Legal

DPA

Data Processing Addendum

Read Lansweeper’s Data Processing Addendum, covering GDPR and CCPA compliance, data protection measures, and international data transfers.

Download pdf

Version 1.5, dated 25 September 2026

This Data Processing Addendum (hereinafter referred to as the “DPA”) hereinafter set forth, as amended from time to time, shall form a part of the Terms of Use between Customer and Lansweeper and are hereby incorporated by reference into the Terms of Use, without the need for further action. In case of conflict between the provisions of the Terms of Use and this DPA, the provisions of the DPA shall prevail.

1. Definitions and Interpretation

Capitalized terms used, but not defined, in this DPA are defined in the Agreement (as defined below), the other capitalized terms used in this DPA shall have the following meaning:

  • “Agreement” means the Lansweeper Terms of Use and any other specific agreement between the Customer and Lansweeper and/or its Affiliates relating to the Services.
  • “Applicable Data Protection Legislation” means, as applicable, (i) laws applicable to the processing of personal data in the United States and each State of the United States including, without limitation, the CCPA; (ii) the GDPR, the Swiss Federal Act on Data Protection, and applicable data privacy laws of the United Kingdom, and each member state of the European Union and European Economic Area (EEA), and (iii) applicable data privacy laws of other jurisdictions that the Parties have expressly identified in the Agreement as applicable to the processing activities of Lansweeper.
  • “CCPA” means the California Consumer Privacy Act of 2018, as amended from time to time.
  • “DPA” means this Lansweeper Data Processing Addendum together with its annexes, which shall be an integral part of the Agreement between the Parties.
  • “International Data Transfer” means any transfer of Customer Personal Data from the EEA, Switzerland or the United Kingdom to an international organization or to a country outside of the EEA, Switzerland and the United Kingdom.
  • “Personal Data” means any information about a natural person that is identified or identifiable to the natural person, either alone or in combination with other information, that Lansweeper will process or have access to as part of providing the Services, including any such information that is created by means of the Services. Personal Data includes “personal data” as that term is defined in the GDPR and “personal information” as that term is defined in the CCPA.
  • “Services” means the services related to provision of the Product by Lansweeper.
  • “Standard Contractual Clauses” means the clauses annexed to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.
  • “Sub-processor” means any Processor (including any third party, excluding a person working under the authority of Lansweeper) appointed by or on behalf of Lansweeper, or its sub-processor, to Process Personal Data on behalf of Lansweeper in connection with the Agreement.
  • The terms, “Controller”, “Data Subject”, “Personal Data Breach”, “Processing” and “Processor” shall have the same meaning as in the GDPR.

2. Object of this DPA

2.1 This DPA is added to the Agreement in order to comply with Applicable Data Protection Legislation, and the provisions of the Agreement shall apply to this DPA. The different Schedules to this DPA are applicable to the extent required by relevant Applicable Data Protection Legislation and address compliance therewith.

2.2 Parties shall comply with the Applicable Data Protection Legislation, for their own account and sole responsibility, unless otherwise set out herein.

2.3 For the purposes of this DPA, Affiliates, End-Users, Billing Contacts and Help Desk-Agents as detailed in the Agreement shall be considered to form an integral part of the Customer and Customer shall be responsible for their compliance with this DPA.

3. Duration and Termination

3.1 The duration of the Processing is the duration of the Agreement.

3.2 Upon termination or expiry of this DPA, or at any earlier moment if the Processing of Personal Data is no longer relevant for the delivery of the Services, Lansweeper shall delete the Personal Data, unless a law or regulation requires storage of the Personal Data. Notwithstanding the foregoing, we will only store LsAgent data in the Cloud Service relay for a maximum period of one (1) month.

3.3 Notwithstanding the foregoing, articles 3 and 5 of this DPA shall survive the termination of this DPA.

4. Measures

4.1 Lansweeper will, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account in particular the risk of accidental or unlawful destruction, loss, alteration or unauthorised disclosure of or access to the Personal Data. A description of the Lansweeper requirements are further detailed on our Security page (https://www.lansweeper.com/about/trust/ or such other URL as specified by Lansweeper). Such requirements and measures may be updated by Lansweeper, from time to time. Customer shall be solely responsible for its own means of accessing the Services (e.g. through proxies) and providing adequate measures to ensure an appropriate level of security.

5. Privacy Statement

5.1 Without prejudice to Section 2.1, Lansweeper reserves the right to Process certain Personal Data for its own purposes (e.g. analytics, improvement of our products and services). In such cases, Processing shall not be subject to this DPA and Lansweeper shall be considered a controller. For more information please refer to our privacy policy (https://www.lansweeper.com/privacy-policy/ or such other URL as specified by Lansweeper).

List of Schedules:

  • Schedule 1: GDPR, including Annex I: Details of Processing
  • Schedule 2: CCPA

Schedule 1: GDPR

1. Object of this Schedule 1

1.1 This Schedule applies to the extent that (i) GDPR, the Swiss Federal Act on Data Protection, and applicable data privacy laws of the United Kingdom, and each member state of the European Union and European Economic Area applies to the Processing, and (ii) Lansweeper Processes Personal Data, on behalf of the Customer through providing the Product.

1.2 This Schedule sets out the subject-matter and duration of the Processing, the nature and purpose(s) of the Processing, the types of Personal Data and categories of Data Subjects and the obligations and rights of the Customer and Lansweeper in relation to the Services as further detailed in Annex I (Details of Processing).

2. Data Protection

2.1 Where Personal Data is Processed by Lansweeper in relation to the performance of this Schedule, the Agreement and the Services, Lansweeper shall:

  1. Instructions – process the Personal Data only on documented instructions from Customer as solely provided herein, unless required to do so by applicable laws and regulations to which Lansweeper is subject. In such a case, Lansweeper shall inform Customer of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest. Parties agree that this DPA makes up the entire instruction of Customer to Lansweeper, any other instructions have to be agreed to in writing by Lansweeper, reserving its rights to charge additional costs for compliance with such instructions;
  2. Need-to-know – provide Personal Data only to authorised persons (which could include employees, agents, resellers, distributors, partners, Sub-processors and subcontractors) on a need-to-know basis and ensure that persons authorised to Process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
  3. Sub-processors – based on the general authorisation to use Sub-processors hereby provided by Customer, inform Customer of any addition or replacement of Sub-processors, thereby giving Customer the opportunity to object to such changes on reasonable grounds during a period of thirty (30) calendar days, after which such Sub-processors shall be deemed to have been accepted. A description of the Lansweeper Sub-Processors can be accessed through the following webpage https://www.lansweeper.com/about/legal/subprocessors/ (or any other hyperlink Lansweeper may provide). Sub-processors engaged by Lansweeper prior to entering into this DPA are accepted by Customer. In case Customer objects to a new Sub-processor and such objection is based on reasonable grounds, Lansweeper shall employ reasonable efforts to resolve the issue.Where Lansweeper engages a Sub-processor for carrying out specific Processing activities on its behalf, reasonably equivalent data protection obligations as set out in this DPA shall be imposed on that Sub-processor. Where that Sub-processor fails to fulfil its obligations under the Applicable Data Protection Legislation, Lansweeper shall remain fully liable to Customer in accordance with the terms set out in this DPA;
  4. Assistance – taking into account the nature of the processing, reasonably assist Customer by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to requests for exercising Data Subject’s rights, without prejudice to Lansweeper’s right to charge Customer any reasonable costs for such assistance. Lansweeper shall promptly notify Customer about any legally binding request by a Data Subject;
  5. Cooperation – reasonably assist Customer in ensuring compliance with its obligations relating to: the security of the Processing, notification of Personal Data Breaches and data protection impact assessments and prior consultations, taking into account the nature of Processing and the information available to Lansweeper and without prejudice to Lansweeper’s right to charge Customer any reasonable costs for such assistance;
  6. Personal Data Breach – Lansweeper shall notify the Customer without undue delay after becoming aware of a Personal Data Breach. Such notification shall contain the following information: (i) the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned; (ii) the name and contact details of the data protection officer or other contact point where more information can be obtained; (iii) the likely consequences of the Personal Data Breach; (iv) the measures taken or proposed to be taken by Lansweeper to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
    • The obligation to report or respond to a Personal Data Breach is not and will not be construed as an acknowledgement by Lansweeper of any fault or liability with respect to the Personal Data Breach;
    • The Customer shall promptly notify Lansweeper with information regarding any non-compliance discovered during the course of an audit or review of provided information. The Customer agrees to provide Lansweeper with a draft of the audit report for review. Lansweeper is entitled to propose any amendments and add management comments to this draft before Customer establishes the final version.
  7. Infringement – reasonably inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Legislation.
  8. Information & Audit – make available to Customer all information reasonably necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections subject to following conditions. Customer must request an audit in writing with prior notice of thirty (30) calendar days and may instruct acknowledged audit professionals at its own expense to execute such audit in following cases:
    • once every twelve (12) months provided that such additional audit inquiries shall not unreasonably impact in an adverse manner Lansweeper’s regular operations and do not prove to be incompatible with applicable legislation or with the instructions of a competent authority;
    • Where an audit is reasonably considered necessary because of genuine concerns as to Lansweeper’s compliance with this DPA;
    • Where a competent data protection authority requires this under Applicable Data Protection Legislation;
    • Following a Personal Data Breach.

3. International Data Transfer

3.1 Personal Data Processed in the context of this Schedule may be subject to an International Data Transfer without the prior written consent of Customer, where Lansweeper ensures that appropriate safeguards are in place for such transfer or an adequate level of protection is guaranteed.

3.2 Customer and Lansweeper, on behalf of itself and relevant affiliates outside of the EEA, UK or Switzerland, shall conclude, either one or both of relevant modules Module Two: Controller to Processor of the Standard Contractual Clauses (“Module Two”) and Module Three: Processor to Processor of the Standard Contractual Clauses (“Module Three”), which shall apply to such International Data Transfer.

3.3 As specified in the Standard Contractual Clauses, for both Module Two and Module Three, the following optional provisions are selected:

  1. Clause 7: Docking Clause
  2. Clause 9(a) Use of Sub-processors: Option 2 – General Written Authorization, with a notice period of 30 days has been selected.
  3. Clause 11 Redress: The optional clause is not included.
  4. Clause 17 Governing Law: Option 1, the governing law of Belgium.
  5. Clause 18(b) Choice of Forum and Jurisdiction, the courts of Belgium.

3.4 If Lansweeper’s compliance with Applicable Data Protection Law to International Data Transfers is affected by circumstances outside of Lansweeper’s control, including if a legal instrument for International Data Transfer invalidated, amended, or replaced, then Parties will work together in good faith to reasonably resolve such non-compliance.

Annex I: Details of Processing

1. The duration of the Processing

The duration of the Agreement.

2. The subject-matter of the Processing

The subject-matter of the Processing is described in this DPA and relates to the Product and Services provided by Lansweeper to the Customer as covered by the Agreement. Lansweeper is a technology asset management solution that gathers hardware, software and network information for management, compliance and analytics purposes. These Services enable Customers to identify, manage, assess, and secure technology assets across and gain insights into their technology environments.

3. The types of Personal Data to be Processed

The data collected by the Product may include, without limitation:

  1. Name and contact details of Data Subjects;
  2. Product usage data;
  3. Metadata, such as but not limited to, electronic identification data (such as IP-addresses);
  4. Asset and Asset usage data;
  5. Data concerning traffic, activities, connections and logs within a Customer’s systems, networks and/or environments; and
  6. Input, Output (as defined in the AI Features Terms) and associated data therewith, insofar Customer makes use of the relevant AI Features.

4. The categories of Data Subjects to whom the Personal Data relates

The Personal Data may relate to Customer, Affiliates, End-Users and/or any other Data Subject (Customer’s employees, external consultants and any other Data Subject using Customer’s systems) to whom the collected data may relate.

5. The nature and purpose of the Processing

Lansweeper may Process Personal Data on behalf of Customer through i.a. collection, consultation, organisation, aggregation, recording, storage, adaptation, transmission, dissemination and anonymisation in the provision of the Services.

Schedule 2: CCPA

1. Object of this Schedule 2

1.1 This Schedule 2 applies to the extent that (i) CCPA applies to the Processing, and (ii) Lansweeper receives, as a ‘Service Provider’ under CCPA, Personal Data, on behalf of the Customer as a ‘Business’ under CCPA, through providing the Product.

2. Service Provider obligations

2.1 Lansweeper will comply with the requirements stated in this Schedule 2, and any additional or more stringent requirements or restrictions applicable to service providers under CCPA.

2.2 Lansweeper will not “Sell”, as defined under CCPA, the Personal Data which is received pursuant to this Agreement.

2.3 Lansweeper will retain, use or disclose such Personal Data only for the specific purpose of performing the Services and within the direct business relationship with the Customer.

2.4 Lansweeper shall provide reasonable assistance to Customer in facilitating compliance with consumer rights requests, without prejudice to Lansweeper’s right to charge Customer any reasonable costs for such assistance.