This Addendum forms part of the Agreement between the customer (the “Controller”) and Lucien (the “Processor”) and reflects the parties’ agreement on the processing of personal data when Lucien places outbound calls on the Controller’s behalf.
Roles
The Controller determines the purpose of each call and the contacts dialed; Lucien processes the resulting personal data (phone numbers, recordings, transcripts) solely to provide the service and on the Controller’s documented instructions.
Subprocessors
Lucien uses the subprocessors listed on the subprocessors page. The Controller is notified of changes and may object on reasonable grounds.
Security & retention
Data is encrypted in transit and at rest. Recordings are retained per the Controller’s configured retention policy and deleted thereafter. The Controller may request erasure or export of any contact’s data at any time (per-contact erasure and export are available in-product and via the API).
International transfers
Where data is transferred outside the EEA, the parties rely on the applicable Standard Contractual Clauses. See data residency.
Sub-processing & assistance
Lucien assists the Controller with data-subject requests, breach notification, and DPIAs to the extent required by applicable law.