LighChat Data Processing Agreement (DPA)

Last updated: 2026-08-03 Version: 2 Applies to: business customers who use LighChat to process personal data of their employees or their own users.

Template. This DPA is entered into with each business customer. Consumers do not need it — individual use is governed by the Privacy Policy. To execute it, write to legal@lighchat.online.

1. Parties

• Controller: [CUSTOMER LEGAL ENTITY] (the "Customer").
• Processor: KDS Consulting, Inc., a Florida corporation, 1730 S Federal Hwy, Suite 160, Delray Beach, FL 33483, United States ("LighChat").

This DPA is an addendum to the agreement under which LighChat provides the Service (the "Main Agreement") and prevails over it on data-protection matters.

2. Subject matter

LighChat processes the personal data of the Customer's users (the "Data") solely on the Customer's documented instructions, in accordance with GDPR Art. 28 and, where applicable, the UK GDPR and U.S. state privacy laws. The Main Agreement, this DPA and the Customer's use of the Service's configuration options constitute the complete instructions.

If LighChat believes an instruction infringes data-protection law, it will inform the Customer and may suspend that instruction.

3. Categories of data and data subjects

• Data subjects: the Customer's employees and contractors, the Customer's end users, and meeting guests.
• Data categories: identifiers (name, username, email, phone), communications content (messages, media, call metadata), technical data (IP, device information, push tokens).
• Special categories: not intentionally processed; content is not inspected by LighChat.

4. Duration

Processing lasts for the term of the Main Agreement plus the deletion periods in Section 11.

5. LighChat's obligations

LighChat shall:

• process the Data only on the Customer's documented instructions, including for transfers to third countries, unless required otherwise by law (in which case it informs the Customer, unless the law prohibits it);
• ensure that personnel with access to the Data are bound by confidentiality obligations;
• implement the technical and organisational measures in Section 9;
• assist the Customer, taking into account the nature of processing, with data-subject requests, with security of processing, with breach notification, and with data-protection impact assessments (GDPR Arts. 32–36);
• make available the information necessary to demonstrate compliance and allow audits under Section 12;
• engage subprocessors only under Section 6.

6. Subprocessors

The Customer grants LighChat general written authorisation to engage subprocessors. The current list is in the Subprocessor Registry.

LighChat imposes on each subprocessor data-protection obligations no less protective than this DPA and remains fully liable for their performance.

LighChat notifies the Customer of any intended addition or replacement of a subprocessor at least 14 days in advance. The Customer may object on reasonable data-protection grounds within that period; if the parties cannot agree on a solution, the Customer may terminate the affected part of the Main Agreement without penalty.

7. The Customer's obligations

The Customer shall: ensure a lawful basis for the processing; provide the information required by GDPR Arts. 13–14 to its data subjects; ensure its instructions comply with law; and configure the Service appropriately (retention, access, sharing settings).

8. Personal data breaches

LighChat notifies the Customer without undue delay and no later than 24 hours after becoming aware of a personal data breach affecting the Data, providing: the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed, and a contact point. LighChat assists the Customer in meeting its own notification duties under GDPR Arts. 33–34.

9. Security measures

• encryption in transit (TLS 1.2+) and at rest (AES-256) at the infrastructure layer;
• optional end-to-end encryption for chats and calls;
• role-based, least-privilege access control and multi-factor authentication for administrative access;
• security rules enforced server-side and covered by an automated test suite;
• audit logging of administrative operations;
• vulnerability disclosure programme (see the Security Policy);
• regular review of measures; changes must not lower the overall level of security.

10. Data-subject requests

Where a data subject contacts LighChat directly, LighChat refers them to the Customer and forwards the request without undue delay. LighChat provides technical assistance to the Customer within 10 business days.

11. Deletion and return

On termination of the Main Agreement, LighChat deletes or returns the Data at the Customer's choice within 30 days, except where storage is required by law. Backups are purged within a further 90 days on the ordinary rotation cycle.

12. Audit

Once per calendar year, on 30 days' written notice, the Customer may audit compliance with this DPA — by questionnaire, by review of available reports, or by an independent auditor under NDA. Audits take place during business hours, must not disrupt the Service, and must respect the confidentiality of other customers' data. Additional audits may be conducted after a personal data breach.

13. International transfers

Personal data is processed in the United States and in other locations listed in the Subprocessor Registry. Transfers from the EEA are made under the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller-to-processor), with the UK Addendum for transfers from the United Kingdom and the Swiss adaptations where relevant. Those clauses are incorporated into this DPA by reference; in case of conflict, they prevail.

Docking clause: Clause 7 applies. Option 2 of Clause 9(a) (general authorisation of subprocessors) applies with a 14-day notice period. The governing law and forum under Clauses 17–18 are those of Ireland unless the Customer is established in another EEA member state, in which case that state's law and courts apply.

14. Liability

Each party's liability under this DPA is subject to the limitations in the Main Agreement, except where those limitations are prohibited by data-protection law.

15. Governing law

Except for the Standard Contractual Clauses (Section 13), this DPA is governed by the law of the State of Florida, unless the Main Agreement specifies otherwise.

16. Contact

Data protection contact: privacy@lighchat.online Legal: legal@lighchat.online KDS Consulting Inc, 1730 S Federal Hwy, Suite 160, Delray Beach, FL 33483, USA