Processor agreement

1. Parties and how this agreement applies

1.1 This agreement is between Lyto, registered with the Dutch Chamber of Commerce (KvK) under number 99898624, at Francois Maelsonstraat 2, 2582 KC Den Haag (Lyto), and the organisation that uses one or more Lyto apps under the Lyto terms (the Customer). The Lyto terms are the Agreement.

1.2 This agreement forms part of the Agreement. By accepting the Agreement, the Customer accepts this agreement. It needs no signature. If the Customer wants a signed copy for its records, Lyto signs a copy of this text on request at lytoapp@gmail.com.

1.3 If Lyto and the Customer have signed a processor agreement separately, that agreement applies to the Customer in place of this one.

2. Roles and scope

2.1 The Customer is the controller and Lyto the processor of the personal data that the Customer’s users enter into, capture with or connect to the Lyto apps (Customer Data). Annex 1 describes that processing in general. Annex P describes the processing behind a connected Microsoft mailbox in Pipeline.

2.2 This agreement does not cover data Lyto controls itself, such as account credentials, billing data and support correspondence. The Lyto privacy policy covers those.

2.3 This agreement runs for as long as Lyto processes Customer Data under the Agreement. Sections 10 and 11 survive it.

3. Instructions

3.1 Lyto processes Customer Data only on the Customer’s documented instructions. The Agreement, this agreement, and the settings and actions of the Customer’s users in the apps are those instructions. Further instructions are given in writing.

3.2 Lyto processes Customer Data for no purpose of its own. In particular, Lyto does not use Customer Data for advertising or marketing, does not sell or share it, and does not use it, or anything derived from it, to train AI models.

3.3 If Lyto is required by Union or Member State law to process Customer Data otherwise, it tells the Customer before processing unless that law forbids it. If Lyto believes an instruction breaks the GDPR or other data-protection law, it tells the Customer at once (Art. 28(3), last paragraph).

4. Confidentiality

Lyto ensures that everyone it authorises to process Customer Data is bound to confidentiality by contract or by law. Lyto’s people access Customer Data only where needed to run, support or secure the service, or on the Customer’s request.

5. Security

Lyto takes the technical and organisational measures in Annex 2 (Art. 32). Lyto may change them, but never so that the overall level of protection falls.

6. Sub-processors

6.1 The Customer gives Lyto general authorisation to engage sub-processors. The sub-processors in use are listed in Annex 3 and in section 6 of the Lyto privacy policy.

6.2 Lyto tells the Customer by email, at the address on its account, at least 30 days before it adds or replaces a sub-processor. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the Agreement for the affected app without penalty.

6.3 Lyto binds each sub-processor to data-protection obligations that are at least as protective as this agreement, and remains liable to the Customer for its sub-processors (Art. 28(4)).

6.4 Lyto transfers Customer Data outside the European Economic Area only under a safeguard in Chapter V GDPR, such as the European Commission’s Standard Contractual Clauses or an adequacy decision. Annex 3 names each sub-processor’s location and the safeguard for each transfer.

7. Data-subject rights

Lyto helps the Customer, by appropriate technical and organisational measures, to answer requests from data subjects (Arts. 12–22). The apps provide this help directly: Pipeline’s export, erasure, Remove from Pipeline and Mark private; Sum’s erasure. If a data subject contacts Lyto directly, Lyto forwards the request to the Customer without undue delay and does not answer it itself unless the Customer asks.

8. Help with security, breaches and the DPIA

8.1 Lyto helps the Customer meet its obligations under Arts. 32–36, taking into account the nature of the processing and the information available to Lyto.

8.2 Personal data breaches. Lyto notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice describes, as far as then known, what happened, the categories and approximate numbers of data subjects and records, the likely consequences, and the measures taken or proposed. Lyto adds information as it becomes available. The Customer decides whether to notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and data subjects. Where a breach involves data obtained through Microsoft Graph, Lyto also reports it to Microsoft as the Microsoft APIs Terms of Use require.

8.3 DPIA. Lyto provides a model data protection impact assessment for each processing where the Customer is likely to need one, and answers the Customer’s reasonable questions about it. For a connected Microsoft mailbox, see Annex P, section P8.

9. Audits

Lyto makes available to the Customer the information needed to show compliance with this agreement and allows for audits, including inspections, by the Customer or an auditor it mandates (Art. 28(3)(h)). The Customer gives reasonable notice, and an audit takes place during business hours, at most once a year unless a breach or a supervisory authority requires it. Each party bears its own costs, unless the audit shows Lyto materially breached this agreement.

10. Deletion and return

10.1 When the Agreement ends, or earlier on the Customer’s written instruction, Lyto deletes the Customer Data, unless Union or Member State law requires Lyto to keep it. Before that, the Customer can export its data from the apps, or ask Lyto for an export.

10.2 Lyto deletes Customer Data from the live systems within 90 days after the Customer’s Lyto account is closed. Backups that contain it rotate out within 30 days after deletion from the live systems.

10.3 Annex P, section P6 sets out what is deleted when a connected mailbox is disconnected.

11. Liability, law and disputes

11.1 The limitations of liability in the Agreement apply to this agreement, except where the GDPR rules them out.

11.2 If this agreement and the rest of the Agreement conflict on the processing of personal data, this agreement governs.

11.3 Dutch law governs this agreement. Disputes go to the competent court in The Hague.

12. Changes to this agreement

Lyto may change this agreement. It emails the Customer, at the address on its account, at least 30 days before a change takes effect, unless the law requires the change sooner. A change never lowers the protection of Customer Data. A Customer that does not accept a change may end the Agreement before the change takes effect. Earlier versions are available on request.

Annex 1: Processing in general

• Subject matter and purpose: providing the Lyto apps the Customer uses under the Agreement (Workspace, Pipeline, Pulse, Solve, Sum, Workstream and Tally).
• Nature: storage, retrieval, organisation, display, export and deletion of Customer Data entered or captured by the Customer’s users; AI-assisted features when a user asks for them.
• Duration: the term of the Agreement, plus the deletion periods in section 10.
• Data subjects: the Customer’s users (employees and others the Customer invites); the Customer’s clients, prospects, suppliers and other business contacts, and their staff.
• Personal data: names, business contact details, job titles and roles; records the users keep about those people (notes, activities, deals, invoices, timesheets, tickets); email captured in Pipeline (Annex P for a connected mailbox); usage metadata (who changed what, when).
• Special categories: none intended. Free text and email may contain them incidentally. Lyto does not seek them out or process them separately.

Annex P: Pipeline, connected Microsoft mailbox

This annex applies once Microsoft mailbox is switched on for the Customer’s organisation and a user connects a mailbox.

P1. What it does

A user connects their own Microsoft 365 or Outlook.com mailbox to Pipeline. Pipeline then reads the mailbox’s Inbox, Sent items and primary calendar through Microsoft Graph, and keeps only mail and meetings with outside companies, as the Customer’s record of its business relationships. A user can also send email from Pipeline through their own mailbox. A work mailbox needs the Customer’s Microsoft 365 administrator to approve Pipeline once for the organisation.

P2. Data subjects

• The Customer’s employees and other users who connect a mailbox, or who appear in mail or meetings that are kept.
• Correspondents: everyone outside the Customer’s organisation who sends, receives or is copied on kept mail.
• Meeting attendees of kept meetings, inside and outside the Customer’s organisation.

P3. Personal data

• Mail that qualifies (P4): sender, recipients, date, subject, content and attachments, and the raw message file.
• Headers of one-way mail from an unknown company, held as a suggestion: sender, recipients, date and subject, without the body.
• Calendar: for each kept meeting, its title, time, place, whether it is online, the organiser, and each attendee’s name, email address and reply. Never the meeting’s body or attachments (Pipeline asks only for Calendars.ReadBasic).
• Connection data: the mailbox address, the Microsoft account and tenant identifiers, the granted permissions, an encrypted refresh token, and the sync state.
• Mail sent from Pipeline: recipients, subject, content, attachments and delivery status.
• Special categories are not intended and may appear incidentally in mail content. Mail that Outlook marks Private, and meetings it marks private, personal or confidential, are skipped.

P4. What is kept, what is discarded

• Pipeline reads headers first and applies Pipeline’s capture rules. Only qualifying mail has its content fetched and stored: mail with a company the user has written to (the two-way rule), or with a person or company already in Pipeline, after the exclusions (free-mail providers, the Customer’s own domains, blocked domains, Not a lead, Outlook-private).
• Everything else is never stored, not even its message identifier. Only the sync position remains.
• Personal mailboxes (Outlook.com, Hotmail) never add a company by themselves: every new company becomes a suggestion, and only mail with people or companies already in Pipeline is kept straight away.
• Meetings are kept only when they involve a person or company in Pipeline, or an attendee whose unknown company becomes a suggestion; and only with at least one outside attendee, at most 25 attendees, not declined by the user, and not marked private, personal or confidential.
• History: on first connect, Pipeline reads the last 12 months of mail and calendar under the same rules. One-way mail from an unknown company older than 90 days is not kept. The calendar is read 90 days ahead.
• Messages deleted, moved or archived in Outlook stay in Pipeline: the kept mail is the Customer’s record. Remove from Pipeline deletes it.

P5. Retention

• Kept mail and meetings: for as long as the person or company they belong to is in Pipeline, or until removed. The raw message file is deleted after 30 days.
• Suggestion headers: until accepted, dismissed, or 30 days, whichever comes first; also when the message leaves the synced folder. A dismissed domain stays blocked, holding the domain alone.
• Connection data: until the mailbox is disconnected.

P6. Disconnecting and deleting

• A user disconnects in Pipeline (Email capture, then Disconnect). An admin can disconnect any user’s mailbox. Pipeline also disconnects a mailbox when its user leaves the organisation, after 90 days of a broken connection, and when Lyto switches the feature off for the organisation.
• Every disconnect deletes at once the tokens, the sync state, and every item that has not qualified (suggestion headers).
• Mail and meetings already kept stay, as the Customer’s record. Only the user can choose Remove what only my mailbox brought in, which deletes kept mail and meetings that no other user’s mailbox or capture also brought in.
• Revoking Pipeline at myapps.microsoft.com (work) or account.live.com/consent/Manage (personal) stops all reading at once. What Pipeline holds is deleted as for a disconnect when the user disconnects in Pipeline, and in any case after 90 days.
• On the Customer’s written instruction, Lyto deletes specific mail, meetings or a whole mailbox’s data, beyond what the apps let users do.
• On erasure of a person or company in Pipeline, their mail, their meeting links and suggestion headers from or to them are deleted.

P7. Sub-processors and Microsoft

• Of the sub-processors in Annex 3, two store or analyse mailbox data: Supabase (database and file storage, Ireland) and Anthropic (AI features, when a user asks for one that reads the record, such as a drafted follow-up or Ask Pipeline; United States, under the Standard Contractual Clauses; inputs are not used for training). Vercel serves the app and carries mailbox data in transit when a page shows it, but stores none of it.
• Microsoft is not a sub-processor of Lyto. Microsoft Graph is the source of the data: the Customer’s (or the user’s) own Microsoft service, under the Customer’s own agreement with Microsoft. The Microsoft APIs Terms of Use state that they create no processor–sub-processor relationship between Lyto and Microsoft.
• Lyto requests only these Microsoft permissions: openid profile offline_access User.Read Mail.Read Mail.Send Calendars.ReadBasic. Adding one means every administrator approves again.

P8. DPIA

A connected mailbox is likely to need a data protection impact assessment by the Customer (systematic processing of employees’ email; AP list items 11 and 13). Lyto provides a model DPIA in English and Dutch for the Customer to adopt and complete. Lyto answers the Customer’s questions about it and updates the model when the processing changes. The administrator who approves Pipeline in the app records that they have read the model DPIA and told the team.

P9. Informing people

The Customer informs its team before the first mailbox is connected, and asks its works council if it has one. Pipeline gives the administrator a copyable team message and an updated paragraph for the Customer’s own privacy statement, covering mail and meetings synced from team members’ mailboxes.

Annex 2: Technical and organisational measures

• Hosting in the EU: database, files and functions at Supabase in Ireland; the apps at Vercel in Frankfurt.
• Encryption: TLS 1.2 or higher in transit; all customer databases encrypted at rest. Microsoft refresh tokens and bank session references carry a second layer of application-level encryption, with the key held in the database vault. Microsoft access tokens are held only in memory, for one sync run or one send. The refresh token is replaced at every refresh.
• Access control: every table is protected by row-level policies that limit a user to their own organisation. Tables that hold tokens or sync state are written only by Lyto’s server functions; users cannot read token columns. Lyto’s administrative access needs multi-factor authentication. Lyto’s people access Customer Data only to run, support or secure the service.
• Minimisation: headers are read before content; non-qualifying mail and internal meetings are never stored; Outlook-private items are skipped; meeting bodies are never requested; the history window is fixed at 12 months.
• Separation of sharing: each user sets who in the organisation sees the content of their mail, and can mark a thread private or remove it.
• Resilience: daily backups, rotated within 30 days; monitoring of errors and failed syncs.
• Development: no production Customer Data in development; a development system can send email only to allow-listed addresses.
• Incidents: a written incident response procedure, including the notifications in section 8.2.

Annex 3: Sub-processors

The current list is section 6 of the Lyto privacy policy. Section 6.2 of this agreement sets out how Lyto announces a change to it.