Effective as of July 24, 2026
This Data Processing Agreement ("DPA") is entered into between LateralIQ\u2122 ("Processor") and you ("Controller" or "Customer") and governs the processing of Personal Data by the Processor on behalf of the Controller in connection with the LateralIQ Services. This DPA forms part of and is incorporated into the Terms of Use and Privacy Policy.
"Controller" means the entity that determines the purposes and means of processing Personal Data (i.e., you, the Customer).
"Processor" means the entity that processes Personal Data on behalf of the Controller (i.e., LateralIQ™).
"Personal Data" means any information relating to an identified or identifiable natural person, as defined by applicable data protection laws including the GDPR and CCPA.
"Sub-processor" means a third party engaged by the Processor to process Personal Data on its behalf.
"Services" means the LateralIQ™ platform and related analytical and intelligence services provided by the Processor.
This Data Processing Agreement ("DPA") forms part of and is incorporated into the LateralIQ™ Terms of Use and Privacy Policy. It applies to the processing of Personal Data by the Processor on behalf of the Controller in connection with the provision of the Services.
By using the Services, the Controller agrees to the terms of this DPA. This DPA reflects the parties' agreement with respect to the processing of Personal Data.
The parties acknowledge and agree that, with respect to Personal Data processed in connection with the Services, the Controller is the Controller of such Personal Data and the Processor is the Processor acting on behalf of the Controller.
The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or international organization, unless required to do so by applicable law.
The Processor shall process Personal Data for the sole purpose of providing the Services as described in the Terms of Use and Privacy Policy. Processing shall continue for the duration of the Controller's use of the Services.
Upon termination of the Services or upon the Controller's request, the Processor shall delete or return all Personal Data to the Controller, and delete existing copies, unless retention is required by applicable law.
The Processor processes Personal Data including, but not limited to: account registration information (name, email), search criteria and queries, saved partner profiles and lists, and usage data. The processing includes storage, retrieval, analysis, and generation of AI-powered intelligence reports based on publicly available and user-submitted data.
The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
• Encryption of Personal Data in transit (TLS 1.2+) and at rest. • Row-level security (RLS) to restrict data access to authorized users only. • Access controls limiting processing to authorized personnel. • Regular security audits and automated vulnerability scanning. • Incident response procedures for security events. • Data retention policies with automatic purging of audit logs (90 days) and user data upon account deletion.
The Processor may engage third-party Sub-processors to process Personal Data on its behalf. The Processor remains liable for the performance of its Sub-processors to the same extent as if it were performing the services itself.
Current Sub-processors include: cloud infrastructure providers (Google Cloud), payment processors (Stripe), and AI model providers (Google Gemini, OpenAI, Anthropic). The Controller consents to the use of these Sub-processors.
The Processor shall provide the Controller with notice of any intended changes to Sub-processors, and the Controller may object to such changes.
The Processor shall assist the Controller in responding to data subject requests exercising their rights under applicable data protection laws, including the right to access, rectification, erasure, restriction of processing, data portability, and objection.
The Controller may exercise these rights directly through the Account settings (data export and account deletion features) or by contacting contact@lateraliq.app.
In the event of a Personal Data breach, the Processor shall notify the Controller without undue delay and in any case within 72 hours of becoming aware of the breach. The notification shall include: the nature of the breach, the likely consequences, the measures taken or proposed to address it, and the contact point for further information.
Personal Data may be transferred to and processed in countries other than the Controller's country of residence. The Processor shall ensure that such transfers are conducted in compliance with applicable data protection laws, including through the use of Standard Contractual Clauses (SCCs) or other approved transfer mechanisms.
The Controller has the right to audit the Processor's compliance with this DPA, subject to reasonable notice and confidentiality obligations. The Processor shall make available all information reasonably necessary to demonstrate compliance and allow for and contribute to audits.
Upon account deletion by the Controller, the Processor shall delete all Personal Data associated with the Controller's account within 30 days, except where retention is required by applicable law. The Controller may export their data at any time through the Account settings.
This DPA shall be governed by and construed in accordance with the laws of the State of New York, without regard to its conflict of law provisions. Any disputes shall be subject to the exclusive jurisdiction of the state and federal courts located in New York County, New York.
For any questions regarding this DPA, please contact us at contact@lateraliq.app.
LateralIQ™ · contact@lateraliq.app