1. Scope and Incorporation
This Data Processing Agreement ("DPA") forms part of the agreement between the customer controlling a Lynka workspace ("Customer") and Lynka, an individual / sole-trader business based in Ghana ("Lynka"), and applies when Lynka processes personal data contained in Customer Data on Customer's behalf.
If this DPA conflicts with the Terms of Service specifically regarding Lynka's processing of Customer Personal Data as a processor or service provider, this DPA controls to that extent.
2. Definitions
"Customer Personal Data" means personal data contained in Customer Data that Lynka processes on Customer's behalf. "Data Protection Laws" means privacy and data-protection laws applicable to processing under this DPA. "Controller", "Processor", "Personal Data", "Processing", "Data Subject" and "Personal Data Breach" have the meanings given by applicable Data Protection Laws.
3. Roles and Instructions
Customer determines the purposes and means of processing Customer Personal Data and generally acts as controller. Lynka generally acts as processor or service provider. If Customer itself acts as processor for another controller, Customer appoints Lynka as its subprocessor and represents that it has authority to do so.
Customer's documented instructions include the Terms, this DPA, Customer's configuration and authorized use of the Services and additional lawful instructions agreed in writing. Lynka will process Customer Personal Data only on documented instructions unless applicable law requires otherwise.
4. Customer Compliance and Unlawful Instructions
Customer is responsible for the lawfulness of its instructions, transparency to Data Subjects, lawful basis, data minimization and other controller obligations. If Lynka reasonably believes an instruction infringes applicable Data Protection Laws, Lynka may inform Customer and suspend the affected processing until the issue is resolved.
5. Processing Details
The subject matter, duration, nature, purposes, categories of Data Subjects and categories of Customer Personal Data are described in Annex I.
Processing may include collection at Customer direction, hosting, storage, organization, retrieval, consultation, display, synchronization, transmission at Customer direction, backup, security monitoring, troubleshooting, export, deletion and other operations necessary to provide and support the Services.
6. Confidentiality
Lynka will limit access to Customer Personal Data to personnel and authorized providers who need access for their role and who are subject to confidentiality obligations appropriate to the data. Persons acting under Lynka's authority will process Customer Personal Data only as authorized.
7. Security Measures
Lynka will maintain technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking account of the nature of processing and risk. Current categories of measures are described in Annex II.
Customer remains responsible for workspace configuration, role assignments, credential and endpoint security, connected integrations and evaluating whether Lynka is appropriate for regulated data.
8. Subprocessors
Customer grants Lynka general written authorization to use subprocessors necessary to provide and secure the Services. Lynka will maintain a public Subprocessor List and impose contractual data-protection obligations appropriate to each provider's role.
Where applicable Data Protection Laws require advance notice or an objection opportunity for a new subprocessor, Lynka will provide reasonable advance notice through its published subprocessor page, the Service or the customer's administrative contact. A Customer with a legally required objection right may object on reasonable data-protection grounds. The parties will work in good faith to address the objection. If no reasonable alternative is available, either party may discontinue the materially affected feature or Service in accordance with the Terms and applicable law.
Lynka remains responsible for its subprocessors to the extent required by applicable Data Protection Laws.
9. Data Subject Rights
Taking account of the nature of processing and information available to Lynka, Lynka will provide reasonable assistance through product functionality or support to help Customer respond to valid requests concerning Customer Personal Data.
If Lynka receives a request relating to Customer Personal Data for which Customer is the controller, Lynka may direct the requester to Customer and will not independently decide the request on Customer's behalf unless instructed or legally required.
10. Compliance Assistance
Taking account of the nature of processing and information reasonably available, Lynka will provide reasonable assistance concerning security of processing, personal-data-breach assessment, data-protection impact assessments and regulatory consultation where those obligations apply to Customer's use of the Services and Customer cannot reasonably obtain the necessary information itself.
11. Personal Data Breaches
If Lynka becomes aware of a confirmed Personal Data Breach affecting Customer Personal Data for which notification to Customer is required, Lynka will notify Customer without undue delay and provide information reasonably available about the incident, affected data or systems, likely consequences and measures taken or proposed, to the extent known and legally permitted.
Notification is not an admission of fault or liability. Customer is responsible for deciding whether it must notify regulators or Data Subjects except where law imposes a separate obligation directly on Lynka.
12. Government and Legal Requests
Where legally permitted, Lynka will notify Customer of a binding government, law-enforcement or court demand requiring disclosure of Customer Personal Data. Lynka will disclose only information it is legally required to disclose and may challenge requests that appear unlawful or overbroad where appropriate and reasonable.
13. International Transfers
Customer Personal Data may be processed outside the country in which Customer or a Data Subject is located. Where a restricted transfer requires a transfer mechanism, the parties will use a legally permitted safeguard.
Where the EU General Data Protection Regulation applies to a transfer to a country without an applicable adequacy decision, the European Commission Standard Contractual Clauses adopted under Decision (EU) 2021/914 are incorporated to the extent required. Module Two applies where Customer is controller and Lynka is processor; Module Three applies where Customer is processor and Lynka is subprocessor. For restricted transfers from the United Kingdom, the applicable UK addendum or other lawful mechanism applies where required.
14. Return and Deletion
During an active subscription, authorized users may use available product functionality to access or export Customer Data subject to permissions and service limits.
Workspace deletion currently uses a fourteen-day grace period. When the production workspace purge completes, the active workflow removes the workspace's applicable managed-storage files, tracked external storage objects and active database records. Completed workspace export archives are retained for seven days after completion before automatic deletion.
Lynka may retain limited information after termination where law permits or requires it, including billing, tax, fraud-prevention, security, suppression, legal-acceptance, consent, deletion-request, dispute and legal-claim records. Provider-managed residual backups and logs may persist until the applicable retention cycle expires.
15. Compliance Information and Audits
Lynka will make information reasonably necessary to demonstrate compliance with processor obligations available to Customer, subject to confidentiality and security.
Where standard documentation is insufficient and applicable Data Protection Laws require an audit right, Customer may request an audit no more than once in a twelve-month period unless a regulator, confirmed breach or material compliance concern reasonably requires more frequent review. Audits must use reasonable advance notice, protect other customers' data, avoid unreasonable disruption and use an auditor subject to confidentiality. Customer bears its own audit costs and reasonable Lynka costs for extraordinary custom or on-site support unless law requires otherwise.
16. Liability
Liability arising under this DPA is subject to the limitations and exclusions in the Terms of Service to the maximum extent permitted by applicable Data Protection Laws. Nothing in this DPA limits Data Subject rights or regulatory powers that cannot legally be limited by contract.
17. Duration and Survival
This DPA remains in effect while Lynka processes Customer Personal Data on Customer's behalf. Confidentiality, deletion, audit, transfer and other provisions that by their nature should survive continue for as long as necessary to give them effect.
18. Governing Law and Contact
This DPA follows the governing-law provisions of the Terms except where applicable Data Protection Laws or incorporated transfer clauses require otherwise. DPA and privacy requests may be sent to support@lynkacrm.com.
Annex I — Processing Description
- Subject matter: operation of Lynka and customer-selected business features.
- Duration: the Service term plus applicable export, deletion, security and legally required retention periods.
- Nature: hosting, storage, organization, retrieval, display, synchronization, communication at Customer direction, support, security monitoring, backup, export and deletion.
- Purposes: providing, securing, maintaining and supporting the Services according to Customer instructions.
- Data Subjects: Authorized Users; Customer employees and contractors; leads; prospects; contacts; customers; suppliers; communication recipients; support requesters; and other individuals whose data Customer places in Lynka.
- Personal Data categories: identity and contact data; professional information; CRM relationship data; notes and activities; communications and metadata; documents; quote, invoice, purchasing, accounting and transaction details; support records; user roles and permissions; and other information Customer chooses to submit.
- Special-category or highly regulated data: not intentionally required for ordinary Lynka use. Customer should not submit it unless the relevant feature expressly supports that use and Customer has the required authority and safeguards.
- Frequency: continuous or intermittent according to Customer and Authorized User activity.
Annex II — Technical and Organizational Measures
- Authenticated access controls.
- Row Level Security and workspace isolation across application data where configured.
- Role and permission controls.
- Protected transport for service communications.
- Private storage buckets for protected lifecycle exports, reports, documents and avatars.
- Logging and monitoring for security, abuse and reliability events.
- Internal HMAC-authenticated worker calls and nonce-replay protection for sensitive lifecycle workers.
- Automated account and workspace deletion workflows with retry/lease controls.
- Removal of tracked external storage objects during workspace purge.
- Operational backup and recovery capabilities provided by infrastructure providers according to the subscribed service tier.
- Personnel/provider access limited to authorized business need and contractual confidentiality where applicable.
Annex III — Current Processing Providers
- Hosting, database, authentication and storage providers used to operate the Services.
- Email delivery, analytics, security monitoring and workflow providers used where enabled.
- Freemius — Merchant of Record and subscription checkout provider for current Lynka plan purchases; other supported payment providers may apply to legacy or separately identified transactions.
- Business-data and search providers used by Lead Generator where applicable.
- Google — user-selected Gmail integration provider; Google data use is additionally governed by Google's API policies.