1. Roles
- CCPA — Lydira is a Service Provider processing Personal Information on behalf of Customer (the Business).
- VCDPA / CPA — Lydira is a Processor.
2. Permitted purposes
Processor shall process Personal Information only for the business purposes specified in the Agreement — operating the travel-agency CRM service on Customer’s behalf.
Processor shall not:
- Sell or share Personal Information as those terms are defined in the CCPA.
- Retain, use, or disclose Personal Information outside the direct business relationship with Customer.
- Combine Personal Information with data from other sources except as permitted under §7027(m) CCPA Regulations.
Processor may use de-identified / aggregated data for product improvement, subject to irreversible de-identification requirements.
3. Consumer rights assistance
Processor assists Customer in responding to verifiable consumer requests for:
- Right to know / access
- Right to delete
- Right to correct
- Right to opt out of sale / sharing (N/A — see §2)
- Right to limit use of sensitive personal information
Self-service data export + deletion tooling lives in Settings → Data & Privacy; Customer can action most requests without Processor involvement.
4. Security
Processor maintains reasonable security procedures and practices, including those detailed in the EU GDPR DPA §6.
5. Sub-processors
Same list as /legal/subprocessors. Flow-downs with each Sub-processor mirror this Addendum.
6. Breach notification
Processor notifies Customer within 72 hours of confirming a breach of Personal Information security. Notice includes a description of the breach, affected Personal Information, remediation steps, and contact for further information.
7. Deletion + return
Within 30 days of termination, Processor returns or deletes all Personal Information per Customer’s election, except where retention is required by law.
8. Certification
Processor certifies that it understands the restrictions and prohibitions in this Addendum and will comply with them.
9. Governing law
Laws of the State of Delaware, except that consumer-rights provisions are interpreted per the applicable state law.
Signatures per the Master Subscription Agreement signature block. Contact legal@lydira.com for the executable version.