This Data Processing Addendum ("DPA") forms part of the Lakewave Terms of Service or other agreement between Lynbrook Solutions LLC, doing business as Lakewave.ai ("Lakewave"), and the customer identified in the account or order form ("Customer") governing Customer's use of the Service (the "Agreement"). It applies to the extent Lakewave processes Customer Personal Data on Customer's behalf in providing the Service and Data Protection Law applies to that processing. If there is a conflict between this DPA and the Agreement about the processing of personal data, this DPA controls. If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses control.
For Customer Personal Data, Customer is the controller (or a processor acting for another controller) and Lakewave is the processor. Where Customer is itself a processor, Customer warrants that its instructions to Lakewave are authorized by the relevant controller.
This DPA does not apply to personal data for which Lakewave is an independent controller, including Customer's account information and the Prospect data that Lakewave assembles from public and third-party sources and licenses to Customer through the Service. Lakewave's processing of that data is described in the Privacy Policy. Once Customer selects, stores, or contacts a Prospect within its account, the resulting records in Customer's account are Customer Personal Data for the purposes of this DPA.
Lakewave will process Customer Personal Data only on Customer's documented instructions, which consist of: (a) the Agreement and this DPA; (b) Customer's use of the Service and its features, including configuration choices, campaign settings, and actions taken by Customer's users; and (c) other written instructions that Customer gives and Lakewave accepts. Lakewave will inform Customer if it believes an instruction violates Data Protection Law, and may suspend the affected processing until the instruction is confirmed or changed. Lakewave may process Customer Personal Data where required by law, in which case it will inform Customer before processing unless the law prohibits it.
Lakewave will not use Customer Personal Data to train artificial intelligence or machine learning models, and will contractually prohibit its AI Sub-processor from doing so. Lakewave may generate and use aggregated or de-identified data derived from Customer Personal Data, in a form that does not identify Customer, its users, or any data subject, to operate and improve the Service, as described in Section 10 of the Terms of Service.
Customer is responsible for: (a) the accuracy, quality, and lawfulness of Customer Personal Data and of the means by which it was obtained; (b) providing any notices and obtaining any consents required for Lakewave to process Customer Personal Data as instructed, and for Customer's outreach to data subjects; (c) ensuring that its instructions comply with Data Protection Law; (d) configuring and using the Service in a way that meets its own obligations, including honoring opt-outs and maintaining suppression lists; and (e) not providing Lakewave with special categories of data, data about children, or data subject to sector-specific laws such as HIPAA or the Gramm-Leach-Bliley Act, unless agreed in writing.
Lakewave will ensure that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations, receive appropriate training, and access Customer Personal Data only to the extent needed to provide the Service, support, or security operations.
Lakewave will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, the costs of implementation, the nature of the data, and the risks presented. The current measures are described in Annex 2. Lakewave may update these measures from time to time, provided that updates do not materially reduce the overall level of protection.
Customer gives Lakewave general authorization to engage Sub-processors. The current Sub-processors are listed in Section 6 of the Privacy Policy, which serves as the Sub-processor list for this DPA. Lakewave will:
Customer may object on reasonable data protection grounds within the notice period by emailing [email protected]. The parties will discuss the objection in good faith. If Lakewave cannot reasonably accommodate it, Customer may terminate the affected Service and receive a refund of prepaid fees for the unused portion of the term, as its sole remedy.
Taking into account the nature of the processing, Lakewave will assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer's obligation to respond to data subject requests under Data Protection Law. The Service provides self-service tools for accessing, correcting, exporting, and deleting Customer Personal Data. If Lakewave receives a request directly from a data subject relating to Customer Personal Data, it will, where the data subject's identity and the relevant Customer can be determined, forward the request to Customer without undue delay and will not respond substantively except to acknowledge it or as required by law. Lakewave may independently act on requests from Prospects to be suppressed from the Service, as described in the Privacy Policy, and will inform Customer where a suppressed Prospect is in Customer's records.
Lakewave will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed to address it, and a contact point. Lakewave will update the notice as more information becomes available and will cooperate reasonably with Customer's investigation and any notifications Customer must make. Lakewave's notice is not an admission of fault or liability.
Lakewave will provide Customer with reasonable assistance, taking into account the nature of the processing and the information available to it, with data protection impact assessments and prior consultations with supervisory authorities that Data Protection Law requires of Customer in relation to the Service.
Lakewave will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including summaries of security reviews and completed security questionnaires. Not more than once in any 12-month period, or when required by a supervisory authority or following a personal data breach, Customer may conduct an audit of Lakewave's compliance with this DPA, on at least 30 days' written notice, during business hours, without unreasonable disruption to Lakewave's operations, and subject to reasonable confidentiality obligations. Customer may use an independent third-party auditor who is not a competitor of Lakewave. Lakewave may charge its reasonable costs for audits beyond the first in any 12-month period. Before an on-site audit, the parties will first attempt to satisfy the audit through documentation and remote review.
Lakewave is located in the United States. To the extent Customer Personal Data originates in the EEA, the UK, or Switzerland and is transferred to Lakewave or its Sub-processors outside those regions in a country not recognized as providing adequate protection, the parties agree as follows.
The SCCs are incorporated into this DPA and apply to such transfers, with Module Two (controller to processor) applying where Customer is a controller and Module Three (processor to processor) where Customer is a processor. For the purposes of the SCCs: Customer is the data exporter and Lakewave is the data importer; Clause 7 (docking clause) applies; in Clause 9, Option 2 (general authorization) applies with the notice period in Section 8 of this DPA; in Clause 11, the optional language does not apply; in Clause 17, Option 1 applies and the governing law is the law of Ireland; in Clause 18, the courts of Ireland have jurisdiction; Annex I and Annex II of the SCCs are completed by Annex 1 and Annex 2 of this DPA; and the competent supervisory authority is determined under Clause 13 based on Customer's establishment.
The UK Addendum applies to transfers of personal data subject to the UK GDPR, with the SCCs as modified above forming the Approved EU SCCs, Tables 1 to 3 completed by the information in this DPA and its Annexes, and, for Table 4, both parties entitled to end the UK Addendum as set out in section 19 of it.
For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with references to the GDPR read as references to that Act, the competent authority being the Swiss Federal Data Protection and Information Commissioner, and the term "member state" not being interpreted to exclude Swiss data subjects from enforcing their rights in Switzerland.
If Lakewave adopts an alternative recognized transfer mechanism (such as certification to a data privacy framework), it may rely on that mechanism instead, and will notify Customer. If a mechanism relied on is invalidated, the parties will cooperate in good faith to implement a replacement.
Customer may export Customer Personal Data at any time during the term through the Service or by request. Within 30 days after termination of the Agreement, Lakewave will delete Customer Personal Data, unless Customer has requested export before deletion or retention is required by law. Data in encrypted backups is deleted on the regular rotation schedule, within 90 days, and remains protected by this DPA until deleted. Lakewave may retain de-identified data as permitted in Section 4.
To the extent the CCPA or another U.S. state privacy law applies to Customer Personal Data, Lakewave acts as a service provider or processor to Customer, and Customer discloses Customer Personal Data to Lakewave only for the limited and specified business purpose of providing the Service. Lakewave will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose it for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship between the parties; or (c) combine it with personal information from other sources, except as permitted for service providers under the CCPA. Lakewave will comply with applicable obligations under the CCPA and provide the same level of privacy protection the CCPA requires, will notify Customer if it determines it can no longer meet its obligations, and grants Customer the right to take reasonable and appropriate steps to stop and remediate unauthorized use. Lakewave certifies that it understands these restrictions.
Each party's liability under this DPA, including the SCCs, is subject to the exclusions and limitations of liability in the Agreement, except to the extent Data Protection Law does not permit such limitation. The parties agree that any regulatory penalties incurred by one party as a result of the other party's breach of this DPA reduce the breaching party's remaining liability cap under the Agreement accordingly. This DPA terminates automatically when Lakewave has deleted or returned all Customer Personal Data. If any provision is unenforceable, the rest remains in effect. Lakewave may update this DPA to reflect changes in Data Protection Law or the Service with notice as described in the Agreement, provided that changes do not materially reduce the protections for Customer Personal Data. Previous versions are linked in the footer.
| Data exporter | Customer, as identified in its Lakewave account or order form. Role: controller (or processor). Contact: the account owner's email address. |
|---|---|
| Data importer | Lynbrook Solutions LLC, doing business as Lakewave.ai, 117 Bernal Road #70, San Jose, CA 95119, United States. Role: processor. Contact: [email protected]. |
| Categories of data subjects | Customer's employees, contractors, and authorized users; business contacts (Prospects) that Customer uploads, selects, stores, or contacts through the Service; recipients who reply to Customer's messages. |
| Categories of personal data | Names, job titles, employers, business email addresses, business phone numbers, business addresses, professional profile links, message content, campaign and engagement data (sends, opens where enabled, replies, opt-outs), and account and usage data for Customer's users. |
| Special categories | None. Customer agrees not to submit special categories of data. |
| Frequency of transfer | Continuous, for the duration of the Agreement. |
| Nature and purpose | Hosting, storage, contact discovery and verification, AI-assisted drafting, scheduling and sending email on Customer's behalf, reply routing, analytics, support, and security, as needed to provide the Service. |
| Duration and retention | The term of the Agreement plus the deletion period in Section 13. |
| Sub-processor transfers | As listed in the Privacy Policy, for the purposes stated there and for the duration of the Agreement. |
| Competent supervisory authority | Determined under Clause 13 of the SCCs by reference to the data exporter's establishment or representative. |