# Legal documentation
Cover image
Platform Terms of UseTerm of use.pngTerms of Use (Platform)
Platform Privacy PolicyPrivacy policy.pngPrivacy Policy (Platform)
Master Services AgreementMaster Services agreement.pngMaster Services Agreement
Data Processing AddendumData Processing.pngData Processing Addendum
Sub-ProcessorsSub Processors.pngSub-Processors Notice
Security MeasuresSecurity Measures.pngSecurity Measures Notice
Product TermsProduct terms.pngProduct Terms
Third-Party Model TermsThird Party terms.pngThird-Party Model Terms
# Terms of Use (Platform) March 2024 | LEGAL NOTICE | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

Lampi.ai is a service developed by Lampi AI SAS, a French simplified joint stock company, registered with the trade and companies register of Paris under number 978 788 347, with registered offices located at 66 Avenue des Champs Elysées 75008 Paris.

The director of publication is M.Guillaume Couturas.

Contact :

| ## 1. Definitions Where drafted in upper case, whether written in singular or plural, the following definitions are applicable to the entire Terms.
Accountrefers to a User’s dedicated and individualized digital interface on the Platform and granting access to the Services.
Administratorrefers to a Customer designated End User who administers Customer’s Account and has access to permissions and other settings.
Artificial Intelligencerefers to a system that is designed to operate with a certain level of autonomy and that, based on machine and/or human-provided data and inputs, infers how to achieve a given set of human-defined objectives using machine learning and/or logic- and knowledge-based approaches, and produces system-generated outputs.
Chatbotrefers to the software developed by Lampi that specializes in natural language dialogue with a human, which is capable of answering questions, triggering the execution of tasks, or generating content.
Customerrefers to a Company or organization that has entered into a Main Services Agreement with Lampi for the uses of the Platform and Services.
Customer Contentrefers to any data, resources, or content used within the Platform by the Customer or End User. User Content may be textual, audio, or visual that End Users provide, submit, upload, publish, or make otherwise available to the Services.
Documentationrefers to refers to all material and digital documentation and user manuals related to the Platform and the Services, available at https://help.lampi.ai, or otherwise provided by Lampi.
End User(s)refers to all persons using the Platform or the Website.
Partiesrefers to the End Users and Lampi.
Lampirefers to Lampi AI SAS, as identified in the front page of the document.
Main Services Agreementrefers to the agreement concluded with Lampi and the Customer that permitted End users to create an account. The Main Services Agreement contains Lampi’s commitment to deliver the Services to Customer, and Customer’s obligations when using the Services.
Outputsrefers to data generated by a machine learning model based upon the Customer Content, that are returned to Customer or End User through the Platform or the Chatbot.
Platformrefers to the website https://www.chat.lampi.ai/, including all its subdomains.
Privacy Policyrefers to Lampi’s privacy policy.
Servicesrefers to the Lampi’s products and services, including the products and services ordered by Customer, or otherwise provided by Lampi and used by Customer under the Main Services Agreement or End User under these Terms, including those products and services described in the Product Terms.
Termsrefers to these terms of use.
Third-Party Servicerefers to any service offered on the Platform or the Website by a third-party e.g. storage or payment services.
Websiterefers to the website https://www.lampi.ai, including all its subdomains.
## 2. Purpose The purpose of the Terms is to define the conditions under which the Services are provided by Lampi to End Users. ## 3. Acceptance and amendment **Acceptance**. In order to be able to use the Services, End Users agree to fully and unconditionally accept these Terms by ticking the relevant case on the Platform or by otherwise accessing or using the Services, including the Lampi’s Privacy Policy. The Terms are accessible at any time on the Platform and End Users should read these Terms carefully before accepting them. **Amendment of the Terms and evolution of the Services**. In order to improve their features and quality, Lampi may regularly modify the Platform and the Services. In particular, Lampi may add, remove or replace certain functions at any time. Therefore, Lampi may modify the Terms from time to time. End Users will be informed of changes fifteen (15) days before the new version comes into force. ## 4. Access to the Platform **Customer’s account**. If you sign up for an account with an email address provisioned by a Customer, you are an authorized End User and you must use the Services in compliance with the Terms. The Customer has separately agreed to a Main Services Agreement or entered into a written agreement with Lampi that permitted End Users to create an account. **Relationship between Lampi, Customer, and User.** As between Lampi and Customer, it is solely Customer’s responsibility to (i) inform user of any obligations or restrictions required to use the Services, (ii) obtain any rights, permissions, or consents from user that are necessary for the lawful use of Customer’s Materials and the operation of the Services, (iii) ensure that the transfer and processing of Customer Content under the Main Services Agreement is lawful, and (iv) respond to and resolve any dispute with any user relating to the Services, Customer Content, or Customer’s failure to fulfill these obligations. **User Account and Registration**. To access the Platform, End Users must first register on the Platform and create an Account. When you register for an account, you may be required to provide us with some personal information (as described in our Privacy Policy, such as your name, email address, or other contact information), and you agree to provide true, accurate, current, and complete information when requested by Lampi. End Users must provide all information required by Lampi to use the Services. Any incomplete registration will not be validated. Lampi reserves the right to verify the information provided and to refuse any invalid and/or incomplete registration request. Any natural person who accepts the Terms in the name and on behalf of a Customer acknowledges that he/she is authorized to do so. The Customer may in no case be released from its obligations on the grounds that the natural person did not have the authority to commit himself/herself. **Security**. When you register, you will be asked to provide a password, and you are solely responsible for maintaining the confidentiality of your account and password. You agree and acknowledge that you are solely responsible and liable for all activities that occur under your account. If you believe that your account is no longer secure, then you must immediately notify us at . **Management of your Account.** As you access the Services with the account of a Customer, such as your employer or other company with which you are associated, your account can be managed by an account administrator on behalf of that Customer. The administrator will have the ability to access, monitor, use, modify, withhold, or disclose any data associated and to control end User access to and use of the Services. **Access Restrictions.** From time to time, Lampi may restrict access to all or any part of the Services to particular categories of End Users. ## 5. Use of Services During the Terms, Lampi grants to End Users a limited, non-exclusive, non-transferable, revocable right to use the Platform and the Services, not specifically governed by additional terms and for purposes authorized by Customer. Nothing in these Terms will be construed to grant you any right to transfer or assign rights to use the Services. The scope and the features of the right to use the Platform and Services will depend on the Main Services Agreement. ## 6. Commitments **Lampi’s commitments**. Lampi’s commitments are mentioned in the Main Services Agreement. **User’s commitments**. End Users agree and guarantee: * to comply with the laws and regulations in force in the country in which they are located; * to refrain from all kind of fraudulent activities; * that they are of legal age or have obtain a legal representative authorisation and supervision and have the capacity to enter into an agreement with Lampi and as the case may be with other End Users, in accordance with the laws of the country in which they are located; * that they possess or have been granted permission to utilize all the User Data which facilitates the provision of the Services, * that the data, resources, or content used within the Platform do not infringe, misappropriate, or otherwise violate any third-party Intellectual Property Rights or breach any applicable laws, * to provide information that is truthful, accurate and free from error when interacting in and with the Platform and the Services, to keep this information up-to-date throughout their time using the Platform and the Services and to publish content that meets these same requirements; * to use the Platform and the Services in accordance with its intended purpose and objective. End Users understand and accept that the following acts are strictly prohibited: * any behavior that disrupts, suspends, slows or prevents the continuity of the Platform and Services; * any intrusion or attempted intrusion into Lampi's information systems or infringement of the security and authentication measures; * any attempt to create, train, develop, or improve similar or competitive products or services; * any use of the Services for benchmarking or competitive analysis of Lampi; * any act infringing Lampi's rights and financial interests, whether commercial or legal; * any copying and/or misappropriation of the Platform and more generally any misuse of the Platform; * any act of selling, reselling, licensing, renting, leasing, or distributing the Output to an unaffiliated third party (who is not a customer, partner, licensee, or end-user of Customer) or otherwise use the Outputs for the benefit of an unaffiliated third party; * any act of submitting or distributing viruses, worms, Trojan horses, corrupted files or other destructive content; * any use of robot, spider, scraper, or other unauthorized automated means to access the Services; * any act of finding security vulnerabilities to exploit the Services; and * any denial of service (DoS) attack on the Services or any other conduct that attempts to disrupt, disable, or overload the Services, such as submitting excessively frequent requests; * any infringement of Lampi’s intellectual property rights. ## 7. Suggestions You may submit to Lampi feedback, ideas, or suggestions regarding Lampi’s Services or new products and services by sending an email at . Lampi may, but has no obligation to, in its discretion and for any purpose (i) use, modify, and incorporate into Lampi’s products and services and (ii) license, sublicense, or distribute the suggestions without obligation or compensation to you. Do not submit any suggestions that are confidential or that are owned by any third party in any form to Lampi. ## 8. Confidential Information Lampi may disclose business or technical information to you under this Agreement which is confidential (“Confidential Information”). You will use reasonable care (i) to only use the Confidential Information in relation to the permitted purpose under these Terms, and (ii) except as permitted by Lampi, not disclose the Confidential Information to any third party except Customer. Confidential Information will not include any information that (i) is or becomes public through no fault of End User, (ii) was known to End User prior to receipt, provided that User did not learn of the Confidential Information in violation of an obligation of confidentiality, (iii) is obtained by User from a third party not under an obligation of confidentiality, and (iv) is independently developed by end User without use of the Confidential Information and separate to and independent of any use of the Services. ## 9. Third-Party Services Lampi may provide information about or access to Third-Party Services, or you may use Third-Party Services with the Services, but (i) Lampi does not endorse or make any representations or warranties about Third-Party Services, and (ii) use of Third-Party Services is at your own risk. Third-Party Services may be subject to separate license agreements or restrictions on use, which are provided in the Documentation to the extent required,, and you agree to comply with all such third-party restrictions. ## 10. Liability **General**. End Users expressly understand and agree that access to the Platform and the use of the Services is at the User's own risk, and that the Services and the Platform are provided on an "as is" and "as available" basis without warranty of any kind, either express or implied, except as otherwise provided by law. To the fullest extent permitted by law, Lampi does not represent or warrant that: (i) access to or use of the Services or the Platform will be uninterrupted, timely, secure or error-free; (ii) Outputs provided by the Services or on the Platform will always be accurate. **Artificial Intelligence**. End Users acknowledge that the Services are based on Artificial Intelligence, a technology that is constantly evolving and that the responses generated might not be entirely accurate. Results and outcomes generated by machine learning algorithms and artificial intelligence are probabilistic and End Users should evaluate such results and outcomes for accuracy as appropriate for End Users’ use case, including by employing human review. End Users are solely responsible, and Lampi will have no liability, for all decisions made, advice given, actions taken, and failures to take action based on End Users’ use of the Services or Output.. **Lampi's liability.** To the fullest extent permitted by law, and unless otherwise provided by law, the aggregate liability of Lampi to you for all claims arising out of or relating the the use of the Platform of the Services, or otherwise under these Terms, is limited to where Lampi’s liability may be established by End Users. To the fullest extent permitted by law, Lampi’s liability is limited to €200. Because some jurisdictions do not allow limitations on implied warranties, or limitations of liability for consequential or incidental damages, these limitations may not apply to you. **Limitation on Lampi’s indirect liability.** In any case, Lampi will not be held liable for any other damages and losses suffered by the End User, in particular indirect damages (including but not limited to, earning or profit losses, commercial damages, the consequences of complaints, actions, claims of third parties against the User) even where Lampi has been informed of their occurrence. In particular, unless otherwise provided by law or regulation, Lampi shall not be held liable for: * breakdowns or malfunctions of the Services lasting less than 24 hours or that are not the responsibility of Lampi; * loss of data due to misuse of the Services; * an unusual or illegal use of the Services offered by a third party or by a User; * harmful or unintended consequences of the operation of Third-Party Services; * indirect damage resulting from the use of the Services or the Platform; * a malfunction or cyberattack; * the harmful consequences of the suspension of an Account; * any case of force majeure, within the meaning of Article 1218 of the French civil code. End Users understand and acknowledge that they bear responsibility for their End User Content. End Users assume full liability for such content, including its legality, reliability, accuracy, and appropriateness. We do not endorse or take responsibility for any End User Content, and to avoid ambiguity, we explicitly disclaim any liability associated therewith. **End User’s liability.** The End User guarantees Lampi against any complaints, claims, actions and/or demands that Lampi may suffer as a result of the End User's breach of any of his/her obligations under these Terms. The End User undertakes to indemnify Lampi for any damage suffered as a result of such a breach. ## 11. End User Warranty You may be permitted to submit, upload, publish, connect or otherwise make available to Customer and other users, through the Services Customer Content. You represent and warrant that: (i) you have the necessary rights, licenses, and permissions for all Customer Content, and any other data you might submit; and (b) neither Customer Content, nor your submission, uploading, publishing or otherwise making available of any other data will infringe, misappropriate or violate a third party’s intellectual property rights, or rights of publicity or privacy, or result in the violation of any applicable law or regulation. ## 12. Duration, suspension and termination **Duration**. The Terms ends when Customer’s subscription expires or terminates, or your access to the Services or Platform is terminated as described below. **Suspension**. If Customer or an End User breaches the Terms, Lampi may temporarily and without prior notice suspend access to the Platform and the Services. After an investigation period during which Lampi shall verify the truth of the alleged violations, access to the Platform and/or to the Services may be restored or the Terms may be terminated. **Termination**. Without prejudice to any other action, Lampi may terminate these Terms and block the User’s access to the Platform in case of material breach of these Terms and in particular in case of a breach of the sections entitled “Commitments” and “Intellectual Property”. In addition, Lampi or Customer may, at its sole discretion, terminate these Terms or your account, or suspend or terminate your access to the Services, at any time for any reason or no reason, with or without notice. You may terminate your account and these Terms at any time by contacting Customer or . Upon termination of these Terms: (i) your rights will terminate and you must immediately cease all use of the Services, and (ii) you will no longer be authorized to access your account of the Services. In the event of a change in the applicable regulations affecting the capacity of Lampi or its employees to execute the Services the Terms will automatically be terminated. Termination of the Terms shall not result, in any event, in any compensation from Lampi to an End User. ## 13. Hyperlinks The Platform may contain links or content redirecting to third-party websites or resources, which may be subject to different policies. Lampi is not responsible for the content available through such links. ## 14. Intellectual property **Lampi’s Intellectual property**. All rights not expressly granted to you or Customer are reserved by Lampi. The Platform and all its functionalities are Lampi's sole intellectual property and are protected by all intellectual property rights in force. Any use, reproduction or representation in any form of the Platform, the Services or any of Lampi’s content, such as source code, databases, functionality, software, website designs, audio, video, text, photographs, or graphics on the Website or the Platform, without express written permission is strictly prohibited. **End Users’ Intellectual property**. The Platform, through the use of the Chatbot, may invite End Users to chat or discuss and may provide them with the opportunity to create content and materials, including but not limited to text, writings, video, audio, photographs, graphics, comments, suggestions, or personal information or other material. Such content is only viewable and accessible by the user in his/her own digital interface, except in the case of: * shared spaces, where all users of the shared space can view and access the shared content; * invite spaces; where all invited user can view and access the content. When you submit Customer Content to Lampi to facilitate Lampi’s provision of the Services, you acknowledge and agree that the Customer Content are owned by Customer. As such, any content created by an End User and Outputs are treated as confidential and remain the sole property of the Customer, except as otherwise decided between the Customer and the End user. ## 15. Miscellaneous **Nullity**. If any provision of the Terms is annulled by a modification of legislation, regulation or by a court decision, the rest of the Terms will not be affected. **Assignment**. End Users may not assign or transfer the Terms to a third party without the prior written consent of Lampi. Any assignment attempted to be made in violation of these Terms will be null and void. **Waiver**. Failure by End User or Lampi to insist upon the performance of any of the terms and conditions of these Terms shall not be construed as a waiver of such and shall in no way affect the End User or Lampi’s right to enforce such provision. **Entire Agreement.** These Terms, included any terms incorporated by reference and other named agreement, contain the entire agreement between Lampi and the End User supersede all previous communications, representations, understandings, and agreements, either oral or written, between the parties with respect to the purpose of these Terms. To the extent of any conflict or inconsistency between the provisions in these Terms and any policies referenced in these Terms, the terms of these Terms will first prevail; provided, however, that if there is a conflict or inconsistency between the Master Services Agreement and these Terms, the terms of the Master Services Agreement will first prevail, followed by the provisions in these Terms, and then followed by the policies referenced in these Terms (e.g., the Privacy Policy). The Customer will be responsible for notifying End Users of those conflicts or inconsistencies and until such time the terms set forth herein will be binding. **Terms of Use Modifications**. Lampi may revise these Terms periodically. If we make any material changes to these End User Terms, we will notify you prior to the update’s effective date (except for changes due to legal or regulatory reasons which may be effective immediately). By continuing to use the Services after the changes become effective, you are agreeing to be bound by the modified terms. Disputes. Any dispute in relation to the use of the Platform and the Services shall be submitted to Lampi by sending an email to . **Governing Law and Jurisdiction**. The Terms are governed by and interpreted according to French laws, except French conflict-of-law rules. Unless otherwise provided by the law, any conflict or dispute related to the validity, the interpretation, performance, and/or termination of the Terms must be submitted to the exclusive jurisdiction of the Paris courts. Non-professional EU residents may submit any dispute related to the Terms in the jurisdiction where they were living at the moment of the acceptance of the Terms or in the jurisdiction where the damage occurred. ## 16. Contact If you have any questions about these Terms or our Services, please contact us at . ***
# Privacy Policy (Platform) March 2024 | LEGAL NOTICE | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

Lampi.ai is a service developed by Lampi AI SAS, a French simplified joint stock company, registered with the trade and companies register of Paris under number 978 788 347, with registered offices located at 66 Avenue des Champs Elysées 75008 Paris.

The director of publication is M.Guillaume Couturas.

The purpose of this document is to provide information regarding the processing of Personal Information by Lampi in compliance with article 13 of the GDPR.

We do not have a data protection officer but you may contact us at the following email address :

For all legal general questions please contact:

| ## 1. Definitions Where drafted in upper case, the following definitions are applicable to the entire Privacy Policy.
Account refers to a User’s dedicated and individualized digital interface on the Platform and granting access to the Services.
Administratorrefers to a Customer designated Authorized User who administers Customer’s Account and has access to permissions and other settings.
Customerrefers to a Company or organization that has entered into a Main Services Agreement with Lampi for the uses of the Platform and Services.
Lampi, We, Us, Ourrefers to Lampi.
Personal Informationrefers to any information relating to an identified or identifiable natural person, as defined in article 4 of the GDPR.
Platformrefers to the website https://chat.lampi.ai/, including all its subdomains.
Servicesrefers to the Lampi’s products and services, including the products and services ordered by Customer, or otherwise provided by Lampi and used by Customer under the Main Services Agreement or Authorized User under these Terms, including those products and services described in the Product Terms.
Terms of Userefers to the terms and conditions applicable to the Services.
Users, You, Yourrefers to any data subject to the collection and processing of Personal Information by Lampi.
Websiterefers to the website https://lampi.ai/, including all its subdomains.
Unless stated otherwise, definitions stated in the singular shall have the same meaning in the Master Services Agreement. Any term defined in article 4 of the GDPR and mentioned in this Privacy Policy shall have the same meaning. ## 2. Foreword Lampi believes that trust is the key to successful and lasting relationships. In this respect, the protection of Your Personal Information and privacy is no exception. For this reason, Lampi takes great care to collect and process Your Personal Information only with the utmost care and in strict compliance with the applicable legal framework. In drafting this Privacy Policy and making it available to Our Users, We intend to fulfill Our duty to inform data subjects within the meaning of articles 13 and 14 of the Regulation EU (2016/679) of the EU Parliament and the Council of 27 April 2016 (the “GDPR”). This Privacy Policy will describe how Your Personal Information is processed when You navigate the Website or Platform and use the Services offered by Lampi. This Privacy Policy applies to Personal Information we collect when you use the Website, the Platform, and our Services, or otherwise interact with us. This Privacy Policy does not apply to the extent we process Personal Information in the role of processor or service provider on behalf of our customers. Customers are solely responsible for establishing policies for and ensuring compliance with all applicable laws and regulations, as well as any and all privacy policies, agreements, or other obligations relating to such Customers’ use or collection of personal information in connection with the use of our Services by individuals with whom our Customers interact. If you are an individual who interacts with a Customer using our Services or you otherwise believe that a Customer uses our Services to process Your personal information, and you contact us regarding this data, you will be directed to contact the applicable Customer for assistance with any requests or questions relating to Your personal information, including without limitation any requests to access, amend or erase Your personal information. We may amend this Privacy Policy from time to time, in which case We will update You by any available means, including by way of notification on the Platform. ## 3. Our role Lampi acts as a data controller regarding User’s Personal Information. ## 4. Personal Information We Collect When you subscribe to Lampi or chat with us, we may ask you for Your name, Your first name, Your postal address, Your telephone number, Your email address, the company in which you work, Your function, Your contact preferences, and more generally any other data allowing a persona to be identified. The categories of Personal Information that Lampi may be required to process are as follows: | **Category** | **Description** | | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Connection data | Identification and contact data, Logs, timestamp, navigation path | | Location data | country | | Internet data | IP address, browser language, browser type | | Payment data |

Billing information we collect in order to process Your payment for use of the Services such as:

  • credit card details;
  • Billing address.
| | Marketing and Communications Data |

Contact information we collect when you express interest in our Services, sign up for an event or webinar, provide our partners with Your information, or download certain content. This may include:

  • First and last name;
  • Email address;
  • Address;
  • Phone number
  • Function;
  • Company name.
| | Feedback and Support data | Any other Personal Information you voluntarily choose to provide:Personal Information in request or feedback you send us | | Customer Data | Personal information contained in the digital files and data that Customers or Authorized Users provide to Lampi. | ## 5. How and why we use Personal Information Lampi only processes personal data strictly necessary to achieve the specified and legitimate purposes defined in this section. In accordance with current regulations, Lampi does not process any sensitive data such as racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership of the persons concerned. The same applies to any information on the life or sexual orientation, genetic, biometric or health data of the persons concerned. **Collection methods.** We receive information from You, directly and indirectly. **Directly**: Most of the information We process is information You give us when using Our Services and in one of the situations described below: * When You browse our Website or the Platform, including behavioral information on Our Website for the purposes of optimizing the customer journey; * When submitting a form on Our Website, you are asked for Personal Information such as data relating to Your professional life, identification data or location data. These are used as part of the prospecting relationship or in accordance with the GDPR if information is transmitted to You; * In an information transfer, via email, push notification or in-app message about product updates, industry news, new partnerships and events. You may be asked for identification information such as Your email address, first name and last name. You can always withdraw Your consent to receive commercial offers from us by using the unsubscribe link at the bottom of any email received. * When you register to Lampi, you are asked for identification data such as Your email address, Your first name, or Your last name. Legally, we need this data to carry out the Services described in the Main Services Agreement the Customer signed with us. * During a commercial partnership with Lampi, You will be asked for identification and professional data such as Your contact details, Your legal address and Your professional email address. We collect this data in accordance with the conditions set out in the contract you have signed. * During Your use of the Platform, internet data may be collected for the purposes of optimizing Our platform to understand Your use. * When making contact, by email, telephone or another channel, personal identification data such as Your email address, Your telephone number (mobile or landline), Your first and last name, as well as any other information in Your contact (professional life data). * Indirectly: We may also collect Personal Information from third-party sources such as authentication partners and public databases for the purposes of user authentication and marketing activities. For example, if you create or log into Your Lampi account using Your Google Account credentials, we will access Your name and email for authentication. * Automatically. We use typical tools and services, such as log files, tags, and similar technologies to automatically collect information, which may contain personal information from Your devices while you navigate our Services or interact with emails we sent to you. **Objectives and bases of legality.** Your Personal Information has several purposes for us depending on the data and the relationship you have with Lampi. We distinguish the following categories: | **Purpose** | **Categories of Personal Information** | **Why We Do This** | **Legal Basis** | | ------------------------------------------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Account Creation | User Data | To register you as a customer or account user | Contractual necessity | | Provide, Maintain, and Improve the Services |

User Data


Feedback and Support Data


Customer data

| To provide the Services in accordance with You or the relevant Customer and develop new services |

Contractual necessity


Our legitimate interest to provide you product and service updates or upgrades and provide customer support

| | Responding to Support Queries |

User Data


Feedback and Support Data

| To respond to requests we receive from you, such as product demonstration requests or support request |

Contractual necessity


Our legitimate interest to provide you product and service updates or upgrades and provide customer support

| | Marketing Activities | Marketing and Communications Data | To market our products and services to you and keep you informed about new updates, as well as follow up on prospective sales leads | Our legitimate interest to provide you product and services updates or upgrades, and information on any related products you may have purchased or shown interest in before | | Event and Webinar Registrations | Marketing and Communications Data | To manage your registration for events and webinars we host, and send communications related to your event registrations | Our legitimate interest to provide you with updates of relevant and upcoming events you may be interest in based on your participation in previous events | | Billing |

User Data


Payment Data

| To process your payment for the use of our Services |

Contractual necessity


| | Business operations |

User Data


Marketing and Communications Data

| For our business purposes such as data analysis, audits, product development, and expanding our business activities |

Contractuel necessity


Our legitimate interest to grow our business and ensure our products and services are meeting customer expectations

| | Complying with our legal obligations | User Data | Where we believe it is reasonably necessary to (i) comply with application law, regulation, legal process, or government request, (ii) protect any person from death or serious injury, (iii) prevent fraud, abuse, or security issue of Lampi or other users, or (iv) to protect Lampi’s or its licensors’ rights, property, safety, or interest |

Legal obligations


Our legitimate interest to protect against misuse of our products and services, protect personal safety, and protect Lampi’s or its licensors’ rights, property, safety, or interest.

| **GDPR compliance**. For GDPR compliance, the basis of lawfulness is the legal obligation in order to respond to GDPR rights requests. The shelf life is 3 years after the closure of an opposition request (limitation period for an offense), or 1 year after closure of a request for access, erasure or rectification (limitation period for an infringement). The recipient of this data is the CNIL, the legal and litigation department of Lampi AI as well as the department which will receive the GDPR rights request. The data source is: the data subjects. This data is necessary for the fulfillment of legal obligations regarding reporting violations and exercising rights ## 6. Personal Information Sharing and Disclosure Within Lampi AI, only authorized personnel have access to your Personal Information. We may share your personal information as described in this Privacy Policy or at the time of collection. Disclosures will only be so that we can process your Personal Information for the purposes set out above. Lampi AI may share your Personal Data to the following third parties: * **Customer Admin and Users**. If your User account was provisioned by a Customer, your Administrator may have access and control over the information associated with your account. The Customer may have its own policies governing access and use of information in your User account. Depending on a Customer’s settings and your choices, we will share certain information with other Users that are part of a Customer account. * **Service Providers**. Lampi uses certain trusted third-party service providers to help us provide, improve, protect, and promote our Services. These third parties may have access to your Personal Information to perform services on our behalf but only as is reasonably necessary for the purpose that Lampi has engaged them for and in compliance with this Privacy Policy. We only share Personal Information with these providers if you have agreed to the transfer, or if it is permitted by data protection law. The information we share is limited to the data necessary for the third parties to provide their services. Lampi AI seeks to conclude data processing agreements with its service providers to ensure that your personal data is used, stored and transferred securely and in accordance with the applicable laws and Lampi AI’s instructions. Any LLM Providers (Anthropic, Azure, Fireworks) are prohibited from using any customer and personal information for model training. They apply a “Zero Data Retention” policy, meaning that Personal Information and Customer Data will not be logged for human review and will not be saved to disk or retained by those providers. Agreements can be found in the [Sub-Processors Notice](https://legal.lampi.ai/sub-processors-notice). * **Third parties you connect to Lampi AI**: **Google and SharePoint:** We access your User Data only to facilitate and enhance the functions of our application. Specifically, we synchronize your documents that are within the folders you select when connecting your Google Drive or SharePoint account to Lampi AI. You can change this selection at any time or request us to delete all your data. The sole purpose of this data is to allow you to use your data on the Platform. Lampi AI will not use this data for any other purpose like advertising or marketing. Regarding Google, Lampi AI uses and transfers of information received from Google API’s to any other app will adhere to [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy#:~:text=You%20must%20disclose%20all%20user,a%20third%20party%20conducting%20surveillance.\)), including Limited Use requirements. Google User Data is never sent to, shared with, or processed by the Deepseek API. * **Affiliates**. Lampi may share personal information with current or future subsidiaries and affiliates for purposes consistent with this Privacy Policy. * **Business Transferees.** We may transfer or otherwise share information in connection with a merger, acquisition, reorganization, or sale of assets, or in the event of bankruptcy. * **Authorities and Others**. We may disclose your information to third parties if we determine such disclosure is reasonably necessary to: (i) comply with applicable law, regulation, legal process, or government request, (ii) protect any person from death or serious bodily injury, (iii) prevent fraud, abuse, or security issue of Lampi or other users, and (iv) to protect Lampi’s or its licensors’ rights, property, safety, or interest. * **Consent**. We may also disclose or share your personal information where you have given us your consent to do so for a specific purpose. To obtain a copy or the location of the guarantees linked to data transfers outside the European Union, please contact: We may sometimes need to transfer personal data outside the European Union in order to provide our services to you. If this is the case, we always ensure that such transfer is carried out in a country considered by the European Commission to have an adequate level of protection of personal data and, if this is not the case, we apply the protections of the CCT (Standard Contractual Clauses adopted by the Commission) in order to achieve the level of protection required by the standard. You can obtain a detailed copy of the transfer tool or further information by submitting a request to Us. ## 7. Data storage By default, Personal Information is stored in France or in European Union. We use industry-standard physical, procedural, and electronic security measures to protect your Personal Information held with our service providers and us, and keep them updated taking into account the state-of-the-art security measures. Access to personal data is also protected with user-specific logins, passwords, and user rights. Our premises are also safe and secure. We will store Personal Information as long as You use the Platform and more broadly any of Our Services. Once Your Account has been inactive for a certain period of time, or if You choose to delete Your online Account or end Our relationship in any manner, We will nevertheless keep and store Your Personal Information for a certain period of time. We will keep Your Personal Information at least 3 years after the end of Our relationship (materialized, for instance, by the deletion of Your Account), for various legal reasons, including statute of limitation rules and potential litigation where We may be involved and where We might need Your Personal Information. This includes, at the moment, all of the Personal Information We process. If the Company considers that it is not necessary to keep Your Personal Information in its active database, it will archive it and ensure that access to it is restricted to a limited number of persons with a genuine need to access it. ## 8. Other information Users are never compelled to provide Personal Information that We may request. However, We draw Your attention to the fact that if You refuse, access to the Services may be limited, suspended or impossible. In any event, and regardless of the purpose of the processing in question, We will adhere to a strict principle of data minimisation and will therefore only collect and process Personal Information that is necessary for the purposes mentioned above. ## 9. Your rights Users are informed that they have the following rights regarding the processing of their Personal Information, under the conditions provided for in articles 15 to 22 of the GDPR: * A right of access to the Personal Information collected by Lampi; * A right to the rectification and/or erasure of the Personal Information collected by Lampi; * A right to the restriction of the processing; * A right to Personal Information portability. According to French privacy laws (articles 84 to 86 of Act n°78-17 of 6 January 1978), Users also have the right to specify instructions defining how Lampi shall manage Person Data after their death under the conditions of such law. Although You have rights, the exercise of such rights is not unlimited; each of the rights offered by the GDPR may be subject to specific conditions. This being said, in order to exercise their rights or for any question on privacy, Users shall make a request accompanied by a proof of their identity by email at Lampi. We will process the requests within a reasonable timeframe taking into account the complexity and the number of requests. We shall strive to reply without undue delay and at the latest within one month of receipt of the request. We may extend this period to three (3) months in the case of a complex request. The exercise of the rights offered by the GDPR are in practice free. However, where Your requests may involve important costs, You may have to bear some of them. Finally, Users have the option to refer to the competent supervisory authority, the French Commission Nationale Informatique et Libertés (“CNIL”), in order to submit a claim. Contact information of the CNIL can be found on its [website](https://www.cnil.fr/fr/contacter-la-cnil-standard-et-permanences-telephoniques). ## 10. Security The Company has implemented measures to protect the confidentiality, security and integrity of Your Personal Information, against unauthorized access and disclosure, modification, alteration, damage, accidental loss or accidental or illicit destruction, as well as against any other form of illicit processing or communication to unauthorized persons. Access to Personal Information is restricted to those employees, partners and service providers who need to know the information, to whom we impose strict security and information protection rules. All persons with access to Personal Information are bound by a duty of confidentiality and may be subject to disciplinary action and/or other sanctions if they fail to comply with these obligations. Where Lampi uses subcontractors, such disclosure is contracted to ensure the protection of such information. Data is hosted and processed on secure servers located within France or the European Union and operated by Lampi's subcontractors acting in accordance with the requirements of the GDPR. However, the Company cannot guarantee you against any loss, destruction or damage of Your Personal Information. The Company is not held, or able to carry out a safeguard of Your data present on Your personal space. In the event that the integrity, confidentiality or security of the User's Personal Information is compromised, Lampi undertakes (i) to notify the CNIL of the breach within Lampi hours of becoming aware of it and (ii) to inform the person concerned as soon as possible when the breach is likely to result in a high risk to the rights and freedoms of that person. When you need to choose a password to access certain parts of the Website that require you to log in to Your personal space, it is Your responsibility to choose a secure password (strong, unique (i.e. not used for another site and/or application, etc.) and to keep it confidential. ## 11. Cookies A cookie is a small computer file playing the same role as a tracker, stored and read for instance at the moment where a website is visited, an email is read or a mobile app is used, whatever the device used. In compliance with EU privacy regulations, Users are informed that “non-essential” cookies may be deposited on their device without their consent. Non-essential cookies include (i) cookies having as their essential purpose to allow or enable electronic communications and (ii) are strictly necessary for the provision of online communication service. The cookies that We use have defined expiration times; unless You visit Our website within that time, the cookies are automatically disabled and retained Data is deleted. ## 12. Changes to the Policy We might review and update this Policy. Any changes We make will be posted on the Platform and, where appropriate, notified to You. Please check back frequently to see any updates or changes to Our Privacy Policy. It is important that the Personal Information We hold about you is accurate and current. Please keep us informed if Your Personal Information changes during Your relationship with Us. # Master Services Agreement ## 1. Definitions Where drafted in upper case, whether written in singular or plural, the following definitions are applicable to the entire Terms.
Administratorrefers to a Customer designated Authorized User who administers Customer’s Account and has access to permissions and other settings.
Affiliaterefers to all entities directly or indirectly controlling, controlled by, or under the control of a Party, where control may be by management authority, equity interest, or otherwise.
Artificial Intelligence refers to a system that is designed to operate with a certain level of autonomy and that, based on machine and/or human-provided data and inputs, infers how to achieve a given set of human-defined objectives using machine learning and/or logic- and knowledge-based approaches, and produces system-generated outputs.
Authorized User(s)refers to all persons using the Platform or the Website.
Authorized User’s Account refers to an Authorized User’s dedicated and individualized digital interface on the Platform and granting Authorized User access to the Services.

Business Days


refers to any day in which normal business operations are conducted (Monday to Friday inclusive), except for holidays.
Business Hoursrefers to the Business Days hours during which business is commonly conducted (9am to 6pm CET inclusive).
Chatbotrefers to the software developed by Lampi AI that specializes in natural language dialogue with a human, which is capable of answering questions, triggering the execution of tasks, or generating content.
Customerrefers to the organization mentioned in the Order Form.
Customer Accountrefers to Customer’s Lampi AI account.
Customer Datarefers to any data, resources, or content used within the Platform by the Authorized User or Customer. Customer Data may be textual, audio, or visual that Authorized Users provide, submit, upload, publish, or make otherwise available to the Services, including third-party content from Customer’s pre-approved integrations or applications.
Customer HostingLampi AI means the Services are to be installed and hosted on computing equipment of Customer or a third-party retained by Customer.

Confidential Information



refers to confidential and proprietary business information of the disclosing party which is labeled or identified to the receiving party in writing as “confidential” or which, under the circumstances of such disclosure, the receiving party knows, or reasonably should know, are treated by the disclosing party as confidential.
Documentationrefers to all material and digital documentation and user manuals related to the Platform and the Services, available at https://help.lampi.ai, or otherwise provided by Lampi AI.
Effective Daterefers to the date of the signature of the Main Services Agreement.
Feesrefers the fees payable by the Customer, as described in the Order Form.
GDPRrefers to the Regulation EU (2016/679) of the EU Parliament and the Council of 27 April 2016.

Intellectual Property Rights or IP Rights


refers to the inventions, know-how, patents, patents rights, copyrights, copyrightable works and works of authorship (including without limitation, titles, websites, databases, source and object codes, themes, graphisms, designs, interfaces, UX, GUI, images, videos, concepts, stories, catch phrases, animation, and methods of operation and any related documentation), trademarks, trade names, trade secrets and other intellectual property and proprietary rights recognized by French law, applicable foreign and international laws, treaties and conventions and in any jurisdiction worldwide.
Lampi AI refers to Lampi AI, a French simplified joint stock company, registered in the trade and companies register of Paris under number 978 788 347, with registered offices located 66, Avenue des Champs-Élysées 75008 Paris.
Lampi AI’s Privacy Policyrefers to Lampi AI’s privacy policy available.
Lampi AI Servicesrefers, collectively, to Lampi AI Software, Lampi AI Hosting, Lampi AI Support, and Lampi AI Professional Services.
Lampi AI Softwarerefers to the Lampi AI software solutions, as further described in the Product Terms and Order Form.
Lampi AI Support refers to technical support for the Lampi AI Software, as further described in the Business Services Terms and/or Order Form.
Main Services Agreement or Agreementrefers to the present agreement.

Order Form



refers to an ordering document specifying the Services to be provided hereunder that is entered into between Customer and Lampi AI. Each Order Form contains specific provisions with respect to prices, features, description of service, duration and other terms as appropriate. Order Form may serve as quotes, invoices, and/or professional services engagement agreements.
Parties refers to the Customer and Lampi AI.
Personal Informationrefers to any information relating to an identified or identifiable natural person, as defined in article 4 of the GDPR.
Platformrefers to the Lampi AI’s platform, including all its subdomains.
Professional Servicesrefers to services which may be provided by Lampi AI in addition to the Services, such as integration, training, configuration, and similar services, as further described in the Order Form.
Open-Source Modelsrefers to machine learning models that are made available under open source license or similar license or terms which govern open use of or distribution of any code or model.
Outputsrefers to data generated by a machine learning model based upon the Customer Data, that is returned to Customer or Authorized User through the Lampi AI Software.
Services Levels or SLArefers to the service levels that shall be achieved by Lampi AI for the Services (such as availability, response time, the time limits for intervention for correction of incidents and the milestones).
Specific Agreementrefers to any specific agreement between Lampi AI and the Customer.
Subscription Termrefers to the period during which Customer has agreed to subscribe to Lampi AI’s Services.
Subscription Planrefers to the applicable subscription level of packaged functionality and services (including free trial) as detailed in the Order Form.
Subscription Start Daterefers to the start date set out in the applicable Order Form.
Termsrefers ​​ the term of the Agreement, which will begin on the Order Start Date and continue until the later of (i) Subscription Term and (ii) until the Agreement or Customer’s Account is terminated.
Terms of Userefers to these terms of use available at: https://legal.lampi.ai/terms-of-use-platform
Territoryrefers to the entire world unless otherwise specified in the Order Form.
Third-Party Modelsrefers to machine learning models that are made available under proprietary license which govern use of or distribution of any code or model.
Third-Party Servicerefers to any service offered on the Platform or the Website by a third-party, including Third-Party Models.
Updatesrefers to any enhancements, improvements, and error corrections to any features or functionality in the Solution.
Upgradesrefers to any new features or functionality that Lampi AI adds to the Services.
Websiterefers to the website https://www.lampi.ai, including all its subdomains.
## 2. Purpose The purpose of this Agreement is to govern and define: (i) the terms and conditions under which Lampi AI shall provide the Lampi AI Services to the Customer; (ii) the terms and conditions under which the Customer shall pay to Lampi AI the relevant price for the Lampi AI Services. ## 3. Contractual documents The Master Services Agreement is composed of the following documents listed below. In case of any conflict or inconsistency the following order of precedence shall apply: * Order Form signed by Customer; * Where applicable, any Specific Agreement; * The present Master Services Agreement, including any potential amendments; * Data Processing Addendum; * Sub-Processors; * Security Measures; * Support Services Additional Terms; * Platform Privacy Policy; * Platform Terms of Use. ## 4. Lampi AI’s provision of services **Description of the Services**. Lampi AI provides a generative AI platform that allows Customers to execute and perform various tasks through the use of AI agents. These AI agents are able to interact with the Customer Data and can help to retrieve, compare, analyze, or extract information, automate meeting notes, generate reports or execute complete workflows. To perform these missions, AI agents can access Customer Data communicated by the Customer to Lampi AI, either through uploading or connecting to the Platform. At any time, Customers have the freedom to add or remove documents or files from the Platform, connect or disconnect an application, erase all documents and information linked to the platform, or choose the data sources they want the AI agents to access. More information about the Services are provided in the Product Terms. In case of additional services, such services are listed in a Specific Agreement. **Hosting of the Services**. The Services will either be: (a) provided with Lampi AI Hosting; or (b) installed on Customer Hosting. **Right to Use**. Subject to the terms of the Agreement, Lampi AI grants to Customer a non-exclusive, non-transferrable right during the Term to: (a) use the Services; (b) implement, configure, and through its Account Administrator, permit its Authorized Users to access and use the Services. **Subscription**. Unless otherwise specified, Lampi AI grants access to the Services pursuant to a Subscription. Customer may activate a Subscription to Services by executing an Order Form. Order Forms are governed by this Agreement. In the event of a conflict between this Agreement and an Order Form, the Order Form shall prevail. **Subscription Term.** Subscriptions will be for the Subscription Term agreed to in the applicable Order Form. Unless otherwise provided for in an Order Form, each Order Form shall automatically renew for a period equal in duration to the expiring Subscription Term unless either Party notifies the other in writing of its intent not to renew the applicable Order Form at least thirty (30) days prior to the end of the then-current Subscription Term. **Support**. Lampi AI shall provide the support services as identified in the Business Support Terms. Lampi AI shall perform the Support Services at levels of accuracy, quality, completeness, timeliness, responsiveness, and resource efficiency that are at least equal to the accepted inLampi AIry standards. **Updates**. The Service is a technology solution that will continue to be improved and that Lampi AI may perform changes and Updates from time to time. Lampi AI undertakes to make all updates freely available to the Customer. **Upgrades**. Lampi AI may enhance the Services by adding new features and functionalities. Lampi AI undertakes to inform the Customer of all Upgrades. Upgrades may be subject to new agreement between the Parties or incur additional fees. **Maintenance**. During maintenance periods, Lampi AI may upgrade versions, install error corrections and apply patches to the Lampi AI hosted systems. Lampi AI will use all reasonable endeavours to avoid unscheduled downtime to Lampi AI Software for software maintenance. **Changes to the Services**. Lampi AI may upgrade, maintain, tune, backup, amend, add or remove features, redesign, improve or otherwise modify the Lampi AI Software from time to time. Lampi AI will not do this in a way that would intentionally cause Authorised Users to lose access to Customer Data or materially decrease the functionality or security features of the Lampi AI Software. Lampi AI will notify Customer in advance of changes to the Lampi AI Software that materially reduce their functionality. If either party wishes to change the scope of the Lampi AI Services (including changing the scope of Lampi AI Professional Services, or increasing the number of Authorised Users or other usage limits, or requests for different support or hosting services): * the party requesting the change shall submit to the other party written details of the requested change; * Lampi AI shall, within a reasonable time, give to the Customer a written estimate of: the likely time required to implement the change; any variations to the Fees arising from the change; and any other impact of the change on the terms of the Agreement; and * if the parties agree to proceed with the change, they will sign a written variation (or agree an Order Form) to implement the change (and, if they don’t, neither party is bound by the change). **Security**. Lampi AI has implemented and maintains an information security program with administrative, physical, and technical safeguards designed to protect the integrity of Customer Data. Customer acknowledges that Customer Data may be processed by Lampi AI in France or in other countries in which Lampi AI or its contractors operate. **Beta** **Services**. In the case of Beta services, despite anything to the contrary in this Agreement, Customer acknowledges that (i) Customer has the sole discretion whether to use any Beta Services, (ii) Beta Services may not be supported and may be changed at any time, including in a manner that reduces functionality, (iii) Beta Services may not be available or reliable, and (iv) Lampi AI provides Beta Services “as-is” and will have no liability arising out of or in connection with Beta Services. ## 5. Customer’s use of services **Authorised Users**. Except otherwise stated within the Order Form, an Authorized User must be identified by a unique email address and user name, and two or more persons may not use the Lampi AI Software as the same Authorized User. **Customer Account Administration**. Customer must have a Customer Account to use the Services. Customer is responsible for designating Administrators for its Customer Account, maintaining updated Administrator contact information, and managing access to Administrator accounts. Administrators may provision Authorized User Accounts up to the maximum number set forth in an Order Form or Customer’s Account, and additional Authorized Users above the maximum may incur additional fees. Each Authorized User must agree to the Terms of Use to activate their account. If there is a conflict between this Agreement and the Terms of Use, this Agreement will prevail. Customer may appoint more than one Administrator and change Administrators at any time. **Customer Responsibilities**. Customer is responsible for any use of the Services through its Customer Account, including all use of the Services by Customer's Authorized Users. Customer will inform its Authorized Users of all Customer policies and practices that are relevant to Authorized Users’ use of the Services and of any settings that may impact the processing of Customer Data. Customer is responsible for maintaining the confidentiality of account credentials used by Authorized Users to access the Services, and preventing unauthorized use of the Services. Customer may not permit sharing of Authorized User accounts and passwords. **Compliance**. Customer and Authorized Users may only use the Services in accordance with, and must ensure its usage complies with, (i) applicable laws and regulations, (ii) this Agreement, (iii) the Product Terms, and (iv) our other policies. If requested, Customer will provide information necessary for Lampi AI to verify Customer’s compliance with the requirements of this Agreement. **Suspension**. Lampi AI may suspend Customer's or Authorized User's right to use the Services if (i) Customer or Authorized User's use of the Services poses a security risk, may violate the Terms of Use, or may adversely affect the Services, Lampi AI’s systems and infrastructure, or a third party, or (ii) Customer is in breach of this Agreement. Where practicable, Lampi AI will use all reasonable efforts to provide prior notice to Customer before any suspension and, where possible using commercially reasonable efforts, will endeavour to minimise the duration and disruption caused by such suspension **Restrictions**. Unless otherwise stated, Customer understands, accepts, and will not allow any Authorized User to perform the following acts: * any behavior that disrupts, suspends, slows or prevents the continuity of the Platform and Services; * any intrusion or attempted intrusion into Lampi AI's information systems or infringement of the security and authentication measures; * any attempt to create, train, develop, or improve similar or competitive products or services; * any use of the Services for benchmarking or competitive analysis of Lampi AI; * any act infringing Lampi AI's rights and financial interests, whether commercial or legal; * any copying and/or misappropriation of the Platform and more generally any misuse of the Platform; * any act of selling, reselling, licensing, renting, leasing, or distributing the Output to an unaffiliated third party (who is not a customer, partner, licensee, or end-user of Customer) or otherwise use the Outputs for the benefit of an unaffiliated third party; * any act of submitting or distributing viruses, worms, Trojan horses, corrupted files or other destructive content; * any use of robot, spider, scraper, or other unauthorized automated means to access the Services; * any act of finding security vulnerabilities to exploit the Services; and * any denial of service (DoS) attack on the Services or any other conduct that attempts to disrupt, disable, or overload the Services, such as submitting excessively frequent requests; * any infringement of Lampi AI’s intellectual property rights. **Third-Party Services.** Lampi AI may provide information about or access to Third-Party Services, or you may use Third-Party Services with the Services, but (i) Lampi AI does not endorse or make any representations or warranties about Third-Party Services, and (ii) use of Third-Party Services is at your own risk. Third-Party Services may be subject to separate license agreements or restrictions on use, which are provided in the documentation to the extent required, and you agree to comply with all such third-party restrictions. ## 6. Financial terms **Fees**. In consideration of the Services provided by Lampi AI under this Agreement, Customer will pay Lampi AI the fees and charges for its use of the Services as described in an Order Form or in Customer’s Account, as applicable. All payments are due in euros (€) unless otherwise indicated on an Order Form or an invoice. All Fees paid are non-refundable. Customer agrees to promptly update account and payment information, including email address, payment method, and payment card expiration date. Some features are provided pursuant to a usage-based model. In such a case, Customer acknowledges and agrees that should the usage permitted by its Subscription Plan be exceeded, Customer may be charged additional fees or required to purchase additional usage to continue accessing and using such feature(s); and Lampi AI may disable or degrade performance of such features. **Downgrades prohibited**. Customer may not downgrade its Subscription Plan or reduce the number of Users during any Subscription Term. If it desires to downgrade its Subscription Plan or reduce the number of Users under any Subscription Plan for a subsequent Subscription Term, it must provide Lampi AI with thirty (30) days’ written notice prior to the end of its current Subscription Term. Downgrading its Subscription Plan may cause loss of content, features, or capacity of the Service and Lampi AI is not responsible for such loss. **Invoices and payment.** All fees are due as stated in the Order Form and related invoices. In the case of non-payment or delinquent payment of any Subscription Fees, Lampi AI may, at its sole discretion: (i) suspend Customer access to the Services; (ii) terminate the applicable Order Form; or, (iii) continue to provide the Services, for a period solely determined by Lampi AI, in anticipation of full and prompt payment by Customer. **Disputes and Late Payment**s. Customer must dispute any Fees within sixty (60) days of payment due date. Past due amounts are subject to a finance charge of 1.5% per month. Customer will be responsible for all reasonable expenses (including attorneys' fees) incurred by Lampi AI in collecting past due amounts. If Customer's Fees are past due, after providing five (5) days prior notice, Lampi AI may suspend the Services. **Renewal and cancellation**. Customer agrees that at the end of each Subscription Term, its Subscription will automatically renew and its payment method for such Subscription will automatically be charged at the start of each new Subscription period for the fees and taxes applicable to that Subscription Term, under the same conditions as the prior Subscription Term unless it cancels its Subscription prior to its renewal date. Customer may cancel its Subscription plan by contacting Lampi AI customer support team at and indicating its intention to cancel its Subscription in accordance with the terms of its Subscription Plan. **Taxes**. Customer is responsible for paying all taxes assessed in connection with its Subscription. Unless otherwise stated with respect to terms and conditions for a specific Subscription, all stated prices are exclusive of any taxes and duties or other amounts, however designated, and including without value added and withholding taxes that are levied or based upon such charges, or upon the Order Form. If Lampi AI is required to pay, invoice or collect taxes associated with Customer’s purchase of, payment for, access to or use of the Lampi AI Services, Lampi AI will issue an invoice to Customer including the amount of those taxes, itemised where required by law, and Customer must pay such invoice. If applicable, Customer shall provide to Lampi AI its tax identification number on the Order Form. Customer shall use the ordered Lampi AI Services only for Customer's business use in the location(s) associated with the provided tax identification number. Should any payment for the Service be subject to withholding tax by any government, Customer will reimburse Lampi AI for such withholding tax. Lampi AI will invoice Customer for such taxes if it believes it has a legal obligation to do so. **Fee Changes**. Lampi AI, at its sole discretion and at any time, may modify the Subscription Fees for the Subscriptions. Any Subscription Fee change will become effective at the end of the current Subscription Term. Lampi AI will provide Customer with reasonable prior notice of any change in Subscription Fees. Customer’s continued use of the Service after the change in Subscription Fees constitutes its agreement to pay the modified Subscription Fees. ## 7. Warranties **Mutual warranties**. Each Party represents and warrants that (i) it has the full power and authority to enter into this Agreement and to grant the rights described hereunder, (ii) the execution and delivery of this Agreement by such Party has been duly and validly authorized; and (iii) this Agreement constitutes a valid, binding, and enforceable obligation of such Party. Both Parties ensure to the other that its Affiliates, employees, officers, representatives, agents, and subcontractors comply with this Agreement. **Customer’s specific warranties and indemnification**. In particular, and without limitation, the Customer warrants and represents that: * it will comply with any applicable law and that he will not infringe upon the IP Rights of Lampi AI nor third parties. the Customer agrees to release Lampi AI from any and all claims arising from or in direct or indirect connection to the use of Artificial Intelligence. the Customer does hereby indemnify, save, and hold harmless Lampi AI and Lampi AI’s Affiliates, officers and employees from all claims, damages, and losses (including, without limitation, attorney’s fees) arising out of or in connection with the Customer’s negligence, misconduct, violation of law, or any other breach of or default under this Agreement. The Customer acknowledges that the Services are based on Artificial Intelligence, a technology that is constantly evolving and that the responses generated might not be entirely accurate; * it has the necessary rights, licenses, and permissions to provide the Customer Data to Lampi AI; and * the use of Customer Data under this Agreement will not violate or infringe the rights of any third party. ## 8. Commitments **Lampi AI’s commitments.** Lampi AI undertakes to perform its obligations with the care normally expected from a professional in his field and to comply with the professional customs in force. Lampi AI will make its best efforts to make the Lampi AI Software available to the Customer and Authorized Users and ensure its accessibility and proper operation. Lampi AI undertakes to ensure that the Lampi AI Software is accessible 24/7, except in the event of (i) force majeure or unforeseeable and unavoidable behavior on the part of a third party or a Third-Party Service or (ii) potential breakdowns, maintenance interventions and updates required for the proper operation of the Lampi AI Software. Lampi AI can only be held to an obligation of best endeavor for the operation of the Lampi AI Software. Access to the Lampi AI Software is at the Customer's own risk, and the Lampi AI Software is provided on an "as is" and "as available" basis without warranty of any kind, either express or implied, except as otherwise provided by law. **Customer’s commitments.** Customer agrees and guarantees: * to comply with the laws and regulations in force in the country in which they are located; * to refrain from all kind of fraudulent activities; * to have obtained a legal representative authorisation and supervision and have the capacity to enter into an agreement with Lampi AI and, in accordance with the laws of the country in which Customer is located; * that they possess or have been granted permission to utilize all the Customer Data which facilitates the provision of the Services, * that the data, resources, or content used within the Platform do not infringe, misappropriate, or otherwise violate any third-party Intellectual Property Rights or breach any applicable laws, * to provide information that is truthful, accurate and free from error when interacting in and with the Lampi AI Software, to keep this information up-to-date throughout their time using the Lampi AI Software and to publish content that meets these same requirements; * to use the Lampi AI Software in accordance with its intended purpose and objective. ## 9. Liability **Disclaimer**. Customer expressly understands and agrees that access to Lampi AI Software is at the Customer's own risk, and that the Lampi AI Software are provided on an "as is" and "as available" basis without warranty of any kind, either express or implied, except as otherwise provided by law. To the fullest extent permitted by law, Lampi AI does not represent or warrant that: (i) access to or use of the Lampi AI Software will be uninterrupted, timely, secure or error-free; (ii) Outputs will always be accurate, and (iii) the Services are free of malware or other harmful components. **Artificial Intelligence**. Customer acknowledges that the Services are based on Artificial Intelligence, a technology that is constantly evolving and that the responses generated might not be entirely accurate. Results and outcomes generated by machine learning algorithms and artificial intelligence are probabilistic and Customer should evaluate such results and outcomes for accuracy as appropriate for Customer’s use case, including by employing human review. Customer is solely responsible, and Lampi AI will have no liability, for all decisions made, advice given, actions taken, and failures to take action based on Customer’s use of the Lampi AI Software or Output. **Limitation on Lampi AI’s indirect liability**. Lampi AI will not be held liable for any other damages and losses suffered by the Customer, in particular indirect damages (including but not limited to, earning or profit losses, commercial damages, the consequences of complaints, actions, claims of third parties against the User) even where Lampi AI has been informed of their occurrence. In particular, unless otherwise provided by law or regulation, Lampi AI shall not be held liable for: * breakdowns or malfunctions of the Lampi AI Software lasting less than 24 hours or that are not the responsibility of Lampi AI; * loss of data due to misuse of the Lampi AI Software; * an unusual or illegal use of the Services offered by a third party or by an Authorized User; * harmful or unintended consequences of the operation of Third-Party Services; * indirect damage resulting from the use of the Services or the Platform; * a malfunction or cyberattack; * the harmful consequences of the suspension of an Account; * any case of force majeure, within the meaning of Article 1218 of the French civil code. Customers understand and acknowledge that they bear responsibility for the Customer Data. Customers assume full liability for such content, including its legality, reliability, accuracy, and appropriateness. Lampi AI does not endorse or take responsibility for any Customer Data, and to avoid ambiguity, Lampi AI explicitly disclaims any liability associated therewith. **Lampi AI’s Liability cap**. To the fullest extent permitted by law, Lampi AI’s and its Affiliates’, licensors’, and suppliers’ aggregate liability under this Agreement under any contract, negligence, strict liability, indemnity, or other legal or equitable theory will not exceed the amount Customer has paid or that is payable for the Services in the six (6) month period prior to the event giving rise to the liability. **Customer’s liability**. Customer guarantees Lampi AI against any complaints, claims, actions and/or demands that Lampi AI may suffer as a result of the Customer’s or Authorized User’s breach of any of his/her obligations under the Agreement. The Customer undertakes to indemnify Lampi AI for any damage suffered as a result of such a breach. **Contribution**. Each party’s liability shall be reduced proportionately to the extent that the other party’s acts or omissions causes or contributes to, directly or indirectly, the loss or damage for which the first party is liable. ## 10. Duration, suspension and termination **Duration**. This Master Services Agreement shall begin on the Subscription Start Date and shall continue for so long as Customer maintains an active Subscription to the Services or for the Subscription Term as laid out in the Order Form or until this Agreement is otherwise terminated in accordance with the terms herein. **Suspension**. If Customer or an Authorized User breaches the Agreement or Terms of Use, Lampi AI may temporarily and without prior notice suspend access to the Platform and the Services. After an investigation period during which Lampi AI shall verify the truth of the alleged violations, access to the Platform and/or to the Services may be restored or the Agreement may be terminated in accordance with the terms below. **Termination for convenience**. The Agreement may be terminated by each Party at any time by giving (30) day’s prior written notice. The Parties agree that the date of notification of the termination shall be the date on which the terminating Party sends the notification. **Termination for breach**. Each Party can terminate this Agreement upon material failure of the other Party to comply with its obligations that remain uncured within fifteen (15) days of receiving written notice of the breach from the non-breaching Party. The Parties acknowledge that the following breaches shall be deemed as material: * any violation, by the Customer, of the terms of the sections entitled “Financial terms”, “Confidentiality”, “Intellectual Property” and “Warranties”; * any repeated violations of the specific terms of Services, and in particular the repeated non-payment or repeated delays in the payment of the Services to Lampi AI. **Other termination cases.** A Party shall be entitled to terminate all or part of this Agreement at any time, on giving thirty (30) day’s notice if the other Party (i) becomes insolvent; (ii) fails to pay its debts or fulfill its obligation in the ordinary course of business as they mature; (iii) admits in writing its liability to pay its debts as they mature; (iv) harms the reputation of the other Party in any way; or (v) becomes the subject of any voluntary or involuntary proceeding in bankruptcy, liquidation, dissolution, receivership, attachment or general assignment for the benefit of creditors that is not dismissed with prejudice within thirty (30) day after the institution of such proceeding. **Effect of Termination**. If this Agreement expires or is terminated, then (i) any fees payable under an Order Form or for Services rendered will become immediately due to be paid, (ii) the rights granted by one party to the other will cease immediately except the provisions contained in sections entitled “Intellectual Property Rights”, “Warranties”, and “Confidentiality”, which shall survive the termination and/or expiration of this Agreement. ## 11. Intellectual property **Customer’s Intellectual property.** Lampi AI Software may invite Customer and Authorized Users to chat or discuss and may provide them with the opportunity to create content and materials, including but not limited to text, writings, video, audio, photographs, graphics, comments, suggestions, or personal information or other material. Such content is only viewable and accessible by the Authorized User in his/her own digital interface, except in the case of: * shared spaces, where all users of the shared space can view and access the shared content; * meeting spaces; where all invited users can view and access the content. As such, any content created by an Authorized User is treated as confidential. Customer remains the sole owner of the documents and data used and collected in the operation of the Lampi AI Software and any content generated within the platform. Customer owns the Output. Except for the rights expressly granted in this Agreement, this Agreement does not grant any rights, and Customer owns and reserves all right, title, and interest in and to the Customer Data and Output. Lampi AI will not access, view or listen to any Customer Data without the Customer’s prior written consent. Such consent shall be considered given if Lampi AI deems it necessary to access a Customer Data to: * fulfill a support service request as requested by the Customer or as set out in the Service Level Agreement or Business Support Terms; and * restore relevant Content at the Customer’s request in the event of a service interruption. Any information obtained by Lampi AI while accessing a Customer Data shall be kept confidential by Lampi AI unless otherwise agreed with the Customer. Lampi AI will not use Customer Data or Outputs to improve machine learning models unless otherwise agreed with the Customer. **Lampi AI’s Intellectual property.** Unless otherwise stated, all rights not expressly granted to Customer are reserved by Lampi AI. The Platform and all its functionalities are Lampi AI's sole intellectual property and are protected by all intellectual property rights in force. Any use, reproduction or representation in any form of the Platform, the Services or any of Lampi AI’s content, such as source code, databases, functionality, software, website designs, audio, video, text, photographs, or graphics on the Website or the Platform, without express written permission is strictly prohibited. **Lampi AI Data.** Lampi AI may collect and create usage data and statistics derived from Customer's use of the Services. Lampi AI may use them to provide, analyze, support, and improve Lampi AI’s products and services, and create and distribute reports and materials about Lampi AI’s products and services. Lampi AI will not identify Customer as a source of information for any report or material described in this section without Customer's prior written approval. **Suggestions.** Customer may submit to Lampi AI feedback, comments, ideas, or suggestions regarding Lampi AI’s Services or new products and services. Lampi AI may, but has no obligation to, in its discretion and for any purpose, (i) use, modify, and incorporate into Lampi AI’s products and services and (ii) license, sublicense, or distribute the suggestions without obligation or compensation to Customer. **Copyright Policy**. Lampi AI respects the Intellectual Property Rights of third parties and responds to notices of alleged copyright infringement if they comply with the law. Lampi AI reserves the right to delete Customer Data alleged to be infringing from Customer’s Account and terminate Authorized Users or Customers that willfully or repeatedly infringe third-party rights. ## 12. Confidentiality **Confidential information.** Customer understands that “Confidential Information” means information and physical material not generally known or available outside the Customer’s information systems and information and physical material entrusted to the Customer in confidence by third parties, and regardless of whether it is marked or not as confidential. Confidential Information includes, without limitation: (i) Lampi AI’s inventions; and (ii) technical or business information disclosed to the Customer by Lampi AI either directly or indirectly, whether in writing, electronically, orally, or by observation before or after the date of this Agreement. For the purpose of the Agreement, Confidential Information shall, in particular, include: (i) “**Intellectual Property**” which refers to, including but not limited to, Lampi AI’s intellectual property of any kind, property technologies, information relating to Lampi AI’s proprietary rights, production and technical data, technical concepts, status and details of research and development of product, processes and services, and information regarding acquiring, protecting and enforcing licensing and proprietary rights; and (ii) “**Processes and know-how**” which includes processes used in relation to the Services, including but not limited to the instructions, guidelines and in particular briefings communicated to the Customer. **Non-disclosure**. At all times during the term of the Agreement and thereafter, the Customer shall hold in the strictest confidence and shall not use (except to the extent necessary in the course of providing the Services) or disclose the Confidential Information. Confidential Information shall remain the exclusive property of the Customer and shall only be used for proper performance of the Services. The Partner will not use the Confidential Information for any purpose that might be directly or indirectly detrimental to Lampi AI or any of its Affiliates or subsidiaries. **Duration**. The obligations to ensure and prevent the disclosure of the Confidential Information imposed on the Customer and any obligations to provide notice under this Agreement will survive the expiration or termination, as the case may be, of this Agreement and shall continue during and after the end or termination of this Agreement up until such time as such Confidential Information has become public knowledge other than as a result of the Customer’s breach of this Agreement or breach by those acting in concert with Lampi AI or on Lampi AI’s behalf. **Ownership and title.** Customer acknowledges and agrees that all rights, titles, and interests in and to any Confidential Information will remain the exclusive property of Lampi AI. **Exception**. In the event that the Customer is required in a civil, criminal or regulatory proceeding to disclose any or part of the Confidential Information, the Customer will notify Lampi AI promptly of such request, if not prevented by applicable laws and regulations. If the Customer loses or makes unauthorized disclosure of the Confidential Information, the Customer will immediately notify Lampi AI and take all reasonable steps necessary to retrieve the lost or improperly disclosed Confidential Information. ## 13. Personal Information **Data Processing Addendum (DPA).** Unless specified otherwise in an Order Form, this Agreement incorporates DPA when a data protection law applies to Customer use of the Services to process Personal Information. **Lampi AI’s Privacy Policy and DPA**. Unless otherwise specified, any Personal Information processing is governed by the DPA. In the event of a conflict between DPA and Platform Privacy Policy, DPA shall prevail. **Transfer of Personal Information to Third-Party Service Providers**. The Lampi AI platform makes Third-Party Provider Services available, such as Third-Party Model Provider services. If you decide to enable, access or use Third-Party Provider Services, you authorize Lampi AI to transfer Customer Data, including Personal Information, to the Third-Party Provider in accordance with its functionality and pursuant to DPA as explained in section 14. **Personal Information**. Personal Information might be sent to Lampi AI by the Customer or Authorized User. By default, if any Personal Information is transmitted to Lampi AI through the Services, Lampi AI is not aware of the existence and nature of such Personal Information and Customer is solely responsible for ensuring that the processing of Personal Information, uploaded to Lampi AI’s Services by the Customer or the Authorized User, complies with the agreed DPA and applicable Data Protection Laws. ## 14. Data Storage By default, Customer Data is stored in France or European Union. Where supported by our underlying cloud service provider(s) and where otherwise in compliance with applicable laws and regulations, Customer may request to have Customer Data stored outside of the European Union, and Lampi AI will use commercially reasonable efforts to support such requests. ## 15. Miscellaneous **Customer Marketing.** Lampi AI may use Customer’s name, logo, and marks to (i) identify Customer as a Lampi AI Customer on its Website, (ii) produce and publish a case study on its Website regarding the Customer’s use of the Services, and (iii) create marketing materials such as press releases, advertisements, brochures, and other marketing materials, without the prior written consent of the Customer. The Provider agrees not to harm the image of Customer in particular by communicating information that could harm its image and/or reputation. **Waiver**. Failure by either Party to insist upon the strict performance of any of the terms and conditions of this Agreement shall not be construed as a waiver of such, and shall in no way affect the Party’s right to enforce such provision. **Nullity**. If any provision of the Agreement is annulled by a modification of legislation, regulation or by a court decision, the rest of the Terms will not be affected. **Assignment**. Either party may assign this Agreement in its entirety, without the other party's consent, to its Affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets, and Customer must provide Lampi AI with prompt notice following such event. Any other attempt to transfer or assign is void. This Agreement will be binding upon and inure to the benefit of the parties and their respective, permitted successors and assigns. **Entire Agreement.** Unless explicitly stated in a separate agreement between the Parties, this Agreement, including all mentioned agreements and Order Forms, constitutes the entire agreement between Customer and Lampi AI with respect to the subject matter of this Agreement and supersedes any prior or contemporaneous agreements whether written or oral, including any non-disclosure agreements. Except as otherwise set forth in this Agreement, no modification, amendment, or waiver of any provision of this Agreement will be effective unless set forth in writing and signed by the parties. If there is a conflict between the documents that make up this Agreement, the documents will control in the following order: Order Form, the Agreement, Product Terms, and the Documentation. **Notices**. Any notice, request, consent, claim, demand, waiver, or other communication under the Agreement shall have legal effect only if in writing and addressed to a party as specified in the Order Form (or to such other address or such other person that such addressee party may designate from time to time in accordance with this clause). Notices sent in accordance with this clause will be deemed effectively given: (a) when received, if delivered by hand, with signed confirmation of receipt; (b) when received, if sent by a nationally recognized overnight courier, signature required; and (c) when sent, if by email, if sent during the addressee's normal business hours, and on the next Business Day, if sent after the addressee's normal business hours. **Relationship of the Parties**. This Agreement is concluded with the express understanding that the Parties are independent from each other, and each of them is supporting the risks of its own business. **Cooperation**. Parties acknowledge and agree that the performance of this Agreement requires close and active cooperation between them and communication on a regular basis. The Parties agree to collaborate in good faith during the completion of the Agreement. In case of any difficulty arising from the execution of this Agreement, each Party shall inform the other within a reasonable time and Parties shall discuss together to resolve it. **Disputes and Informal Resolution.** Lampi AI wants to address Customer's concerns and requests that Customer bring issues that may lead to a dispute to our attention immediately. Before filing a claim, Lampi AI and Customer agree to try to resolve the dispute by providing notice to the other party and having the appropriate executives attempt to resolve the dispute through communication and discussion. After fifteen (15) business days from providing notice, either party may bring a formal proceeding. **Governing Law and Jurisdiction.** The Agreement is governed by and interpreted according to French laws, except French conflict-of-law rules. Unless otherwise provided by the law, any conflict or dispute related to the validity, the interpretation, performance, and/or termination of the Agreement must be submitted to the exclusive jurisdiction of the Paris courts. # Data Processing Addendum This Data Processing Addendum ("**DPA**"), forms part of, and is subject to, the Master Services Agreement or other written or electronic terms of service or subscription agreement between Lampi AI and Customer that reference this DPA (the “**Agreement**”), and is effective on the Effective Date of the Agreement. If the Parties agree that an Affiliate that is listed in the Order Form, should be eligible to use the Services, Customer confirms that it is authorized to enter into relevant data processing agreements with Lampi AI on such Affiliates' behalf. If any deviations are necessary due to mandatory legal requirements applicable to an Affiliate, Customer undertakes to ensure that such issues are raised in advance (prior to any processing on behalf of such Affiliate takes place) in writing to Lampi AI. This DPA applies where, and to the extent that, Lampi AI (i) processes or collects Customer or Authorized User Personal Information on behalf of Customer when providing Services under the Agreement or (ii) have access to the Customer’s employees and/or customers’ Personal Information. Consequently, Lampi AI must comply with all applicable Data Applicable Laws and implement the necessary measures to ensure security and confidentiality of the related Personal Information, as described in this DPA. ## 1. Definitions Capitalised terms used herein shall have the respective meanings specified below in this Article 1.
Data Applicable Law refers to all laws and regulations applicable to the processing set forth herein, and, in any case, the GDPR.
Data Controllerrefers to an entity that determines the purposes and means of the processing of Personal Information.
Data Processorrefers to an entity that processes Personal Information on behalf of a Data Controller.
DPArefers to the present agreement, all its amendments and related appendices.
Sub-Processorrefers to a third party data processor engaged by Data Processor who has or will have access to or process Personal Information from Data Controller.
This DPA applies where, and to the extent that, Lampi AI processes Personal Information on behalf of Customer (or Authorized Users) when providing Services under the Agreement. All capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement. All definitions in section 4 of the GDPR shall apply to the present DPA including but not limited to: processor, Personal Information, data subjects, profiling, pseudonymisation, consent, Personal Information breach, international organization. ## 2. Purpose The purpose of this DPA is to define the terms and conditions under which Lampi AI undertakes to perform, on behalf of the Customer, the processing set forth herein. In the event of any conflict or inconsistency between the provisions of the Agreement and this DPA, the provisions of this DPA shall control and govern. ## 3. Processing by Lampi AI As part of delivering the Services under the Agreement, Lampi AI has access to the Personal Information processed by the Customer under its responsibility. The legal basis for this processing is the provision of the Service by Lampi AI. In the relationship between Lampi AI and the Customer, the Customer is the Data Controller of Personal Information. Lampi AI will process Personal Information solely as a Data Processor acting on behalf of the Customer. The Customer agrees that (i) it will fulfill its obligations as a Data Controller under Data Applicable Laws concerning its processing of Personal Information and any processing instructions it issues to Lampi AI and (ii) it will ensure that the processing is lawful, enabling Lampi AI to process Personal Information according to the Agreement and this DPA. The Customer is responsible for providing information (in accordance with Data Applicable Laws requirements) to data subjects when collecting their Personal Information. Details of data processing are set forth in [Appendix 1](#appendix-1-specification-of-data-processing). The Customer agrees not to provide Lampi AI, the Data Processor, with any data concerning a natural person’s health, religion, or any special categories of data as defined in Article 9 of the GDPR. ## 4. Transfer of Personal Information outside of the European Union or to international organizations Customer hereby consents to processing of the Personal Information in the countries where Sub-Processors maintain data processing operations, as indicated in [Appendix 2](#appendix-2-list-of-sub-processors), as necessary to help ensure the proper functioning of and improvement to the services. **Data storage**. Lampi AI will only ever store Personal Information (and Customer Data) on servers located within the European Union. **Data access**. Lampi AI may transfer Personal Information outside of the European Union or to international organizations solely for the purposes of our Sub-Processors accessing Personal Information in order to provide the Services. **Customer acknowledges that such transfer of Personal Information is limited to the case where the Customer or Authorized User uses on its own a Third-Party Model provided by a Third-Party Services provider located outside the European Union.** In the event Lampi AI is required by Data Applicable Law to transfer Personal Information to a country outside the European Union or an international organization, Lampi AI must notify the Customer immediately, and in any case before complying with the transfer obligation, unless Data Applicable Law prohibits such notification on important grounds of public interest. Where relevant, Lampi AI is bound with Sub-Processors by the “standard contractual clauses for the transfer of Personal Data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council” or equivalent legal mechanisms (such as those defined in chapter V of the GDPR, US-EU Privacy Shield, etc.). In case of any conflict between the standard contractual clauses or equivalent mechanism and this DPA, the standard clauses or equivalent mechanism will control. ## 5. Designation of Sub-Processors **List of Sub-Processors**. Lampi AI engages Sub-Processors to carry out all or parts of the processing. The list of its existing Sub-processors is accessible in [Appendix 2](#appendix-2-list-of-sub-processors). Lampi AI entered into a written agreement with all Sub-processor. **New Sub-Processors.** Lampi AI must notify with reasonable prior notice the Customer prior to the addition or replacement of any Sub-processors. Such subcontracting may only be performed if the Customer has not objected within fifteen (15) days from the date of receipt of the notification, provided that such objection is based on reasonable grounds relating to data protection. Such an objection may be sent by email to the Lampi AI at: . ## 6. Data subjects' rights Lampi AI must assist the Customer in fulfilling its obligations to respond to data subjects’ requests regarding the exercise of their rights, including without limitation right of access, rectification, erasure and opposition, right to restriction of processing, right to portability, right not to be the subject of an automated individual decision-making (including without limitation profiling). When data subjects send requests regarding their rights to Lampi AI, it must notify the Customer by forwarding the requests within five (5) business days upon receipt. Lampi AI must not respond to data subject requests without the Customer's prior approval. ## 7. Record of processing activities Lampi AI agrees to maintain a written record of all categories of processing activities performed on behalf of the Customer, including: * The name and contact details of (i) the Customer entity on whose behalf Lampi AI acts, (ii) any Sub-processors and, where applicable, (iii) the data protection officer; * The categories of processing activities carried out on behalf of the Customer; * A general description of technical and organizational security measures. ## 8. Security measures and audit Lampi AI has implemented security measures described in Appendix 3 and must, upon the Customer's request, demonstrate its compliance therewith. The Customer in its sole discretion, may itself, or through a third party, conduct an audit of Lampi AI’s data security measures, no more than once every twelve (12) months, and Lampi AI must collaborate with such audits. If such review reveals any material vulnerabilities, Lampi AI must fix such vulnerabilities without undue delay, at its own expense. The Customer, at its election, may block Lampi AI’s receipt of or access to Personal Information until Lampi AI’s data security vulnerabilities have been resolved to the Customer’s satisfaction. In the event of a Personal Information breach, Lampi AI will also permit the Customer to conduct an exceptional supplementary audit in order to ensure that the proper security requirements and remedies have been put in place. Lampi AI acknowledges that security requirements are constantly changing and that effective security requires frequent evaluation and regular improvements of outdated security measures. Lampi AI will therefore evaluate the measures as implemented in accordance with this present section and Schedule 1 on an on-going basis in order to maintain compliance with the requirements set out therein. ## 9. Personal Information breach notification Lampi AI must notify the Customer of any Personal Information breach within twenty four (24) hours of becoming aware of it. This notification must be accompanied by all relevant documentation in order to enable the Customer, if necessary, to notify that breach to the competent supervisory authority and the data subjects if need be. The documentation must include the following without limitation: * A description of the nature of the breach, including where possible the categories and approximate number of data subjects concerned and the categories and approximate number of Personal Information records concerned. * The name, phone number and email address of Lampi AI's contact point. * A description of the likely consequences of the breach. * A description of the measures taken or proposed to be taken by Lampi AI to address the breach including, where appropriate, measures to mitigate its possible adverse effects. ## 10. Personal Information output Upon fulfillment of the processing for the purposes agreed, termination of the Agreement, and/or the DPA, and/or upon written request by the Customer, Lampi AI shall, at the discretion of the Customer either delete or return all the Personal Information to the Customer and delete existing copies and backups. Lampi AI agrees to follow the Customer’s instructions within sixty (60) days of receipt. In the event the Customer does not provide any instructions within thirty (30) days from the reception of Lampi AI's notification, Lampi AI must return all Personal Information to the Customer and delete all existing copies and backups. ## 11. Assistance and documentation In addition to its assistance obligation as set forth in section 7, Lampi AI must assist the Customer in ensuring compliance with obligations pursuant to security, and Personal Information breach notifications to a supervisory authority and/or to data subjects. Lampi AI must provide to the Customer all information necessary to demonstrate compliance with all its obligations. Lampi AI agrees to assist the Customer in completing data protection impact assessments as required by Data Applicable Law. ## 12. Terms The provisions of this DPA shall apply as long as Lampi AI processes Personal Information for which the Customer is Data Controller. ## 13. Miscellaneous **Notification**. Any written notification, contact or notice under this DPA must be sent to the following email address: . **Liability**. For the avoidance of doubt, any claim or remedies the Customer may have against Lampi AI, any of its Affiliates and their respective employees, agents and Sub-Processors arising under or in connection with this DPA, including: (i) for breach of this DPA; (ii) as a result of fines (administrative, regulatory or otherwise) imposed upon Customer; and (iii) under Data Applicable Law will be subject to any limitation of liability provisions that apply under the Agreement. **Force majeure**. No Party shall be liable for failure to fulfill any obligation under this DPA which is prevented or delayed by an event of force majeure, as defined by the French civil code and case law. The Party claiming the benefit of this provision shall, as soon as reasonably possible after the occurrence of such event: (i) notify the other Party of the nature and extent of any such force majeure condition and (ii) use all possible means to resume performance under this DPA as soon as possible. If a Party’s performance is affected by force majeure for a period of more than twenty (20) calendar days, then the other Party may terminate this DPA by giving written notice to the other Party, without incurring any cost or liability. **Waiver**. Failure by either Party to insist upon the strict performance of the terms and conditions of this DPA shall not be construed as a waiver of such, and shall in no way affect the Party’s right to enforce such provision. **Severability**. If any provision of this DPA shall be held invalid or unenforceable by any court of competent authority, this DPA shall continue to be valid as to the other provisions thereof and the remainder of the affected provision. **Governing law**. The laws of France shall govern this DPA. Each of the Parties irrevocably submits to the exclusive jurisdiction of the competent courts within the jurisdiction of the Paris Court of Appeal (France) for any suit, action, proceeding or judgment relating to or arising out of the DPA and the transactions contemplated hereby. *** ## Appendix 1 - Specification of data processing Categories of Personal Information. * **User**: first and last name, email address, access level and system role, and other attributes that are provided when using the Services. Such personal data might also be collected from third-party systems per the Customer or Authorized User’s instruction. * **Customer** **Data**, * **Usage** (Support purposes): Data about activity on and use of our Services, * **Device and Internet data** (Support purposes): IP address, browser language, browser type, operating system, city and country, device type. Internet data * **Other Information for Support Services**: Details such as the content of communications with Lampi AI, including interactions with customer support and contacts through social media channels. The transfer of any special categories of data as defined in Article 9 of the GDPR, such as health data, genetic, biometric, data revealing racial and ethnic origin, political opinions, religious or ideological convictions, trade union affiliation, or sexual orientation, criminal convictions or offenses, by the Data Controller is strictly prohibited. **Categories of data subjects**. Lampi AI will process Personal Data regarding the Subscriber’s end-users of the Services, which includes the following categories of data subjects: * Customer’s employees, clients, customers, authorized users, contractors, consultants, advisors. **Processing operations**. Lampi AI will collect, store, organize, and process, delete, analyze and host the Personal Information for the purpose indicated above, as included in the Agreement and in accordance with instructions of the Customer. **Location of processing operations.** France and as specified in the Sub-Processors Notice mentioned in [Appendix 2.](#appendix-2-list-of-sub-processors) *** ## Appendix 2 - List of Sub-Processors Lampi AI engages Sub-Processors to carry out all or parts of the processing. The list of its existing Sub-processors is available in the [Sub-Processors Notice](/sub-processors-notice). *** ## Appendix 3 - Security Measures The list of Security Measures is available in the [Security Measures Notice](/security-measures-notice).
# Sub-Processors Notice This Sub-Processors Notice details the current sub-processors that Lampi AI has authorized to handle customer personal data as part of Lampi AI's services, in accordance with Lampi AI's Data Processing Addendum (DPA). ## 1. Infrastructure providers | Sub-processor | Processing activities | Location of data processing | DPA | | --------------- | --------------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------ | | Microsoft Azure | Data hosting | Paris, France, Europe | [Link](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) | ## 2. LLM Providers | Open-source models vs LLM Providers | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

At Lampi, our primary focus is to ensure security and privacy by design when providing AI-related services to Customers. To maintain robust control over data flows, Lampi AI offers to use:

  • open-source models (on-demand)
  • LLM providers.

Open-source models can run on our infrastructure hosted by infrastructure providers located in Europe, allowing us to maintain complete control over data processing activities. This means that Customer Data remains within Lampi's secure environment.

All LLM Providers available on the Platform apply a Zero Data Retention policy.

Customers have the flexibility to select any available large language model when interacting with AI agents. When Customers opt for Third-Party Models from a Third-Party Services provider, some data will flow to the Third-Party to process your request.

| | Sub-processor | Processing activities | Location of data processing | DPA | | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | | Microsoft Azure Foundry (OpenAI) | Data processing and generation - Microsoft applies a Zero Data Retention Policy on all data, and does not use it for training purposes. | EU / US (depending on model selection) | [Link](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) | | Google, Inc. | Data processing and generation - Google applies a Zero Data Retention Policy on all data, and does not use it for training purposes. | EU | [Link](https://ai.google.dev/gemini-api/terms?hl=fr) | ## 3. Other service providers | Sub-processor | Processing activities | Location of data processing | DPA | | ------------- | --------------------------------------- | --------------------------- | -------------------------------------------------------------------------------------- | | Hubspot | Internal client management (CRM) | USA | [Link](https://legal.hubspot.com/dpa) | | Stripe | Payment processor for specific features | Paris, France, Europe | [Link](https://stripe.com/fr/legal/dpa) | | Docusign Inc. | Contract Management | USA | [Link](https://www.docusign.com/legal/terms-and-conditions/data-protection-attachment) | # Security Measures Notice | At Lampi AI, security and privacy by design are core principles in the delivery of our AI-related services. We take seriously our responsibility to protect the software, systems, infrastructure, and data that support the Services, and we maintain technical and organizational measures intended to preserve the confidentiality, integrity, and availability of Customer Data and Personal Information. | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | This Security Measures Notice forms part of, and is subject to, the Master Services Agreement, Data Processing Addendum, subscription agreement, or other written or electronic terms between Lampi AI and the Customer that reference this notice (the “**Agreement**”). It is effective as of the effective date of the Agreement, unless otherwise agreed by the Parties. This notice describes the main security measures and controls implemented by Lampi AI to protect Customer Data and Personal Information in connection with the Services. It is intended to provide a clear and trust-building overview and does not disclose confidential implementation details, internal configurations, or security-sensitive operational procedures. Additional information regarding Lampi AI’s security measures may be made available upon request and subject to appropriate confidentiality, security, and contractual safeguards. Lampi AI may update these technical and organizational measures from time to time, including to reflect changes in technology, regulatory expectations, service architecture, or security practices, provided that such updates do not materially reduce or weaken the overall level of protection for Personal Information processed by Lampi AI in providing the Services. Customer acknowledges that it is responsible for reviewing the information made available by Lampi AI, including this notice, and determining whether the Services and related security measures meet Customer’s business requirements, internal policies, and legal obligations under applicable laws. Capitalized terms not defined in this Security Measures Notice have the meanings given to them in the Agreement or the Data Processing Addendum. ### 1. Technical measures **Data hosting and infrastructure.** Except as otherwise agreed by the Parties, Lampi AI hosts its production platform primarily on Microsoft Azure, with core workloads deployed as containerized services on Azure Kubernetes Service (AKS) in the European Union, including France as the default production hosting location where applicable. The platform uses Azure-native storage, networking, compute, and security capabilities to support resilient and controlled operation of the Services. **Architecture overview.** Lampi AI’s platform is designed as a set of separated application services and microservices, including frontend services, backend APIs, AI processing services, inference components, document ingestion and retrieval workflows, integration bridge components, GPU-related workloads, and orchestration, autoscaling, and scheduling layers. This separation supports controlled deployment, scalability, monitoring, and isolation of responsibilities across the platform. **Private-by-default infrastructure.** Lampi AI applies a private-by-default service exposure model for internal platform components. Databases, search engines, cache and state services, internal processing services, logging components, and storage backends are not designed to be directly exposed to the public internet. Production services are exposed only through designated and controlled entry points. **Data storage and processing.** Lampi AI separates data storage and processing components by function, including document and object storage, relational data storage, vector and full-text search, cache or state storage, AI workflow state, logs, and generated artifacts. Full-text and vector-enabled search capabilities are supported through Elasticsearch, while uploaded and generated files are stored through S3-compatible object storage, such as MinIO, hosted within the Azure environment where applicable. **Network segmentation**. Lampi AI uses AKS networking, Kubernetes service boundaries, internal service discovery, and controlled ingress routes to segment production workloads. External HTTP(S) traffic is routed through designated ingress components, such as NGINX HTTPS ingress where applicable, while internal services communicate through private cluster networking and are subject to service-level access controls. **Administrative access points.** Administrative and monitoring interfaces are restricted to authorized personnel and protected through authentication and network controls such as VPN, IP allowlisting, or equivalent access restrictions where applicable. Direct public access to production databases, internal object storage, caches, search services, and internal processing components is not permitted. **Encryption in transit.** Lampi AI protects communications in transit using HTTPS/TLS, with TLS 1.3 used where supported by the relevant component, provider, or integration. External access to files or objects is handled through controlled mechanisms such as time-limited presigned URLs where applicable, rather than direct public access to storage backends. **Encryption at rest.** Customer Data and Personal Information are protected at rest using AES-256 or cloud-provider managed encryption mechanisms, including for databases, object storage, managed disks, managed file storage, and backup storage where applicable. Encryption controls may be implemented through the application, infrastructure, database, or cloud provider layer depending on the data class and service component. **Secrets and key management.** Lampi AI restricts access to secrets, credentials, and cryptographic material using role-based access, least-privilege permissions, infrastructure secret stores, and Kubernetes secrets or equivalent mechanisms where applicable. Administrative access to sensitive systems requires appropriate authorization and multi-factor authentication. Application keys and service credentials are reviewed and rotated periodically according to operational requirements and risk. **Authentication methods.** Lampi AI supports authentication methods such as email and password where enabled, signed-link password recovery, Azure AD / Microsoft Entra ID single sign-on using OAuth2 or OpenID Connect, and Google OAuth where configured. Passwords are not sent in plain text, and password-based authentication uses secure password hashing mechanisms such as bcrypt. **Multi-factor authentication**. Lampi AI requires or enforces multi-factor authentication for sensitive administrative and infrastructure access where applicable. The platform includes protections against brute-force attacks, including account lockout or blocking mechanisms after repeated failed authentication attempts, as configured for the relevant account type or service. **Role-based access control.** Lampi AI implements role-based access control to restrict access to features, data, administrative functions, and operational capabilities according to assigned roles and permissions. Access rights are designed according to the principle of least privilege and are enforced through backend authorization checks, with user interface controls used as an additional layer where applicable. **Customer role-based access.** To limit access based on the principle of least privileged access and help prevent conflicts of interest, Customer administrators can manage users, roles, and permissions within the Services. This may include restricting access to features, workspaces, data sources, administrative capabilities, integrations, and available large language models based on users’ responsibilities, seniority, or business need. **Tenant isolation.** Lampi AI enforces tenant isolation through organization-scoped authorization, path and object segregation, API-level validation, and membership and permission checks on relevant requests. Client access to object storage is mediated through controlled application flows and time-limited links where applicable. **API and service access**. API access and service-to-service communication are protected through authentication, authorization, and least-privilege service credentials where applicable. Internal APIs and backend services are not intended to be publicly reachable except through approved ingress, gateway, or application routes. **Upload and file controls**. Lampi AI applies security controls to uploaded content, including file-type validation and malware scanning or equivalent protective mechanisms where applicable. These controls are intended to reduce the risk of malicious files, unsupported formats, and unsafe processing behavior within document ingestion and AI workflows. **Logging and monitoring**. Lampi AI uses monitoring, tracing, and logging tools. Logs and telemetry may include application logs, infrastructure events, Kubernetes events, access and authentication events, configuration activity, administrative actions, operational metrics, AI workflow traces, and data-operation audit events, subject to configured retention and the Agreement. **Log protection**. Logs are stored in internal logging and monitoring systems and are not directly exposed to the public internet. Access to logs is restricted to authorized personnel through role-based permissions, authentication, and infrastructure access controls. Log retention periods may vary by log type, service component, operational need, and contractual commitment. **Vulnerability and patch management**. Lampi AI performs vulnerability scanning, dependency monitoring, container image scanning, and package monitoring across its infrastructure-related hosts, codebase, and product components. Identified issues are triaged and remediated according to severity, exploitability, affected component, and operational risk. **Patch deployment and verification**. Lampi AI manages patches through controlled release and deployment processes, including version-controlled changes, container rebuilds where applicable, CI/CD testing, and post-deployment monitoring. Emergency or critical security patches may be expedited, subject to appropriate validation and rollback procedures. **Secure development.** Lampi AI follows a secure development lifecycle. Secure coding practices are aligned with widely recognized principles such as the OWASP Top 10 and are adapted to the specific risks of AI-enabled applications. **Testing and non-production environments**. Lampi AI maintains development, staging, and test environments that are separated from production through distinct configurations, deployment stacks, access controls, domains or endpoints, and CI/CD execution paths where applicable. Real Customer Data is not intended to be used in test environments; public, synthetic, anonymized, or otherwise approved data is used for testing where appropriate. **Backup and resilience**. Lampi AI performs scheduled backups of relevant production components, such as databases, search systems, object storage, cache or state components, and tracing or observability systems, according to the applicable service configuration. Backups are stored in Azure-hosted storage within the European Union perimeter where applicable and are protected in transit and at rest using cloud-provider encryption and secure transfer mechanisms. **Restore testing and disaster recovery**. Lampi AI maintains backup restoration and disaster recovery procedures covering data stores, application configuration, and operational recovery steps. Restore testing is performed at least annually or as otherwise required by the Agreement, and disaster recovery procedures include escalation, technical recovery actions, role assignment, and customer communication where applicable. **Physical security**. Lampi AI relies on reputable cloud infrastructure providers for physical security controls protecting data centers, hardware, facilities, power, environmental protections, and physical access management. These controls are managed under the shared responsibility model and supported by the providers’ security and compliance programs. ### 2. Organizational measures **Security governance**. Lampi AI maintains an internal governance structure for information security and operational resilience. The CEO provides executive oversight and accountability for security and resilience priorities, while the CTO has operational responsibility for implementing and maintaining security controls, incident response procedures, and technical risk management practices. **Security team responsibilities.** Lampi AI’s Security Team monitors systems, reviews security events, coordinates incident response, supports vulnerability management, and assists with containment, investigation, remediation, and documentation of security events. Security responsibilities are assigned according to role, expertise, and operational need. **Employee awareness and training**. Lampi AI provides onboarding and periodic security and privacy awareness training to personnel who work with systems, data, or operational processes. Training includes expected behavior, reporting channels, confidentiality obligations, data protection principles, secure use of internal tools, and awareness of common threats such as phishing and social engineering. **Personnel security**. Lampi AI personnel are required to comply with confidentiality, acceptable use, professional conduct, and information security expectations. Personnel are required to execute confidentiality commitments, acknowledge applicable policies, and process Customer Data only as authorized. Background checks may be conducted where legally permissible, role-appropriate, and consistent with applicable labor laws. **Internal access control**. Lampi AI applies least-privilege and role-based access principles to internal systems, cloud infrastructure, production environments, databases, networks, logs, and administrative tools. Access to sensitive systems is restricted to authorized personnel with a legitimate business need and is protected through authentication, multi-factor authentication where applicable, and periodic review. **Privileged access management**. Privileged access is limited to authorized personnel and used only for administration, support, troubleshooting, security, recovery, or other approved operational purposes. Privileged actions are subject to approval, logging, access restriction, and time limitation where appropriate. Access may be revoked, suspended, or restricted immediately where required for security, termination, or contractual reasons. **Access revocation.** Lampi AI maintains onboarding, role-change, and termination procedures designed to ensure that employee and contractor access is granted appropriately and revoked when no longer required. Termination or offboarding processes include revocation of relevant credentials, tokens, system accounts, and administrative privileges. **Risk management**. Lampi AI conducts periodic reviews of security, privacy, operational, and supplier risks. These reviews support continuous improvement of policies, controls, monitoring, incident response procedures, and development practices. Lampi AI’s practices are designed to be aware of applicable requirements and expectations under GDPR, NIS2, DORA, and other relevant frameworks where applicable. **Data protection governance**. Lampi AI processes Customer Data and Personal Information in accordance with the Agreement, the Data Processing Addendum, and Customer instructions where applicable. Lampi AI applies data minimization, purpose limitation, access restriction, encryption, and data residency controls appropriate to the Services and applicable processing activities. **Policy management.** Lampi AI maintains policies and procedures covering security, privacy, incident response, access management, vulnerability management, supplier risk, and business continuity where applicable. Policies and procedures are reviewed periodically and updated to reflect changes in the Services, regulatory environment, threat landscape, and business operations. ### 3. Supplier and third-party controls **Supplier management.** Lampi AI limits supplier relationships relevant to service delivery to providers with an appropriate business purpose and security posture. Suppliers are assessed based on their role, criticality, data access profile, contractual commitments, operational resilience, and available assurance documentation. **Sub-processors.** Lampi AI’s sub-processors may include cloud infrastructure providers, approved AI or large language model providers, and business service providers where applicable. The current list of sub-processors is made available separately in Lampi AI’s Sub-Processors Notice or otherwise in accordance with the Agreement. **Contractual protections.** Lampi AI uses data processing agreements, confidentiality obligations, security clauses, incident notification obligations, data transfer safeguards, audit or information rights, and sub-processing controls where appropriate. Supplier commitments are evaluated in light of the supplier’s role, the nature of the processing, and the level of access to Customer Data. **Cloud provider assurance**. Lampi AI relies on critical cloud and infrastructure providers, including Microsoft Azure as its primary production cloud provider, for portions of the security control environment under the shared responsibility model. Such providers are selected in part for their mature security programs, resilience capabilities, regional hosting options, and recognized compliance documentation. **Third-party AI providers**. Where a Customer or Authorized User elects to use a third-party model provider or AI service through the Services, such use is governed by the configuration, provider terms, contractual safeguards, and Customer instructions applicable to that integration. Lampi AI use only providers and configurations that restrict retention, reuse, and training on Customer Data. **Third-party integrations**. Customer-driven connectors and integrations are permission-based and are designed to access only the resources authorized by the Customer or end user. Integrations do not receive ongoing access beyond the permissions granted, and access can be revoked according to the relevant application and service configuration. **Data residency and transfers**. Customer Data is stored and processed primarily in the European Union by default, subject to Customer configuration, selected integrations, selected model providers, and the Agreement. Cross-border transfers, where applicable, are managed through contractual, technical, and organizational safeguards such as appropriate data processing terms and transfer mechanisms. ### 4. AI-specific security and data protection **AI security by design.** Lampi AI designs its AI-related services with controls intended to protect Customer Data during AI processing, retrieval, model interaction, inference, document analysis, and generated output workflows. These controls are implemented across application logic, authorization checks, infrastructure, logging, model routing, and operational monitoring. **Customer control over model use.** Customers may configure or agree which model providers, model families, or deployment options are available for use within the Services, subject to the Agreement and technical availability. External large language model calls can be restricted or disabled in favor of approved, self-hosted, EU-hosted, private, or on-premise models where supported by the deployment model. **Use of Customer Data.** Lampi AI does not sell Customer Data, prompts, inputs, outputs, or Personal Information, and does not use such data to train or improve Lampi AI models except where the Customer has explicitly requested and agreed to a dedicated fine-tuning or training activity. Where fine-tuning is requested, additional controls, customer approvals, environment separation, and anonymization or deletion of Personal Information are applied where applicable. **Third-party model processing.** When a Customer or Authorized User chooses to use a third-party model through the Services, Customer Data may be transmitted to that provider solely for the purpose of providing the requested functionality and subject to applicable contractual and technical safeguards. Lampi AI uses only customer-selected third-party AI and model providers under commitments that Customer Data, prompts, inputs, and outputs are not used to train or improve third-party models. **Zero data retention and non-use commitments.** Lampi AI uses third-party model provider that apply zero data retention, non-retention, non-logging, or equivalent non-use commitments for Customer Data submitted for inference. These commitments are intended to ensure that Customer Data processed by third-party model providers is not retained, logged, reused, or incorporated into provider model-training datasets. **Model routing and restriction controls.** Lampi AI applies model routing controls to manage which AI endpoints may be called in production and to reduce unintended data exposure to non-approved providers. Customers may choose to restrict available models, disable external model calls, or use approved self-hosted, EU-hosted, private, or on-premise models where applicable to their deployment and contractual requirements. **Retrieval and data-source controls.** Lampi AI’s AI workflows use authorization-aware retrieval and data-source access controls so that users receive responses based on data they are permitted to access. Organization membership, role permissions, connector permissions, and document access rules are validated as part of relevant retrieval and processing workflows. **Prompt-injection safeguards.** Lampi AI applies AI-specific security controls intended to reduce the risks of prompt injection, unsafe instruction following, unauthorized tool use, and unintended data exposure. **AI observability and auditability.** Lampi AI maintains observability and tracing for AI workflows. This supports operational monitoring, debugging, quality review, and auditability of AI interactions, including the relationship between user requests, data sources, model calls, and generated responses, subject to configured retention and access restrictions. **Human oversight.** Lampi AI’s AI capabilities are designed primarily to augment human analysis, document processing, and decision support. Customers remain responsible for their use of outputs, validation of critical decisions, internal governance, and configuration of user permissions and model access according to their own policies and legal obligations. ### 5. Incident response, continuity and availability **Incident response program.** Lampi AI maintains policies and procedures for detecting, escalating, containing, investigating, remediating, documenting, and communicating security and operational incidents. Incidents are classified by category and severity, including a priority scale from P1 to P5, to support appropriate response, escalation, and customer communication. **Detection and escalation**. Lampi AI uses operational monitoring, logs, alerting, employee reporting, vulnerability management, and security tools to identify potential incidents. Personnel are required to report suspected incidents promptly, and high-risk events are escalated to the CTO and Security Team for coordination and decision-making. **Containment and remediation**. Lampi AI’s incident response procedures include containment, investigation, evidence preservation, root cause analysis, corrective action, recovery, monitoring, and post-incident review. Remediation may include configuration changes, patches, access revocation, provider coordination, customer guidance, or procedural improvements depending on the nature of the incident. **Customer notification**. Lampi AI notifies affected Customers promptly and without undue delay after becoming aware of a confirmed security incident involving Customer Data, and within 24 hours after awareness where contractually committed or required by applicable law for qualifying data breaches. Notifications may be provided through support channels, account contacts, contractual notice mechanisms, or , as appropriate. **Incident communications.** Incident communications may include the nature of the incident, affected systems or data categories, known or likely consequences, measures taken or proposed, mitigation steps, customer actions where relevant, and a Lampi AI contact point. Lampi AI may provide updates as investigation and remediation progress, and may issue closure communications or lessons learned where appropriate. **Availability monitoring**. Lampi AI monitors platform availability, application performance, system health, infrastructure behavior, network performance, and AI workflow execution. Alerts may be routed to internal communication channels and escalated according to severity. **Business continuity.** Lampi AI’s continuity practices include redundant and cloud-native infrastructure capabilities where applicable, backup procedures, monitoring, incident escalation, controlled deployment, and recovery planning. These measures are designed to reduce the likelihood and impact of service disruptions and support timely restoration of affected components. **Disaster recovery**. Lampi AI maintains disaster recovery procedures for restoring supported data stores, application components, configuration, and operational services. Recovery activities are coordinated by designated technical and security personnel, with executive oversight where required, and are supported by documented procedures and periodic testing. **Backup protection**. Backups are stored in Azure-hosted storage in the European Union where applicable and protected using secure transfer and encryption at rest. Backup access is restricted through least-privilege service credentials, infrastructure controls, and administrative safeguards. **Security review and improvement**. Lampi AI periodically reviews its security measures, supplier controls, risk posture, monitoring practices, incident procedures, and development processes. Improvements are prioritized based on risk, customer needs, regulatory expectations, operational maturity, and the evolving threat landscape for AI-enabled services. # Product Terms The terms below (“**Product Terms**”) forms part of, and is subject to, the Master Services Agreement or other written or electronic terms of service or subscription agreement between Lampi AI and Customer that reference this terms (the “**Agreement**”), and is effective on the Effective Date of the Agreement. Capitalized terms used in these Product Terms but not defined below are defined in the Agreement. Lampi AI may modify these Product Terms periodically. If an update will materially affect Customer's use of the Lampi AI Software, Lampi AI will notify Customer prior to the update's effective date (except for changes due to legal or regulatory reasons which may be effective immediately). Otherwise, updates will be effective as of the date of deployment. **Lampi AI Search Services**. The following governs the Customer’s use of the Lampi AI search capabilities, enabling Customer to navigate through Customer Data, incorporating uploaded or connected Customer Data from various third-party applications, all from a single access point (“**Lampi AI Search Services**”). Customer agrees that, upon being granted access, Lampi AI will ingest and systematically index data from the specified sources. Customer maintains the authority to designate which data sources are to be connected and indexed by Lampi AI. Customer represents and warrants that (i) it has the necessary rights, licenses, and permissions to connect the Customer Data, (ii) that the use of Customer Data will not violate or infringe the rights of any third party, and (iii) Customer Data will comply with the Terms of Use. **Lampi AI Model Services**. The following governs the Customer’s use of the Lampi AI Chatbot and AI agents, and any other service to which Customer may input Customer Data to a machine learning model hosted by Lampi AI (collectively, “**Lampi AI Model Services**”). Customer may input Customer Data into the Lampi AI Model Services and receive Output. Customer represents and warrants that (i) it has the necessary rights, licenses, and permissions to create the Output, (ii) that the use of Output will not violate or infringe the rights of any third party, and (iii) Output will comply with the Terms of Use. Lampi AI does not have any obligation to monitor Customer Data, Output, or Customer application, but Customer acknowledges and agrees that Lampi AI reserves the right to, upon request, monitor any and all information transmitted or received through Lampi AI Model Services for support as mentioned in the Master Services Agreement. On the Lampi AI Software, Lampi AI provides a list of the major open-source or foundation models available on the market. It is the Customer's responsibility to select the model that suits their needs and that complies with its technical or legal requirements. **Lampi AI Assistant Meeting Services**. The following governs the Customer’s use of Lampi AI meeting assistant, allowing Customer to record, transcribe, summarize, analyze, and take action on conversations. Lampi AI will not access, view or listen to any conversations without the Customer’s prior written consent. Such consent shall be considered given if Lampi AI deems is invited to the conversations or that the Lampi AI Assistant Meeting Services is used during the conversations. Any information obtained by Lampi AI while accessing a conversation is treated as Customer Data and shall be kept confidential by Lampi AI. Customer shall make the necessary arrangements to ensure a third-party that takes part in the conversation is provided with the necessary warning about the presence of any recordings made of a conversation. Customer shall notify the third party that their conversation with the Customer is being recorded by Lampi AI; and Lampi AI shall have no liability whatsoever in respect of any use made by Customer of the recordings and its contents, and/or of any personal information. **Trial Access to Services**. Customer may receive access to Lampi AI Model Services on a trial or evaluation basis (“**Trial Access**”). Customer will not use Trial Access for commercial or production purposes and will not disclose to a third party any Output obtained from Trial Access. Customer acknowledges that Lampi AI may terminate Customer’s Trial Access at any time. **Fine-Tuned Models.** Some Lampi AI Model Services may include machine learning models that have been fine-tuned, upon request from the Customer, with Customer Data based on a Base Model (“**Fine-Tuned Model**”). Customer does not own Fine-Tuned Models, which are subject to Lampi AI’s rights. Except for the rights expressly granted, and subject to third-party restrictions, Lampi AI owns and reserves all right, title, and interest in and to the Fine-Tuned Models and Base Models. Unless otherwise stated, Fine-Tuned Model is dedicated to the Customer and will not be available to any other-party. "**Base Model**” means a machine learning model which Lampi AI has trained, and may be based on Open-Source Models or Third-Party Models. **Hosting Services**. The Lampi AI Software is available in different cloud infrastructure configurations allowing customers to select the best option to meet their security requirements. The offerings include: Lampi AI Public Cloud, Shared Private Cloud, and Dedicated Cloud. The Hosting offering selected by the Customer will be specified in the Order Form. The terms of this section apply to each of the Lampi AI Hosting options. The Lampi AI Software will be installed and hosted on computing equipment of the cloud computing service provider selected and retained by Lampi AI from time to time. Lampi AI reserves the right to determine the hosting service provider but will ensure the hosting service provider: (a) is a globally recognised, tier-one hosting provider; (b) agrees to provide the hosting using cloud infrastructure located in France or European Union; (c) agrees to maintain a professional hosting facility designed for such use, equipped with industry-standard physical access security, climate control, fire suppression, and managed power supply with UPS and generator back-up; (d) agrees to provide industry-standard data access security arrangements; and to implement and maintain appropriate technical and organizational measures, including information security policies and safeguards, designed to preserve the security, integrity, and confidentiality of Customer Data (including personal information) and to protect against unauthorized or unlawful disclosure or corruption of or access. (On request, Lampi AI will give the Customer details of its then-current hosting provider and links to their security procedures.) Lampi AI will install all system, database and Lampi AI Software on the hosted environment. The loading of initial Customer Data will be performed as part of the implementation, as a Lampi AI Professional Service. Lampi AI informs the Customer, who accepts, that it might have the Services running on a cloud infrastructure that are performed by one of the following subcontractors: OVHcloud, OCI, Scaleway, Vercel, and/or Google Cloud Platform. All subcontractors have been selected for their high security standards, and security and privacy controls in place. Lampi AI will notify the Consumer of any changes to subcontractors that are not listed in these terms. If applicable, Lampi AI undertakes to pass on, in its agreements with subcontractors, the obligations incumbent on it under the Agreement. Lampi AI shall remain solely liable towards the Customer for the fulfillment of his contractual obligations arising from the Agreement. ​​Unless otherwise stated, Customer does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, storage or even individual application capabilities. **Implementation services**. Lampi AI will provide services to help Customer deploy the Lampi AI Software. The details of the services, including the scope, deliverables, estimated timeline and fees, will be set out in an Order Form. The terms in this section apply generally to all deployments of Lampi AI Software on the Lampi AI Cloud. Lampi AI and the Customer will agree a scope and the Professional Service fees to deliver that scope. * **Changes** - Any changes requested post configuration which lie outside the agreed documentation will be completed by the Customer, or alternatively, a Change request can be raised for Lampi AI to complete the work for an additional charge. * **Development Items** – items where development would be required are considered out of scope, until a detailed scoping and analysis of the use case and associated data is conducted. Business requirements that are not possible within the current function of the software will be considered as a customisation and will be scoped and costed separately from the implementation costs, unless otherwise agreed in writing. # Third-Party Model Terms The terms below (“**Third-Party Model Terms**”) forms part of, and is subject to, the Master Services Agreement or other written or electronic terms of service or subscription agreement between Lampi AI and Customer that reference this terms (the “**Agreement**”), and is effective on the Effective Date of the Agreement. Capitalized terms used in these Third-Party Model Terms but not defined below are defined in the Agreement. Lampi AI may modify these Third-Party Model Terms periodically. If an update will materially affect Customer's use of the Lampi AI Software, Lampi AI will notify Customer prior to the update's effective date (except for changes due to legal or regulatory reasons which may be effective immediately). Otherwise, updates will be effective as of the date of deployment. **Service evolution and modifications.** The Customer acknowledges that Third-Party Models Provider services are subject to technological evolution and policy changes. Lampi AI reserves the right to modify these Terms to reflect significant changes in Third-Party Models Provider services or policies. The Customer explicitly acknowledges that Lampi AI bears no liability for Third-Party Models Provider -initiated changes and cannot guarantee that such changes will not impact Lampi AI's Services. **Data processing and privacy.** **a. Customer Data Processing**: Customer authorizes Lampi AI to transmit Customer Data, including Personal Information, to Third-Party Model Provider in accordance with the Data Processing Agreement and service functionality requirements. DPA agreements with each Third-Party Model Provider can be found in the [Sub-Processors ](/sub-processors-notice)Notice. **b. Model Training Restrictions**: **i. Lampi AI and Third-Party Models Providers are prohibited from using Customer Data for model training** ii. Lampi AI is not allowed to grant third parties rights to use Customer Data for model training iii. Customer's use of Lampi AI's Services does not confer any rights to use Customer Data for training purposes. **c. Data Retention from FMP:** **i. All selected Third-Party Models Providers apply a “Zero Data Retention” policy,** meaning that Customer Content will not be logged for human review and will not be saved to disk or retained by those providers. **d. Model Provider Selection** Customers have the ability to opt out of any Third-Party Models available for inference (directly through the user interface). **User Responsibilities**: Customer maintains sole responsibility for: i. Input and Output usage compliance with applicable laws ii. Adherence to these Terms, the Agreement, and iii. Respecting intellectual property rights. When using Third-Party Models, Customer must comply with all applicable Third-Party Model Provider policies. Lampi AI explicitly disclaims all warranties regarding: i. Results obtained through service use ii. Third-Party Model Output accuracy. **Risk Acknowledgment:** i. Service use and Output utilization occur at Customer's sole risk ii. Users must independently verify Output accuracy iii. Detailed or specific Output may contain inaccuracies iv. Outputs may not reflect post-training developments c. No oral or written information provided by Lampi AI creates additional warranties beyond those expressly stated herein.