Data processing agreement

In force from 17. August 2026.

This document is for professional customers — care homes, home-help services, insurers — who use Lacima for people in their charge. For a family, the privacy policy is sufficient and takes precedence.

It supplements the terms of service agreed with Lacima SAS (informations provisoires) and constitutes an agreement within the meaning of Article 28 GDPR.

1. Roles

The customer is the controller of the data of the people they enrol. Lacima SAS (informations provisoires) is a processor and acts only on the customer's instructions, within the limits of the service described.

2. Subject matter and duration

The processing is for the purpose of providing companionship calls, producing accounts of them, and issuing alerts. It lasts for the term of the contract.

3. Nature of the data

Identity and contact details of the person called, language, timezone, conversation content, safety alerts, and the audio recording where enabled. Conversation content may fall under Article 9 GDPR.

4. Lacima SAS (informations provisoires)'s obligations

• Process the data only to provide the service, never for its own purposes.
• Train no model on the conversations of the people called.
• Ensure confidentiality by authorised staff, and log access to conversations.
• Implement the security measures in section 7.
• Assist the customer in responding to data-subject requests.
• Notify any personal data breach without undue delay, and at the latest within forty-eight hours of

discovering it.

• Delete or return the data at the end of the contract, at the customer's choice.

5. The customer's obligations

• Ensure a valid consent exists for every person enrolled, and for each strand: calls, keeping the

transcript, audio recording.

• Inform the data subjects of this processing.
• Enter no data in the family notes that they do not need.
• Pass on without delay any withdrawal of consent or any request from the person called.

6. Sub-processors

The customer authorises the use of the sub-processors listed in the privacy policy. Any addition is notified before it takes effect; the customer may object and terminate if the objection makes the service impossible.

Transfers outside the European Union, and the safeguards for them, are described in that same policy. The customer is informed of them before the contract is entered into.

7. Security measures

Encryption in transit, encryption of provider credentials at rest, access separated by role, a named audit log on every read of a conversation, automatic deletion of transcripts after thirty days and of recordings after sixty, encrypted backups, and least privilege for staff.

8. Audit

The customer may request, once a year and with reasonable notice, the evidence demonstrating compliance with this agreement.

9. Liability

The limitations in the terms of service apply, without prejudice to the mandatory provisions of the GDPR.

Contact: dpo@lacima.net-innovation.com.