Data Processing Addendum (DPA)
Between: the Customer (“Controller”) and LaneSquare Technology Pvt. Ltd (“Pickcel” / “Processor”)
Effective date: on acceptance of the Terms of Service, or the date of a signed order referencing this DPA
Version: v3.0
This DPA forms part of the Terms of Service and applies where Pickcel processes Personal Data on behalf of the Customer in providing the Service. In case of conflict on data-protection matters, this DPA prevails over the Terms.
1. Definitions
“Data Protection Laws” means all applicable laws on the processing of Personal Data, including the EU GDPR, UK GDPR, Swiss FADP, the California CCPA/CPRA, and India's DPDP Act 2023. “Controller”, “Processor”, “Personal Data”, “Processing”, “Data Subject”, “Sub-processor”, and “Personal Data Breach” have the meanings in the Data Protection Laws. Other capitalized terms follow the Terms.
2. Roles and scope
2.1 The Customer is the Controller (or a processor acting for a third-party controller) and Pickcel is the Processor of Customer Personal Data. Details of processing are in Annex I.
2.2 For California: Pickcel acts as a “service provider” and will not sell or share Customer Personal Data, nor retain, use, or disclose it except to perform the Service or as permitted by the CCPA/CPRA.
3. Processor obligations
Pickcel will:
- (a) process Customer Personal Data only on the Customer's documented instructions (including the Terms, this DPA, and use of the Service), unless required by law (in which case it will inform the Customer unless legally prohibited);
- (b) ensure persons authorized to process are bound by confidentiality;
- (c) implement the technical and organizational measures in Annex II;
- (d) respect the conditions in §5 for engaging Sub-processors;
- (e) taking into account the nature of processing, assist the Customer by appropriate measures to respond to Data Subject requests (Annex II tooling / support);
- (f) assist the Customer with security, breach notification, data protection impact assessments, and prior consultations (GDPR Arts. 32–36) considering the information available to Pickcel;
- (g) at the Customer's choice, delete or return all Customer Personal Data at the end of the Service and delete existing copies, except where storage is required by law (see §8);
- (h) make available information necessary to demonstrate compliance and allow for and contribute to audits (see §7).
4. Customer obligations
The Customer warrants that it has a lawful basis and all necessary notices/consents for the Personal Data it provides, that its instructions comply with Data Protection Laws, and that it is responsible for the accuracy and legality of Customer Data.
5. Sub-processors
5.1 The Customer provides general authorization for Pickcel to engage Sub-processors listed in the Sub-processor list.
5.2 Pickcel will impose data-protection obligations on Sub-processors substantially equivalent to this DPA and remains liable for their performance.
5.3 Pickcel will give the Customer prior notice of at least 30 days via email of any intended addition or replacement of a Sub-processor, and the Customer may object on reasonable data-protection grounds; the parties will work in good faith to resolve, failing which the Customer may terminate the affected Service.
6. International transfers
Where Pickcel processes or transfers Personal Data outside the EEA/UK/Switzerland to a country without adequacy, the parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference (Module 2 controller-to-processor, or Module 3 processor-to-processor as applicable), and the UK International Data Transfer Addendum (IDTA) applies for UK transfers, in each case completed as set out in Annex III, with Pickcel as data importer.
7. Audits
Pickcel will make available its most recent SOC 2 and/or ISO/IEC 27001 reports/certificates to demonstrate compliance. Where that is insufficient to meet a Controller's legal obligation, the Customer may request an audit no more than once per 12 months (or after a Breach) on reasonable prior notice, during business hours, subject to confidentiality and without unreasonably disrupting operations; the parties will agree scope and cost.
8. Return and deletion
On termination or expiry, Pickcel will, at the Customer's choice, delete or return Customer Personal Data and delete existing copies within 30 days, except copies required to be retained by law, which remain protected under this DPA. See also the retention terms in the Privacy Policy.
9. Personal Data Breach
Pickcel will notify the Customer without undue delay and in any case within 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data, with the information reasonably available to help the Customer meet its notification obligations, and will take reasonable steps to mitigate and remediate.
10. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where Data Protection Laws require otherwise.
Annex I — Description of processing
- Subject matter: provision of the Pickcel digital-signage Service.
- Duration: for the Subscription Term plus the retention periods in the Privacy Policy.
- Nature and purpose: hosting, storage, transmission, display, and management of Customer content and screen/user administration.
- Categories of Data Subjects: Customer's staff/Users; end-viewers only if identifiable; individuals appearing in Content.
- Categories of Personal Data: account/user identifiers; any Personal Data within Customer Content. Special-category data: none.
- Controller / Processor: Customer / Pickcel (LaneSquare Technology Pvt. Ltd).
Annex II — Technical and organizational security measures
- Access control (least privilege, unique IDs, MFA for admin access)
- Encryption in transit (TLS) and at rest (MongoDB Atlas)
- Network security, firewalls, monitoring, and logging
- Secure SDLC, vulnerability management, and patching
- Backup and disaster recovery
- Personnel confidentiality and security training
- Incident response and breach management
- Physical security of facilities / reliance on certified cloud providers
- Vendor/Sub-processor risk management
Annex III — Transfer mechanism details
Transfers are governed by the EU Standard Contractual Clauses (Module 2 or Module 3, as applicable) and the UK Addendum to the EU SCCs, in the form issued by the European Commission and the UK ICO respectively, completed with Pickcel (LaneSquare Technology Pvt. Ltd) as data importer. Technical and organizational measures are as set out in Annex II. A completed copy of the executed Clauses is available on request at dpa@pickcel.com.