Data Processing Addendum

This DPA applies to personal data processed by Lapsite on behalf of a customer in connection with the services.

If there is a conflict between this DPA and the Terms regarding personal data processing, this DPA controls for that subject matter.

This page is a standard contractual transparency summary and is not legal advice.

Customer is the controller (or business) for personal data submitted to the platform for its own sites, inventory, and leads.

Lapsite acts as processor (or service provider/contractor) for that customer data and processes it only under documented instructions, except where required by law.

For Lapsite account, billing, fraud prevention, and platform security operations, Lapsite may act as an independent controller as described in our Privacy Policy.

Customer authorizes Lapsite to use subprocessors to provide the service. Current subprocessors are listed on our Subprocessors page.

International transfer safeguards are documented in applicable service agreements and our privacy documentation.

Lapsite provides customer-facing controls and support workflows to access, correct, and delete data where available.

If Lapsite receives a data subject request directly that relates to customer-controlled data, Lapsite may redirect the request to the relevant customer where appropriate.

Upon account termination or valid customer instruction, Lapsite will delete or return customer personal data as described in service controls and policy documentation, except where retention is required by law.

Limited encrypted backup copies and security logs may persist for a short retention window before automatic purge.