If the data breach relates to data Lightspeed is processing on behalf of you as a processor, we will always notify you within 36 hours after discovery. Under privacy laws, a data breach is defined as 'a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.'

In which scenarios would I need to submit a privacy request to Lightspeed Support? Because of the data-sharing nature of our partner integrations, if you're a merchant affected by privacy laws and you have integrated your OnSite account, you'll also need to enter into a DPA with our partners. For more information, please contact our integration partners directly. It's also important to note that upon your permission, Lightspeed shares the personal data that you control in your OnSite account with partners that you've selected to integrate with. This allows our partners to pull the data they need to build their integrations and Lightspeed to offer the best business solution to you as a merchant. This will ensure that you're compliant with privacy laws and avoid fines from the privacy authorities. Once you've signed the DPA, it is effective immediately and is legally binding. If you haven't received the DPA from us yet, it's important that you request the DPA by submitting a privacy request to Support. Also, it clearly describes all the obligations that Lightspeed has towards you. Signing the DPA is fully to your benefit as it creates specific rights for you in relation to Lightspeed’s processing activities. You can request to receive a form during the same process as submitting a privacy request to Support. For instructions specific to your Lightspeed product, please see their respective privacy Help articles:Īs Lightspeed is helping merchants in the processing of personal data, we are required by law to enter into a Data Processing Agreement (DPA) with our merchants affected by privacy laws. NOTE: All of our Lightspeed products support the above privacy requests. Similarly, merchants that have integrated their accounts with one of our partners need to contact them directly to learn what personal data they have and how to complete privacy requests on their end. Read Required privacy actions for more information. If you have Lightspeed eCom connected to your OnSite inventory, you'll also need to perform actions in eCom. for tax, regulatory or payment processing (chargeback) reasons). We also recommend identifying any potential reason why you might need to keep some of the personal data that your customer or employee is requesting to delete (e.g.

We recommend that our merchants do their due diligence to confirm the identity of their employees and customers before completing their privacy requests. You can read helpful answers to the essential FAQs. As a Lightspeed OnSite merchant, the 6 privacy requests you need to comply with are the following:

The California Consumer Privacy Act (CCPA) took effect on Jan 1, 2020.

Europe's General Data Protection Regulation (GDPR) took effect on May 25, 2018.

Privacy laws are designed to protect and empower the privacy of citizens and to reshape the way organizations across the region approach data privacy.

Lightspeed onsite support