Data Processing Agreement

Parties and scope#

This agreement is between:

• the organisation that uses Lamp under our Terms of Service (“you”, the controller), and
• Individual Entrepreneur MIKHAIL KOZIN, Rezo Gabashvili Street N 1, Block B, Floor 8, Apt. N196, Gldani District, 0167 Tbilisi, Georgia (“MatGen”, “we”, the processor).

It applies to personal data that you put into Lamp and that we process on your behalf. It does not cover data we process for our own purposes, such as your users’ account data and billing; the Privacy Policy covers that. You accept this agreement together with the Terms of Service. Where this agreement and the Terms of Service differ on personal data, this agreement applies.

What we process, and for how long#

Subject and purpose. We process the personal data only to provide Lamp to you under the Terms of Service.

Nature of the processing. Storing your content, searching and analysing it, and sending the text each task needs to AI model providers to generate chat answers and reports.

Kinds of data and people. Listed in Annex 1.

Duration. For as long as you use Lamp, and then until the data is deleted under section 10.

Your instructions#

We process the personal data only on your documented instructions, including for transfers outside the EU. Your instructions are these terms, the Terms of Service and the way you use Lamp’s features. You can give further instructions by e-mail.

If the law requires us to process the data in another way, we tell you before we do, unless that law forbids it.

If we think an instruction breaks data protection law, we tell you straight away.

Confidentiality#

Everyone at MatGen who can access the personal data is bound to keep it confidential, by contract or by law.

Security#

We protect the personal data with the technical and organisational measures that Art. 32 GDPR requires. They are listed in Annex 2. We may improve them over time, but we will not lower the overall level of protection.

Sub-processors#

You authorise us to use the sub-processors in Annex 3.

Before we add or replace a sub-processor, we tell you at least 30 days in advance by e-mail. You can object on reasonable grounds within that time. If you object and we cannot offer a solution, you may end the contract.

Each sub-processor is bound by a written contract with the same data protection duties as this agreement. We remain responsible to you for its work.

Transfers outside the EU#

We transfer personal data outside the European Economic Area only with a safeguard under Chapter V GDPR: an adequacy decision of the European Commission, including the EU–US Data Privacy Framework, or the Commission’s standard contractual clauses. The list in Annex 3 shows where each sub-processor is.

Helping you meet your duties#

If a person asks us to use their data protection rights for data we process for you, we pass the request to you and do not answer it ourselves unless you tell us to. We help you answer such requests, as far as we reasonably can.

We also help you with security, with data protection impact assessments and with consulting a supervisory authority (Art. 32 to 36 GDPR), taking into account what we know about the processing. We may charge a reasonable fee for help that goes beyond what the law requires of us.

Personal data breaches#

If we become aware of a breach of the personal data we process for you, we tell you without undue delay. We tell you what happened, which data and people are affected, the likely consequences and what we are doing about it. If we do not know everything at once, we send the rest as we learn it.

End of the contract#

When you stop using Lamp, we delete or return the personal data, as you choose, within 30 days. We also delete existing copies, unless the law requires us to keep them. Copies in our backups are deleted within 3 months, as old backups are replaced. Tell us your choice by e-mail. We return data as a JSON file, the format of Lamp’s own export.

Audits#

We give you the information you need to check that we keep to this agreement. We allow and contribute to audits, including inspections, by you or an auditor you appoint. We answer audit questions in writing first. An inspection on site is possible at most once a year, with at least 30 days’ notice and at your cost, and it must not expose other customers’ data.

Liability and law#

Liability under this agreement is as set in the Terms of Service. This agreement is governed by the same law as the Terms of Service.

Annexes#

Annex 1: Personal data and the people it concerns

Kinds of personal data. Any personal data in the text you paste into the chat, such as names and contact details, and the names of inventors, applicants and authors; the content of chat messages and search queries; the reports Lamp generates from them.

People concerned. Your staff who use Lamp; people named in chat messages, including text pasted into them, or in search queries.

Special categories of data. You must not put special categories of personal data into Lamp (Art. 9 GDPR).

Annex 2: Technical and organisational measures

• Passwords are stored only as hashes, never in readable form.
• The session cookie is HttpOnly, so scripts on a page cannot read it.
• Connections between you and our sites are encrypted with HTTPS.
• Only MatGen staff with the admin role can open Lamp’s admin panel, and Lamp records the admin actions that change or delete data.
• Lamp’s database is backed up every day to separate object storage. We keep 7 daily, 4 weekly and 3 monthly copies, and once a month we restore a copy to check that it works. If a backup fails, we are alerted by e-mail.
• We test Lamp with automated security scans, fuzzing and load tests.

Annex 3: Sub-processors

We send the current list of sub-processors, with what each one does and where it is, to business customers on request. Write to our e-mail address.