LogMeIn Customer Data Processing Addendum 2018 (DPA).pdf

## LMI Customer Data Processing Addendum 2018.v2 - Summary

This document outlines a Data Processing Agreement (DPA) between LogMeIn (the "Processor") and a customer ("Customer") regarding the handling of customer data during their use of LogMeIn's online services.

Key Points:

Scope: The DPA applies to all Customer entities that are parties to, or using Services under, a Terms of Service agreement with LogMeIn, even if not directly signed. It covers both direct customers and authorized affiliates who use the services but have separate agreements.
Data Processing Roles:
Customer: Acts as the "Controller," responsible for deciding how Personal Data is processed.
LogMeIn: Acts as the "Processor," handling data on behalf of the Controller according to instructions.
Types of Data: The agreement covers "Customer Content" – any files, documents, recordings, etc. uploaded or generated by Customer and its users while using LogMeIn's services, along with any Personal Data contained within.
Compliance: Both parties must comply with relevant "Data Protection Laws and Regulations," specifically the GDPR for European Union data subjects.
Security Measures: LogMeIn implements "Security and Privacy Operational Controls" (SPOC) to protect Customer data. These are accessible through LogMeIn's GDPR Resource Center.
Sub-processors: LogMeIn may engage Sub-processors (other companies handling data on its behalf), but these must also comply with Data Protection Laws and be approved by the Controller (Customer).
* Standard Contractual Clauses: The DPA incorporates standard contractual clauses for data transfers to third countries, as required by the European Commission.

Execution:

The DPA requires signature from authorized representatives of both parties. It becomes legally binding upon receipt and acceptance by LogMeIn.