Data Processing Agreement
Version 1.0 · 7 September 2026
Draft — pending review by qualified counsel before commercial launch
This Data Processing Agreement ("DPA") forms part of the FloorDash Terms of Service between Lambda Twelve PC ("Processor", "we") and the Customer ("Controller"). It governs the processing of personal data within Customer Content, as defined in the Terms, under Article 28 GDPR.
1. Subject matter and duration
We process personal data within Customer Content solely to provide the FloorDash service to the Controller. This DPA applies for as long as the Controller's workspace exists, plus the deletion and backup-retention periods in section 10.
2. Nature and purpose of processing
Hosting, storage, synchronization, organization, display, backup, export, support, and deletion of workspace records — floorplans, people, sites, desks, assets, assignments, and their history — so that the Controller can manage its offices and IT assets.
3. Categories of data subjects and personal data
| Data subjects | Personal data categories |
|---|---|
| The Controller's employees, contractors, workspace users, and any other people whose records the Controller chooses to maintain in FloorDash. | Name; work email; identity-provider identifiers (e.g. Microsoft Entra object IDs); job title and organizational information; site memberships; desk and location assignments and their history; Controller-configured person fields; other Customer Content the Controller stores that constitutes personal data. FloorDash is not designed for, and the Controller agrees not to store, special categories of data (Art. 9 GDPR). |
4. Instructions
We process personal data within Customer Content only on the Controller's documented instructions: the Terms, this DPA, the Controller's configuration of the Service (including which directory groups to sync and which people to import), and actions taken by the Controller's users in the workspace. We will inform the Controller if, in our opinion, an instruction infringes data-protection law, or if we are required by EU or member-state law to process beyond these instructions.
5. Confidentiality
Persons we authorize to process Customer Content are bound by contractual or statutory confidentiality obligations. Our staff have no standing access to Customer Content; access follows the routine (Customer-generated PIN) and exceptional models described in section 6 of the Terms, and is logged where technically feasible.
6. Security (Art. 32)
Taking into account the state of the art and the risks of the processing, we implement appropriate technical and organizational measures, including: EU-located infrastructure under our control; encryption in transit (TLS) for all service traffic; tenant isolation enforced at the application's data layer; role-based access control within workspaces; audited, time-limited, read-only support access gated on Customer-generated PINs; nightly backups stored in the EU; and separation of staff (operator) accounts from customer workspaces. A concise security overview will be published and maintained at floordash.eu/security.
7. Subprocessors
The Controller authorizes the subprocessors listed at floordash.eu/subprocessors, which states each provider's role, the data involved, and processing locations. We will update that page at least 15 days before adding or replacing a subprocessor that processes Customer Content; the Controller may object on reasonable data-protection grounds, in which case the parties will seek a solution and the Controller may terminate and export if none is found. We remain responsible for our subprocessors' performance.
8. Assistance
- Data-subject rights: the Service's export, correction, and deletion functions are the primary mechanism; we provide reasonable further assistance for requests the Controller cannot fulfil through the Service.
- Security and breaches: we notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Content, with the information reasonably available to us, and cooperate in the Controller's obligations under Articles 33–34.
- DPIAs: we provide reasonable assistance with data protection impact assessments and prior consultations relating to the Service.
9. International transfers
Customer Content is hosted and backed up in the EU. Where a subprocessor involves a transfer outside the EEA (see the subprocessors page), it takes place under an adequacy decision or standard contractual clauses, as stated there.
10. Deletion and return
The Controller can export Customer Content in machine-readable form at any time, in every workspace state. Upon workspace deletion (or termination of the Terms), we delete Customer Content from live systems; backup copies expire on the backup retention schedule stated in the Privacy Policy, and are not restored except for disaster recovery. Statutory retention obligations (e.g. invoicing records, where we are controller) are unaffected.
11. Demonstrating compliance and audits
We make available the information reasonably necessary to demonstrate compliance with this DPA — this page set, the subprocessor inventory, and the security overview — and answer reasonable written audit questions. Where that is insufficient, the Controller (or an independent auditor bound to confidentiality) may audit at most annually, on at least 30 days' notice, during business hours, without access to other customers' data; the Controller bears its own costs.
12. Precedence
For processing of personal data within Customer Content, this DPA prevails over any conflicting term of the Terms of Service.
Contact
Lambda Twelve PC (trading as Lambda Twelve)
VAT: EL800949070 · G.E.MI. No.: 145563001000
support@floordash.eu