Introduction

LISS Inc. (“LISS”), together with its subsidiaries (collectively, “LISS”), provides high-performance data center services including colocation, managed hosting, cloud, and network services across a network of data centers and POP locations. LISS customers may use LISS services to store, transmit, encrypt, decrypt, modify, process and otherwise manipulate or transmit data. In most cases, LISS does not directly control how its services and infrastructure are utilized and what information is stored on or transmitted through such infrastructure.

Certain data pertaining to individuals in the European Economic Area and the United Kingdom may constitute protected “personal data” as defined in the European Union (“EU”) General Data Protection Regulation (“GDPR”). In addition, certain of the LISS Services may constitute “processing” as defined in GDPR. As such, GDPR may apply to LISS in certain circumstances, depending on the services provided and data stored.

The following disclosures concerning LISS’s compliance with GDPR are presented for informational and compliance purposes only. Nothing in these disclosures constitutes a representation that any particular data or service is governed or subject to GDPR, nor do these disclosures represent or constitute any contract or undertaking with any customer or prospective customer.

Effective Date of GDPR

GDPR became effective on May 25, 2018.  Although the United Kingdom has withdrawn from the European Union, a version of the GDPR was adopted into law in the United Kingdom on January 1, 2021 and continues to apply to individuals there.  On and after such dates, LISS complies with GDPR to the extent applicable.

LISS’s Status Under GDPR

Under GDPR, LISS may be designated as (i) a “processor” subject to GDPR with respect to certain data sets; (ii) a “controller” subject to GDPR with respect to certain data sets; or (iii) not subject to GDPR for certain data sets.

Processor

If GDPR applies, in most cases, LISS will be a “processor.” This means that LISS will store or perform some other set of operations on a data set that contains “personal data” for a customer, at the customer’s written direction.

Example: LISS provides managed hosting services to Customer A, a retailer based in France. This customer stores shoppers’ names, birthdates, email addresses and credit card information and many of these shoppers are EU citizens. Customer A is a “controller” of the shopper data. In connection with the managed hosting services, LISS has logical access to the shopper data, and therefore, LISS is a “processor” of the shopper data. LISS processes data for Customer A pursuant to a data processor agreement.

Controller

LISS also collects and stores contract information, payment information, employee records, and other information for the purposes of conducting business, marketing, employment, and more. In these cases, LISS is a controller of data.

Example: LISS enters into a contractual agreement with Customer B concerning the use of colocation space. Customer B is based in the EU.  LISS receives personal information regarding employees of Customer B during negotiations, including the employees’ work email addresses. LISS is a “controller” of this data.

GDPR Does Not Apply

For other relationships, GDPR will not apply, either because the data does not constitute protected data, or because the customer is not subject to GDPR.

Example: A US-based customer purchases managed hosting services for marketing data concerning US citizens. GDPR does not apply.

Example: An EU-based customer purchases colocation services from LISS. LISS does not have logical access to any customer data. LISS does not have logins, passwords, or any other data, and cannot access the server. LISS provides only physical security of the actual machine storing the data. LISS is not a data processor because LISS does not perform any operation on the customer’s data. It is not necessary to execute a processor agreement with LISS under GDPR.

Example: An EU-based customer purchases network services from LISS. LISS does not have logical access to any customer data in connection with network services. It is not necessary to execute a processor agreement with LISS under GDPR, because LISS is acting as a “mere conduit” of the data and is not considered a processor of the data.

LISS Responsibilities

Security: LISS implements standard up-to-date security measures to secure the environment and connections through which LISS provides its services. LISS can deliver additional and/or alternative measures upon customer’s request.

Disclosure: LISS will not disclose any information to any third party unless authorized by law, or authorized by either the data subject, controller, or processor as the case may be.

LISS Compliance As Processor

If LISS will be processing personal data (as “processing” is defined under GDPR) for a customer or other third party, LISS will enter into a Data Processing Agreement with the customer or third party. This agreement contains standard contractual clauses required by GDPR and governs the terms of LISS’s processing of the protected data at issue.  A sample copy of LISS’s standard form of Data Processing Agreement may be found here.

LISS Compliance As Controller

If LISS is a “controller” under GDPR, LISS will comply with applicable GDPR obligations. These include, but are not limited to the following:

• LISS will lawfully process data.
• LISS will enter into processing agreements with any third-party processors prior to sending personal data to such processors.
• LISS will maintain all required records and provide required modalities for the exercise of rights of the data subject.
• LISS will retain data only as long as necessary for the purpose for which it was obtained.
• LISS will provide required notices.
• LISS will adopt all required policies and procedures and train employees who handle personal data governed by GDPR.
• LISS will implement privacy by design and privacy by default with regard to personal data governed by GDPR.
• LISS will provide all required notifications in the event of a data breach.

GDPR Compliance

To ensure GDPR Compliance, LISS undertakes the following:

• LISS enters into data processing agreements with its customers if GDPR applies to the processing of their data.
• LISS enters into sub-processing agreements with its providers if necessary.
• LISS maintains all documentation required by GDPR and provides all required notices.
• LISS maintains up-to-date security measures, performs regulator audits, and will implement additional security at the customer’s request and pursuant to the terms of applicable agreements.
• In areas applicable to GDPR, LISS offers its customers assistance in relation to security, data subject rights, data breaches, data protection impact assessment, prior consultation, and other elements of GDPR.

For any further questions regarding this notification or LISS’s compliance with GDPR more generally, please contact us at: gdpr[at]lisstech.com.  Please be advised that LISS cannot respond to any questions regarding your status as a controller or processor.

LISS Processors and Subprocessors

LISS uses certain processors and subprocessors to assist it in providing LISS Services. These processors and subprocessors may process personal data. A list of current LISS processors and subprocessors is available here.

Data Subject Notifications

As set forth above, in certain instances LISS will act as a controller under GDPR. Article 13 and 14 of GDPR require LISS to provide certain information to data subjects when collecting their personal data directly from them or from third parties (such as an employer).

This summary is for informational purposes only and is qualified in its entirety by applicable privacy policies and terms of use provided elsewhere on this website and by LISS affiliates. In the event of conflict, the terms of the applicable privacy policy or terms of use shall govern.

Identity of the Controller

LISS and/or any of its domestic and foreign subsidiaries will constitute the controller for GDPR purposes in the event that the data in question is personal data under GDPR and is collected by LISS. If you have any questions or concerns regarding collection of your personal data, please contact gdpr[at]lisstech.com.

Purposes of Processing of Data

LISS may utilize personal data in a number of ways to meet obligations under various agreements, to pursue legitimate interests such as facilitating services pursuant to contractual agreements with entities, including providing services such as colocation, managed hosting, cloud, and network services. The legal basis for this processing generally will be that it is necessary for the legitimate interests outlined above, but other bases may include compliance with legal obligations or consent.

Recipients of Data

The recipients of personal data will depend in large part on the services being provided that require the processing of personal data. In many cases, the only recipients of such data will be employees of LISS who have committed themselves to confidentiality. In other cases, LISS may transmit such data to processors or other controllers as necessary to meet LISS’s obligations.

Transfer Outside of EU/EEA or the UK

LISS may transfer personal data outside of the European Union / European Economic Area or the United Kingdom. When LISS does this, appropriate safeguards will be in place, such as an adequacy decision under the GDPR (an official determination that local law provides sufficient protection for personal data) or a data processing agreement containing the standard contractual clauses approved under GDPR. LISS will only transfer personal data to controllers and processors outside of the EU/EEA or UK who meet these standards.

Duration of Storage

LISS will only store your data as long as required by the basis for processing. For example, LISS will only store personal data that is being processed pursuant to LISS’s legitimate interest so long as such interest is present. If LISS is processing personal data based on consent, that consent may be withdrawn by you at any time. Please contact gdpr[at]lisstech.com to withdraw such consent.

Your Rights as a Data Subject

LISS is committed to fulfilling its obligations concerning the exercise of your rights under GDPR. Please be advised that you have the following rights under GDPR (to the extent GDPR applies to your personal data):

• The right to request access to, rectification or erasure (i.e., the right to be forgotten) of personal data or restriction of processing or to object to processing;
• The right to data portability;
• The right to lodge a complaint with a supervisory authority; and
• In certain circumstances, the right to know the source of the data and whether the source was public.

Should you have any questions regarding the exercise of these rights, please contact gdpr[at]lisstech.com.  LISS may provide additional information in communications directly with data subjects as necessary.

Last Revised: March 2023