1. Roles
The client normally acts as controller of its users, employees, patients, guests, suppliers or consumers. It determines purposes, essential means, notices and legal bases.
Lulab acts as processor or custodian only for operations needed to develop, migrate, host, back up, maintain or support the contracted system.
2. Subject, duration and data
The proposal should describe service, duration, categories of people, data types, operations, location, providers, backup frequency, retention and exit. If a detail is missing, processing is limited to what is strictly necessary to perform the service.
3. Instructions and lawfulness
Lulab will process data under documented instructions unless legally required otherwise. It will report instructions that appear unlawful, unsafe or outside scope and may pause them pending clarification.
The client warrants that data was lawfully obtained, notices were provided, consents handled where needed and the system will not be used for prohibited purposes.
4. Confidentiality and access
Access is limited to personnel and providers needing it for the service and subject to confidentiality duties. Accounts should be individual where reasonably possible and revoked when no longer needed.
5. Security measures
- HTTPS and encryption in transit where supported by the provider.
- Access controls, strong passwords, protected sessions and least privilege.
- Input validation, file and directory restrictions, reasonable updates and logging of relevant events.
- Backups and restoration only under the contracted plan.
- Incident procedures, evidence preservation and access review.
5A. Portal, files and temporary credentials
The portal may process contact data, intake responses, project materials, approvals, tasks and security traces. Files are stored outside public access and served only after verifying an authorized session and its relationship to the portal.
Temporary credentials are kept separate from responses and files, with authenticated encryption and an application key outside the database. Their contents are neither logged nor emailed; encrypted material is purged within 72 hours or 24 hours after first reveal, whichever occurs first.
6. Subprocessors and transfers
The client authorizes reasonably necessary providers such as hosting, domain, CDN, email, backup, monitoring, support, messaging and APIs identified in the proposal or provider register.
Lulab will communicate material changes where reasonable. If the client objects for a documented data protection reason, the parties will assess an alternative; additional costs or limits may require adjustment.
7. Individual and authority requests
Lulab will forward requests relating to client-controlled data and provide reasonable assistance. The client determines the response unless law requires direct action. Extraordinary work may be charged separately.
8. Incidents
Lulab will notify the authorized contact without undue delay after confirming a relevant incident under its control, with available information on nature, data, measures and recommendations.
The client is responsible for determining and making notices to individuals or authorities where required. Both parties will cooperate and avoid uncoordinated public statements unless legally required.
9. Evidence and audit
Lulab will provide reasonable compliance information. On-site audits, special testing or extensive questionnaires require notice, confidentiality, reasonable timing, no impact on other clients and cost coverage when beyond ordinary support.
10. Return, export and deletion
At termination, the client may request a reasonable export in the available format within the contractual period. Migrations, transformations or special delivery may be charged.
After the transition period, Lulab will delete or anonymize operational data under its control, except for legal retention, disputes, client instructions or temporary persistence in rotating backups.
Non-payment may suspend services but does not authorize arbitrary destruction or improper withholding of personal data. Export may be conditioned on payment for reasonably necessary technical work, not on obstructing legal rights.
11. Allocation of responsibilities
The client is responsible for purposes, legal bases, notices, data quality, users and permissions in its organization. Lulab is responsible for following instructions, protecting access under its control and applying agreed measures.
Each party will report changes increasing risk. Neither party may require the other to conceal incidents, violate law or weaken essential controls.
12. Precedence and contact
A project-specific addendum prevails over this model. For matters not covered, the proposal, Terms of Use and Services and Privacy Policy apply.
Data matters contact: ventas@lulabtech.com.
