Lofty Data Processing Agreement

• Customer Instructions. The parties agree that this DPA and the Agreement (including instructions provided by Customer) constitute Customer’s documented instructions regarding Lofty’s processing of Customer Data (“Documented Instructions”). Lofty will process Customer Data only in accordance with Documented Instructions (which if Customer is acting as a processor, could be based on the instructions of its controllers). Additional instructions outside the scope of the Documented Instructions (if any) require prior written agreement between Lofty and Customer, including agreement on any additional fees payable by Customer to Lofty for carrying out such instructions. Customer is entitled to terminate this DPA and the Agreement if Lofty declines to follow instructions requested by Customer that are outside the scope of, or changed from, those given or agreed to be given in this DPA. Considering the nature of the processing, Customer agrees that it is unlikely Lofty can form an opinion on whether Documented Instructions conflict with the GDPR. If Lofty forms such an opinion, it will immediately inform Customer, in which case, Customer is entitled to withdraw or modify its Documented Instructions.

• Confidentiality of Customer Data. Lofty will not access or use, or disclose to any third party, any Customer Data, except, in each case, as necessary to maintain or provide the Services, or as necessary to comply with the law or a valid and binding order of a governmental body (such as a subpoena or court order). If a governmental body sends Lofty a demand for Customer Data, Lofty will attempt to redirect the governmental body to request that data directly from Customer. As part of this effort, Lofty may provide Customer’s basic contact information to the governmental body. If compelled to disclose Customer Data to a governmental body, then Lofty will give Customer reasonable notice of the demand to allow Customer to seek a protective order or other appropriate remedy unless Lofty is legally prohibited from doing so.

  • 3.1
    Subject matter. The subject matter of the data processing under this DPA is Customer Data.
  • 3.2
    Customer acknowledges that Lofty may change the security measures through the adoption of new or enhanced security technologies and authorizes Lofty to make such changes provided that they do not diminish the existing level of protection. Lofty shall make information about the most up to date security measures applicable to the Services available to Customer upon request.
• Confidentiality Obligations of Lofty Inc. Personnel. Lofty restricts its personnel from processing Customer Data without authorization by Lofty. Lofty imposes appropriate contractual obligations upon its personnel, including relevant obligations regarding confidentiality, data protection and data security.
• Assistance with Data Subject Requests.To the extent Customer does not have the ability to independently correct, amend, or delete Customer Personal Data, or block or restrict Processing of Customer Personal Data, then at Customer’s written direction and to the extent required by Data Protection Laws, Lofty shall comply with any legitimate and commercially reasonable request by Customer to facilitate such actions. Considering the nature of the processing, the Service Controls are the technical and organizational measures, Lofty will assist Customer in fulfilling Customer’s obligations to respond to data subjects’ requests under the GDPR. If a data subject makes a request to Lofty, Lofty will promptly forward such request to Customer once Lofty has identified that the request is from a data subject for whom Customer is responsible. Customer authorizes on its behalf, and on behalf of its controllers when Customer is acting as a processor, Lofty to respond to any data subject who makes a request to Lofty, to confirm that Lofty has forwarded the request to Customer.

• Security Incident Notification.

  • 6.1
    Security Incident. Lofty will (a) notify Customer of a Security Incident without unreasonable delay after becoming aware of the Security Incident, and (b) take appropriate measures to address the Security Incident, including measures to mitigate any adverse effects resulting from the Security Incident.
  • 6.2
    ​Lofty Assistance. To enable Customer to notify of a Security Incident, Lofty will cooperate with and assist Customer by including in the notification under this Section such information about the Security Incident as Lofty is able to disclose to Customer, taking into account the nature of the processing, the information available to Lofty, and any restrictions on disclosing the information, such as confidentiality. Considering the nature of the processing, Customer agrees that it is best able to determine the likely consequences of a Security Incident.

  • 6.3

    Unsuccessful Security Incidents. Customer agrees that:
    • 6.3.1. an unsuccessful Security Incident will not be subject to this Section. An unsuccessful Security Incident is one that results in no unauthorized access to Customer Data or to any of Lofty’s equipment or facilities storing Customer Data, and could include, without limitation, pings and other broadcast attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond headers) or similar incidents; and
    • 6.3.2. Lofty’s obligation to report or respond to a Security Incident under this Section is not and will not be construed as an acknowledgement by Lofty of any fault or liability Lofty with respect to the Security Incident.
  • 6.4
    Communication. Notification(s) of Security Incidents, if any, will be delivered to one or more of Customer’s administrators by any means Lofty selects, including via email. It is Customer’s sole responsibility to ensure Customer’s administrators maintain accurate contact information at all times.

• Audits and Inspections.

  • 7.1
    Internal Audits. Upon written request, Lofty shall provide, at its own expense, if available, any data security compliance reports or audit reports that assess the effectiveness of Lofty's information security program, system(s), internal controls, and procedures relating to the Processing of Customer Personal Data.
  • 7.2
    Customer Audits. Upon written request, Lofty agrees to respond, no more than once per year, to a reasonable information security questionnaire concerning security practices specific to the Services provided hereunder. Upon reasonable advance written notice in no case fewer than thirty (30) business days and Lofty acceptance, Customer may, not more than once per year, during normal business hours and at its own expense, inspect Lofty facilities, networks and procedures directly related to the processing of Customer Personal Data in order to determine compliance with this Agreement. Lofty shall reasonably cooperate with such audit by providing access to knowledgeable personnel, physical premises as applicable, documentation, infrastructure, and any application software that Processes Customer Personal Data. Customer shall be responsible for the costs and expenses of such an audit. Customer acknowledges that certain information about Lofty's security standards and practices are sensitive confidential information which will not be disclosed by Lofty to Customer.
  • 7.3
    Privacy Impact Assessment and Prior Consultation. Taking into account the nature of the processing and the information available to Lofty, Lofty will reasonably assist Customer at Customer’s cost and expense in complying with Customer’s obligations in respect of data protection impact assessments and prior consultation.

• International Transfers

  • 8.1
    Lofty​ may Process Customer Personal Data in the United States and anywhere else in the world where Lofty or its Sub-processors maintain data Processing operations. Lofty shall at all times provide an adequate level of protection for Customer Personal Data, in accordance with the requirements of Data Protection Laws.
  • 8.2
    To the extent performance of the Services requires the transfer of Customer Personal Data from within the European Union, the European Economic Area and their member states, Switzerland, or the United Kingdom to a country not recognized by the European Commission as providing an adequate level of protection for Personal Data (as described in the GDPR), the Standard Contractual Clauses will apply to the transfer and are incorporated by reference herein.
• Termination of the DPA. This DPA will continue in force until the termination of the Agreement (the “Termination Date”).
• Return or Deletion of Customer Data. At any time up to the Termination Date, and for 90 days following the Termination Date, subject to the terms and conditions of the Agreement, Lofty will return or delete Customer Data when Customer uses the Service Controls to request such return or deletion.

• Sub-processing.

  • 11.1
    Authorized Sub-processors. Customer provides general authorization to Lofty's use of sub-processors to provide processing activities on Customer Data on behalf of Customer (“Sub-processors”) in accordance with this Section. The Lofty lists of Sub-processors that are currently engaged by Lofty listed within Annex 1 of this agreement. At least 30 days before Lofty engages a Sub-processor, Lofty will update Annex 1 and provide Customer with a mechanism to obtain notice of that update. To object to a Sub-processor, Customer can: (i) terminate the Agreement pursuant to its terms; or (ii) cease using the Service for which Lofty has engaged the Sub-processor.

  • 11.2Sub-processor Obligations. Where Lofty authorizes a Sub-processor:

    • 11.2.1
      Lofty will restrict the Sub-processor’s access to Customer Data only to what is necessary to provide or maintain the Services in accordance with the Documentation, and Lofty will prohibit the Sub-processor from accessing Customer Data for any other purpose.
    • 11.2.2
      Lofty will enter into a written agreement with the Sub-processor and, to the extent that the Sub-processor performs the same data processing services provided by Lofty under this DPA, Lofty will impose on the Sub-processor the same contractual obligations that Lofty has under this DPA; and
    • 11.2.3
      Lofty will remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause Lofty to breach any of Lofty's obligations under this DPA.

• Requests, Demands, And Inquiries from Governmental or Regulatory Bodies.

  • 12.1
    Unless prohibited to do so by applicable law, Lofty shall inform Customer as soon as possible if it receives a request or demand from a governmental or regulatory body with authority over Lofty or Customer relating to Lofty's Processing of Customer Personal Data. Lofty may attempt to redirect the government or regulatory body to request that data directly from Customer. As part of this effort, Lofty may provide Customer’s basic contact information to the government or regulatory body. If compelled to disclose Customer Personal Data to a government or regulatory authority, then Lofty shall give Customer reasonable notice of the demand to allow Customer to seek a protective order or other appropriate remedy unless Lofty is legally prohibited from doing so.
  • 12.2
    ​Lofty​ shall provide commercially reasonable cooperation to assist Customer in its response to any requests from a Supervisory Authority relating to the Processing of Customer Personal Data under the Agreement and this DPA.
  • 12.3
    ​Authority in the performance of its tasks relating to this Section, to the extent required under any Data Protection Laws.

• MISCELLANEOUS.

  • 13.1
    Termination and Survival. This Agreement and all provisions herein shall survive so long as, and to the extent that, Lofty Processes or retains Customer Personal Data.
  • 13.2
    Counterparts. This Agreement may be executed in any number of counterparts and any Party (including any duly authorized representative of a Party) may enter into this Agreement by executing a counterpart.
  • 13.3
    Ineffective clause. If individual provisions of this Agreement are or become ineffective, the effectiveness of the remaining provisions shall not be affected. The Parties shall replace the ineffective clause with a legally allowed clause, which will accomplish the intended commercial intention as closely as possible.

• physical access to locations is limited to Lofty employees, subcontractors, and authorized visitors;
• Lofty employees, subcontractors, and authorized visitors are issued identification cards that must be worn while on premises;
• monitoring access to Lofty facilities, including restricted areas and equipment within facilities;
• access to the data center where Customer Personal Data is hosted is logged, monitored, and tracked; and
• data centers are secured with alarm systems and video cameras.

Technical Security Measures. Lofty shall:

• Perform vulnerability scanning on key applications and infrastructure.
• Identify computer systems and applications that warrant security event monitoring.
• Encrypt Personal Data in transit, and where needed, at rest.
• Deploy necessary system security patches to all software and systems that process or store Personal Data.
• Use up-to-date commercial virus/malware scanning software that identifies malicious code on all of its systems that collect, use, disclose, store, retain or otherwise Process Personal Data.
• Use an up-to-date multi-factor authentication solution to ensure that only authorized personnel have access to Customer Personal Data.
• Computers and servers have reasonable up-to-date versions of system security software which may include host firewall, anti-virus protection, and up-to-date patches and virus definitions.
• Lofty​ maintains logs of various components of the infrastructure and an intrusion detection system.