Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Lenucs Pty Ltd and each Customer. It applies when Lenucs processes personal information in Customer Data for the Customer. Under POPIA the Customer is the responsible party and Lenucs is the operator (similar to “controller” and “processor” under the GDPR).

• Subject matter: providing Lenucs Console and lenucs.link.
• Duration: for as long as the Customer uses the Services, plus the deletion and backup periods below.
• Nature and purpose: hosting, storing, displaying, organising, analysing and transmitting Customer Data so the Customer can collect leads, manage customers and bookings, publish forms and product links, run automations and use AI features.
• Data subjects: the Customer’s leads, customers, buyers, form respondents and booking clients, and the Customer’s team members.
• Categories of information: whatever the Customer chooses to collect, typically names, contact details, company, messages, order and delivery details, booking details, notes, form answers and uploaded files, plus technical details such as traffic source and device type.
• Special personal information: not intended. Customers must not process it in Console without our written agreement (see the Acceptable Use Policy).

• Process Customer Data only on the Customer’s documented instructions: the Terms, the Customer’s settings and use of Console, and written requests. If an instruction appears to break the law, we will tell the Customer.
• Keep Customer Data confidential, and make sure staff with access are bound by confidentiality and only access it when needed (for example for support the Customer asks for, security or legal reasons). Staff access to admin tools requires two-step sign-in, and admin actions are recorded in an audit log.
• Maintain the security measures described on our Security page, as required by section 19 of POPIA.
• Notify the Customer without undue delay after becoming aware of a security compromise affecting its Customer Data, with the information we have, so the Customer can meet its notification duties under section 22 of POPIA.
• Help the Customer, as far as reasonably possible, respond to requests from data subjects. Console provides export, correction and “Erase this person” tools. If a data subject contacts Lenucs directly about Customer Data, we refer them to the Customer or forward the request.
• Not sell Customer Data, and not use it for our own marketing or to train AI models.
• Only use the subprocessors listed on our Subprocessors page, under written terms that protect personal information. We will update that page at least 30 days before adding a new subprocessor (except in an emergency), and the Customer may object on reasonable data protection grounds.
• Transfer Customer Data outside South Africa only as section 72 of POPIA permits.
• Provide information reasonably needed to show compliance with this DPA.

• Have a lawful basis for the personal information it collects, and collect only what it needs.
• Give data subjects the information POPIA requires, for example with the privacy notice and link available on each form.
• Get consent where required, including separate consent for direct marketing.
• Respond to data subject requests and keep its exports secure.
• Make sure its instructions to Lenucs are lawful.

Customers can export their Workspace data at any time from Settings. When a Workspace deletion request is completed, we delete Customer Data from the live service; copies in backups are removed as backups rotate out. We may keep information we must keep by law, and we will continue to protect it.

When a Customer’s User uses Lenucs AI, the relevant Customer Data is sent to our AI provider only to generate that answer. We do not store prompts or answers, and Customer Data is not used to train models. See the AI Terms.