1. Roles
- CCPA: Lydira is a Service Provider processing Personal Information on behalf of Customer (the Business).
- VCDPA / CPA: Lydira is a Processor.
2. Permitted purposes
Processor shall process Personal Information only for the business purposes specified in the Agreement: operating Lydira, the software Customer uses to run its travel agency’s sales, operations and accounting, on Customer’s behalf.
Processor shall not:
- Sell or share Personal Information as those terms are defined in the CCPA.
- Retain, use, or disclose Personal Information outside the direct business relationship with Customer.
- Combine Personal Information with data from other sources except as permitted under §7027(m) CCPA Regulations.
Processor may use de-identified / aggregated data for product improvement, subject to irreversible de-identification requirements.
3. Consumer rights assistance
Processor assists Customer in responding to verifiable consumer requests for:
- Right to know / access
- Right to delete
- Right to correct
- Right to opt out of sale / sharing (N/A; see §2)
- Right to limit use of sensitive personal information
Self-service data export + deletion tooling lives in Settings → Data & Privacy; Customer can action most requests without Processor involvement.
4. Security
Processor maintains reasonable security procedures and practices, including those detailed in the EU GDPR DPA §6.
5. Sub-processors
Same list as /legal/subprocessors. Flow-downs with each Sub-processor mirror this Addendum.
A workspace in Processor’s US cell is hosted on AWS in N. Virginia (us-east-1), where its application servers, database, file storage and backups stay. Services that Customer connects with its own account (its own email server, messaging provider, consolidator or GDS office) work under Customer’s own contract with that provider and are not Sub-processors of Processor.
6. Breach notification
Processor notifies Customer within 72 hours of confirming a breach of Personal Information security. Notice includes a description of the breach, affected Personal Information, remediation steps, and contact for further information.
7. Deletion + return
Within 30 days of termination, Processor returns or deletes all Personal Information per Customer’s election, except where retention is required by law.
8. Certification
Processor certifies that it understands the restrictions and prohibitions in this Addendum and will comply with them.
9. Confidentiality of team chat content
The Processor does not read or review the content of conversations the Customer’s users hold with each other in the platform’s team chat (channel messages, direct messages and their attachments). This content, backups included, is accessed only (a) for support work at the Customer’s written request and within the scope it states, or (b) under a binding order of a competent authority or a legal obligation, by the fewest personnel authorised for that task. Every access is logged and, unless the law forbids it, notified to the Customer in writing. The platform’s administration interface has no screen that shows this content, and message text is not written to application logs or to the audit log. Direct messages are sent to no automatic AI feature. Channel messages reach the Sub-processors in §5 only for the AI features the Customer leaves enabled.
10. Governing law
Laws of the State of Delaware, except that consumer-rights provisions are interpreted per the applicable state law.
Signatures per the Master Subscription Agreement signature block. Contact legal@lydira.com for the executable version.