Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Limnn (Private) Limited (“Limnn”) and the customer (“Customer”) and applies whenever Limnn processes Customer Personal Data in providing the Services. It applies automatically when Customer accepts the Terms; customers that need a countersigned copy can request one from legal@limnn.com.

“Customer Personal Data” means personal data in Customer Data that Limnn processes on Customer's behalf. “Data Protection Laws” means laws that apply to that processing, including the EU GDPR, UK GDPR and Data Protection Act 2018, Swiss FADP and US state privacy laws, where applicable. Terms such as controller, processor, data subject and personal data breach have the meanings given in the GDPR.

Customer is the controller (or a processor acting for its own controller) and Limnn is a processor (or sub-processor) of Customer Personal Data. Where US state laws apply, Limnn is a “service provider” or “processor” and will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship, or combine it with other data except as those laws permit. Limnn is an independent controller for account, billing, security and website data described in the Privacy Policy.

Limnn processes Customer Personal Data only on Customer's documented instructions, which are: the Terms and this DPA; Customer's configuration and use of the Services (including the modules, integrations, automations and AI features it enables); and any other written instructions agreed by the parties. Limnn will tell Customer if it believes an instruction breaks Data Protection Laws, and is not required to follow it. Customer is responsible for the lawfulness of its instructions and for having a lawful basis and giving notices for the data it puts into the Services.

Limnn ensures that personnel authorised to process Customer Personal Data are bound by confidentiality obligations, and limits access to those who need it to provide, support or secure the Services.

Limnn implements the technical and organisational measures in Annex II and may update them as long as the overall level of protection is not reduced. Customer is responsible for its own configuration: roles, MFA, SSO, IP allow-lists, sharing of file links, call-recording settings and the like.

Customer authorises Limnn to use the sub-processors listed at Sub-processors & Data. Limnn imposes data protection terms on each sub-processor that protect Customer Personal Data to the standard of this DPA and remains responsible for their performance. Limnn will notify Customer by email at least 30 days before a new sub-processor begins processing Customer Personal Data. Customer may object on reasonable data-protection grounds within that period; the parties will discuss in good faith, and if they cannot resolve it Customer may terminate the affected Services and receive a refund of prepaid fees for the unused period.

The Services include tools that let Customer respond to data subjects itself: record editing and deletion, CSV export, a data-subject access report and a data-subject erasure job (Settings → Data management), described at Sub-processors & Data. If Limnn receives a request directly from a data subject about Customer Personal Data, it will refer the person to Customer and not respond itself except to confirm the referral. Limnn will provide reasonable additional assistance with requests that the tools do not cover, with data protection impact assessments and with prior consultations, taking into account the nature of the processing and the information available to Limnn.

Limnn will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Limnn will update Customer as more information becomes available and take reasonable steps to contain and remedy the breach. Notification is not an admission of fault.

During the subscription Customer can export and delete Customer Personal Data using the Services. After the Terms end, Customer may export its data while the workspace remains available and may ask Limnn to delete the workspace; Limnn will then delete Customer Personal Data from its live systems. Copies in encrypted database backups are deleted when those backups expire on their retention schedule. Limnn may keep data where law requires it, protected under this DPA.

Limnn will make available the information reasonably necessary to demonstrate compliance with this DPA, including by answering a reasonable written security questionnaire once a year. Limnn does not currently hold third-party certifications or audit reports. If the information provided is not sufficient to meet Customer's obligations, or a regulator requires it, Customer may conduct an audit at its own cost, on at least 30 days' notice, during business hours, limited to what is necessary and subject to confidentiality, and without access to other customers' data.

Limnn operates globally, and Customer Personal Data may be stored and processed in countries other than the one where Customer or its users are located. Our sub-processors are listed at Sub-processors & Data. To the extent Customer Personal Data subject to EU, UK or Swiss law is transferred to a country without an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Decision 2021/914) are incorporated by reference, Module 2 where Customer is a controller and Module 3 where Customer is a processor, with Customer as data exporter and Limnn as data importer, the optional docking clause included, Clause 11 optional language omitted, the Clause 9(a) general-authorisation option with the notice period in this DPA, and Annexes I and II of this DPA completing the SCC annexes. For UK transfers the UK International Data Transfer Addendum applies, and for Swiss transfers the SCCs apply with the references adapted to the FADP. If the SCCs conflict with this DPA, the SCCs prevail.

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not permit that. If this DPA conflicts with the Terms on data protection, this DPA prevails.

This DPA is governed by the law that governs the Terms (the laws of the State of Delaware, USA), except that the Standard Contractual Clauses are governed by the law of Ireland with disputes under them before the courts of Ireland (Clauses 17 and 18), and the UK Addendum by the law of England and Wales. Nothing in this DPA limits the rights of data subjects or supervisory authorities under Data Protection Laws.

Categories of data subjects and personal data, by module

Special categories. Customer may choose to store special-category data (for example health information in leave records, or data revealing trade-union membership) in HR modules; Customer is responsible for the lawful basis and for restricting access with roles and field-level security.

The current list of sub-processors, their purposes, data and locations is maintained at Sub-processors & Data and is incorporated into this DPA.