Data Processing Addendum
Effective date: October 30, 2026 · Last updated: October 30, 2026
For accounts created before the effective date: November 29, 2026 (Terms of Service, Section 17)
Key terms are marked with a colored bar on the left.
1. Scope
This Data Processing Addendum ("DPA") forms part of the Terms of Service between LexQ, LLC ("we", "us") and the customer that accepts them ("you"). It applies when Customer Data, as defined in the Terms, contains personal information that we process on your behalf. It sets out the terms that U.S. state privacy laws, including the California Consumer Privacy Act ("CCPA"), require between a business and its service provider or processor ("Privacy Laws"). Section 12 adds the terms that the EU and UK General Data Protection Regulations require. If the laws of another jurisdiction require additional terms, contact us at hello@lexq.io.
2. Roles and Instructions
You decide why and how personal information in Customer Data is processed, and you are the business or controller under the Privacy Laws. We are your service provider or processor. We process that personal information only on your instructions, which are the Terms, this DPA, and the way you configure and use the Service. If we believe an instruction violates the Privacy Laws, we will tell you.
3. Purpose, Data, and Duration
We process personal information in Customer Data only to provide, secure, and support the Service: to store your rules and facts, evaluate rules, run simulations and replays, keep execution logs, and help you when you ask. The personal information and the people it relates to are whatever you choose to include in Customer Data. Processing continues for as long as you use the Service and for the retention periods stated in the Terms.
4. Restrictions
We will not: (a) sell or share the personal information, as the CCPA defines those terms; (b) retain, use, or disclose it for any purpose other than those in Section 3, including any commercial purpose other than providing the Service; (c) retain, use, or disclose it outside our direct business relationship with you; or (d) combine it with personal information that we receive from or on behalf of another person, or collect from our own interactions with individuals, except as the Privacy Laws permit. We will comply with the Privacy Laws that apply to us as your service provider and give the personal information the level of privacy protection they require. We will tell you if we determine that we can no longer meet these obligations.
5. Your Right to Verify and Remediate
You may take reasonable and appropriate steps to ensure that we use the personal information consistently with your obligations under the Privacy Laws. We will answer your reasonable written questions about our processing and security within 30 days. On your reasonable request, we will make available to you the information in our possession that is necessary to demonstrate our compliance with the Privacy Laws. We will allow, and cooperate with, reasonable assessments by you or an assessor you designate. Alternatively, we may arrange for a qualified and independent assessor to assess our policies and our technical and organizational measures using an appropriate and accepted control standard or framework, and we will give you the report on request. If you notify us of unauthorized use of the personal information, you may take reasonable and appropriate steps to stop and remediate it, and we will cooperate.
6. Confidentiality and Security
We limit access to personal information in Customer Data to the people who need it to provide the Service, and they are bound by confidentiality. We protect it with the measures described in our Privacy Policy under Data Storage and Security, including encryption in transit and at rest, logical separation between tenants, and role-based access controls.
7. Subprocessors
We use Amazon Web Services, Inc. to host and store Customer Data in the United States. If you send Customer Data to us by email, it is stored in our business email, Google Workspace (Google LLC). Each subprocessor is bound by written terms that protect personal information at least as much as this DPA requires. We will notify you at least 30 days before we add or replace a subprocessor that processes Customer Data. If you object, you may export your Customer Data and delete your account before the change takes effect, and we will refund the fees you prepaid for the days left in your billing period, as described in our Refund Policy.
8. Requests from Individuals
You can view and export Customer Data in the console and API, and change or delete the rules, fact definitions, and other configuration you have created there. Execution logs and the files you upload for simulations cannot be changed or deleted there. If you instruct us in writing to delete specific personal information from them, we will delete it or irreversibly mask it within 7 days, confirm in writing when we have done so, and keep a record of the deletion. Copies in our backups are erased within a further 7 days. This is how we help you respond to requests from individuals under the Privacy Laws. If an individual contacts us directly about personal information in Customer Data, we will forward the request to you and will not respond to it except on your instructions or as the law requires.
9. Security Incidents
If we become aware of unauthorized access to, or acquisition of, personal information in Customer Data, we will notify you without undue delay, and in any event within 24 hours. The notice will describe what happened, the information involved, the steps we have taken, and how to reach us, and we will update it as we learn more.
10. Deletion
When your account is closed, we keep Customer Data for 30 days so that you can request a full export, then permanently delete it, and erase copies in our backups within a further 7 days, as stated in the Terms. If the law requires us to keep some of it longer, we keep only that data, and only for as long as the law requires.
11. Liability and Precedence
Our liability under this DPA is subject to the Limitation of Liability section of the Terms. If this DPA conflicts with the Terms, this DPA controls for personal information in Customer Data, unless an Enterprise agreement provides otherwise.
12. Customers Subject to the GDPR or UK GDPR
This section applies when your processing of personal information in Customer Data is subject to the EU General Data Protection Regulation ("GDPR") or the UK GDPR. You are the controller and we are your processor. In addition to the rest of this DPA: (a) we process the personal data only on your documented instructions, including with regard to transfers to a third country, unless the law requires otherwise, in which case we will tell you before processing unless the law prohibits it; (b) taking into account the nature of the processing and the information available to us, we help you meet your obligations under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessments, and prior consultation); (c) when the Service ends, we delete the personal data as described in Section 10, unless the law requires us to keep it; (d) by accepting this DPA, you give us general written authorization to engage the subprocessors listed in Section 7, and we will inform you of any intended addition or replacement as described there; and (e) we make available to you the information necessary to demonstrate our compliance with Article 28 of the GDPR, and we allow for and contribute to audits, including inspections, as described in Section 5. Because we process Customer Data in the United States, the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA for any transfer of personal data from the European Economic Area, with you as the data exporter and us as the data importer. For those clauses: Clause 7 does not apply; under Clause 9, option 2 applies, with the notice period in Section 7; the optional wording in Clause 11 does not apply; under Clause 17, option 2 applies, and if the law of the Member State in which you are established does not allow for third-party beneficiary rights, the law of Ireland applies; under Clause 18, the courts of the Member State whose law governs the clauses have jurisdiction; Annex I is completed by Sections 1 to 3 of this DPA, and the competent supervisory authority is the one competent for you; Annex II is Section 6 of this DPA; and Annex III is the list in Section 7. For transfers from the United Kingdom, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner applies, completed with the information in this section, and either party may end it as the Addendum allows. If the Standard Contractual Clauses conflict with this DPA, the clauses control.
13. Contact
For questions about this DPA, contact us at hello@lexq.io, or write to LexQ, LLC, 2810 N Church St, STE 90966, Wilmington, DE 19802, USA.
LexQ, LLC|2810 N Church St, STE 90966, Wilmington, DE 19802, USA|hello@lexq.io