Data Processing Addendum
This addendum applies whenever Celestris AI Pvt Ltd processes personal data on your behalf in Lightng CRM, and forms part of the Terms of Service. It is designed to meet Article 28 of the GDPR and UK GDPR and the equivalent requirements of other data protection laws. You accept it by accepting the Terms. Nothing needs to be signed.
Last updated: 15 October 2026. For a countersigned copy, email hello@celestris.pro.
1. Roles and scope
You are the controller of personal data in your Customer Data, and we are your processor. We process it only to provide the service, on your documented instructions (these terms and your use of the product), unless the law requires otherwise, in which case we'll tell you unless the law forbids it.
| Details | |
|---|---|
| Subject matter and duration | Providing the service, for the length of your subscription and the deletion period afterwards |
| Nature and purpose | Hosting, storing, displaying, searching, emailing, AI-assisted analysis, as directed by you |
| Data subjects | Your contacts, leads, customers, prospects and team members |
| Types of personal data | Names, job titles, companies, email addresses, phone numbers, social profile links, notes, email content and engagement |
2. Our obligations
- Everyone at our company who can access the data is bound by confidentiality.
- We apply the technical and organisational measures on our Security page.
- We help you respond to data subject requests and meet your obligations on security, breach notification and data protection impact assessments, as far as the nature of the processing allows.
- We notify you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
- When your account ends, we delete the data from live systems, and from backups as they cycle, unless the law requires us to keep it.
- We make available the information needed to show compliance with this addendum, and allow reasonable audits, normally by answering written questions and sharing relevant documentation, at most once a year unless there is a breach.
3. Sub-processors
You give general authorisation for the sub-processors listed on our Sub-processors page. We bind each of them to data protection obligations at least as protective as these, and remain responsible for them. We'll give at least 30 days' notice of a new sub-processor by updating that page and emailing account owners, and you may object on reasonable data protection grounds. If we can't resolve the objection, you may cancel and receive a refund of prepaid fees for the unused period.
4. International transfers
Where personal data subject to EEA, UK or Swiss law is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, as applicable), with the UK International Data Transfer Addendum where relevant, are incorporated by reference, with Ireland as the governing law and forum for the Clauses.
5. Your obligations
You confirm that you have a lawful basis to process the personal data you put into the service and to instruct us to process it, and that you have given any notices and obtained any consents required, including for email tracking.