GDPR: where can I find LWS’s data processing agreement (DPA) and confidentiality commitments?

Procédure

LWS's commitments as a processor within the meaning of the GDPR are published in two freely accessible documents on the LWS Terms and Conditions page, in the "General terms and conditions" section: "Processing of personal data or DPA" and "Data processing agreement (DPA agreement)." This help article shows you where to find them, what they contain regarding data confidentiality, location and security, and who to contact with a question.

This help article summarizes contractual documents to help you find your way around. Only the documents themselves are authoritative: read them in full, and seek legal advice if your project requires it.

Where can you find LWS's data processing agreement (DPA)?

On the LWS Terms and Conditions page, the "General terms and conditions" section offers the following PDFs:

• Processing of personal data or DPA (version dated April 16, 2024);
• Data processing agreement (DPA agreement) (version dated April 19, 2024).

The "Legal documents" section on the same page also provides the Information System Security Policy, the Privacy Policy, and the GDPR Legal Information.

According to these documents, the DPA forms an integral part of the contract concluded between LWS and the customer, and the DPA agreement specifies that placing an order or creating an account constitutes acceptance of this agreement. The DPA agreement also includes a "Special terms and conditions" section, with the types of data processed (including sensitive data) and a signature from both parties.

Who is responsible for what?

The DPA is established in accordance with Article 28 of the GDPR:

• for the data you host with LWS, you are presumed to be the data controller: you are the one who chooses the data and the data subjects;
• LWS acts as the processor and processes this data only on your instructions, to the extent necessary to provide the services.

The DPA also reminds you that you remain responsible for the security of what you install and operate yourself on your services (websites, software, applications).

Data confidentiality

According to the DPA and the DPA agreement:

• LWS employees authorized to process the data are bound by confidentiality obligations and receive training on the protection of personal data;
• LWS undertakes to access your data and use it only for the purposes of performing the services;
• confidentiality commitments are required from all employees and service providers acting on behalf of LWS.

Data location and subcontractors

The DPA states that the data is located in France and that LWS does not transfer personal data outside the European Union. Annex II of the DPA agreement lists the sub-processors, all located in France: LWS SAS and Groupe LWS (affiliated entities), Equinix and Adista (third-party entities).

In the event of a change or addition of a sub-processor, the DPA provides that LWS will notify you in your management interface or by email, and that you have 15 days to raise a reasoned objection.

Security measures and certification

Annex I of the DPA agreement cites, in particular, the encryption of data in transit and at rest, the control of physical and logical access to servers, strengthened authentication, the isolation of data belonging to different customers, and the rapid application of security patches published by CERT-FR. For details, refer to LWS's Information System Security Policy.

The lws.fr website states "Company and datacenters ISO 27001 certified." The DPA provides that, if a service is certified, LWS will make the corresponding certificates and reports available upon the customer's written request.

Hosting sensitive data

The DPA lets you choose the services and makes you responsible for that choice. If your processing presents a high risk, for example because it involves sensitive or health data, the DPA asks you to choose your services carefully and verify that they are suitable for the type of data processed. The Information System Security Policy recalls the same rule: it is up to the customer, as data controller, to ensure that the service level is appropriate for the sensitivity of the data.

The DPA also provides that, upon written request, LWS will provide you with reasonable assistance for a data protection impact assessment. Information not published on the LWS website is considered confidential, and LWS may request the signing of a non-disclosure agreement before communicating it to you.

Contacting LWS with a question about your data

The DPA provides several ways to contact them:

• a ticket from your customer area (see how to contact LWS technical support);
• the contact form on the LWS website;
• a postal letter to: LWS, DPA - Traitement des données, 10 rue Penthièvre, 75008 Paris (France).

The Legal notices & Privacy of lws.fr page also provides a GDPR / DPO contact: rgpd@lws.fr.

Related articles

• How do I contact LWS technical support?