respective roles, and Sections 9 and 11 apply accordingly.
Description of Processing
Processor Obligations
The Processor will:
- process Client Personal Data only on the Client's documented instructions, which consist of the Agreement, the applicable Order and the Client's use of the Services, unless law requires otherwise (in which case it will inform the Client where lawful);
- tell the Client if it believes an instruction violates applicable law;
- not sell Client Personal Data, and not use it for its own marketing or for any purpose outside the Services;
- ensure that personnel with access are bound by confidentiality obligations.
Client Obligations
The Client is responsible for having a lawful basis and all necessary notices and consents to provide Client Personal Data to the Processor, for the accuracy of that data, and for not submitting special-category or highly sensitive data without prior written agreement. The Client is also responsible for handling its own obligations to data subjects and regulators.
Technical and Organizational Measures
The Processor maintains commercially reasonable measures appropriate to the risk, including:
- access controls, least-privilege access and authentication for credentials, servers and APIs;
- encryption in transit and, where appropriate, at rest;
- logging, monitoring and vulnerability management;
- backups and incident response procedures;
- vendor review of hosting and infrastructure providers.
No system is completely secure. The Client remains responsible for protecting its own credentials, systems and integrations.
Use of Sub-processors
The Client gives general authorization for the Processor to engage sub-processors such as hosting, cloud infrastructure, email, support and payment providers. The Processor will bind each sub-processor to data-protection obligations no less protective than this Agreement and remains responsible for their performance.
The Processor will provide the current list of sub-processors on request and will give the Client reasonable prior notice of new sub-processors. The Client may object on reasonable data-protection grounds within 14 days; if the Parties cannot agree on a solution, the Client may stop using the affected Services.
Data Subject Requests
The Processor will promptly forward to the Client any request it receives from an individual about Client Personal Data and will not respond except to redirect the individual, unless the Client instructs otherwise. The Processor will provide reasonable assistance so the Client can respond to such requests. Assistance beyond the standard Services may be charged at the Processor's then-current rates.
International Data Transfers
The Processor operates from the United States. Where Client Personal Data subject to the GDPR, UK GDPR or Swiss FADP is transferred to the United States or another country without an adequacy decision, the Parties agree that the EU Standard Contractual Clauses (Module Two, or Module Three where the Client is itself a processor), and where relevant the UK Addendum, are incorporated by reference and take effect on the Client's written request. Wyoming law governs them to the extent permitted, and the relevant supervisory authority is the one determined under those clauses.
Security Incident Notification
The Processor will notify the Client without undue delay, and where feasible within 72 hours, after becoming aware of a confirmed breach affecting Client Personal Data, and will provide available information about its nature, likely impact and the steps taken. As data owner, the Client is responsible for deciding on and carrying out any notification to individuals, the Wyoming Attorney General, other regulators or consumer reporting agencies that law requires.
Assistance and Audits
The Processor will provide information reasonably needed to show compliance with this Agreement and will assist with data protection impact assessments and regulator consultations where required. The Client may audit once every 12 months on 30 days' written notice, during business hours, at its own cost and under confidentiality obligations. The Processor may satisfy this by providing recent third-party reports or written answers where reasonable.
Return and Deletion
When the Paid Period or Order ends, the Processor will, on the Client's written request made within 30 days, return or delete Client Personal Data. If no request is made, the Processor may delete it after a reasonable retention period. Data in backups is removed in the ordinary backup cycle, and data may be kept where law requires or for legitimate security, accounting and dispute-resolution purposes.
Liability, Governing Law and Precedence
Each Party's liability under this Agreement is subject to the limitations in the Public Offer (Section 13) or, where the Services are provided under the Terms of Service, the Terms. This Agreement is governed by the laws of the State of Wyoming, United States, and disputes are resolved as provided in the Offer or the Terms. If this Agreement conflicts with the Offer or the Terms on the processing of Client Personal Data, this Agreement prevails; if the Standard Contractual Clauses apply, they prevail over this Agreement.
Contact Us
For questions or requests under this Agreement, contact: