Data Processing Addendum

The customer determines purpose and means and provides lawful instructions. Lancaster Solutions LLC processes covered data to provide, secure, support, and improve the contracted service.

Authorized personnel and subprocessors should be bound by appropriate confidentiality and security obligations reflecting the data and risk.

Lancaster Solutions LLC uses the providers identified in the published subprocessor register for hosting, email, billing, abuse prevention, and related operations. Contracts and technical controls require processing only for the stated service purpose.

The parties should define assistance for rights requests, assessments, deletion, return, and incidents, including contacts and timelines.

Where applicable, the parties should use an approved transfer mechanism. Data is returned or deleted according to the agreement, except where retention is legally required or persists temporarily in protected backups.

• Assign an owner for implementing and reviewing the obligations described in Data Processing Addendum.
• Map the policy to product settings, contracts, support procedures, data flows, records, and staff responsibilities.
• Keep the public language aligned with actual production behaviour and contracted commitments.
• Retain approval, effective-date, change-history, and customer-notice records.

• A material product, pricing, data-processing, security, vendor, or support change.
• A new jurisdiction, customer class, contract requirement, or regulatory obligation.
• An incident, complaint, audit finding, or operational exception that shows the published process is incomplete.
• A change that could create testing outside the approved scope or at an unsafe rate.