Data Processing Practices

1. Who we are

Gruther, a company incorporated under the laws of France, with its registered office at 19 boulevard Malesherbes, 75008 Paris, France, publishes lensx.tech and operates LensX, a business-to-business platform that connects an organization’s HR, finance, and operations records into one deterministic data layer, its organizational memory, over which authorized people can reason with AI assistance.

This page describes how we handle the data our customers entrust to us. It is written for the people who evaluate us: security teams, data protection officers, and procurement. It supplements our Privacy Policy and does not replace the data protection terms of a signed agreement, which prevail.

2. Our roles: controller and processor

We act in two distinct capacities, and it matters which one applies.

• Processor, for customer records. Everything a customer connects to or generates within its LensX workspace is processed by us on that customer’s documented instructions. The customer is the controller: it decides what is connected, why, and who may see it. We process it to provide the service and for no independent purpose of our own.
• Controller, for our own operations. Account and administrative data, billing records, support correspondence, business contacts, and website visitor data are processed by us as controller, for the purposes and on the legal bases set out in the Privacy Policy.

3. What we process for customers

The scope is set by the customer, through the sources it chooses to connect. In practice it covers three families of records:

• HR records: org structure, positions and job descriptions, skills and skill levels, evaluations, training and mobility histories, and candidate data where the customer uses the platform for hiring.
• Finance records: budgets, cost centres, payroll aggregates, transactions, and the reference data needed to interpret them.
• Operations records: projects, assignments, workloads, delivery and activity data, and the documents attached to them.

These records frequently contain personal data about the customer’s employees, candidates, contractors, clients, and counterparties. We do not require and do not ask for special categories of data. If a customer chooses to connect a source containing them, it is responsible for having a lawful basis and the additional conditions the law requires.

We do not use customer records to train models. The AI reasons over a customer’s own records to answer that customer’s questions. Facts live in the deterministic data layer, not in model weights, and answers are traceable to the records they were drawn from. One customer’s data is never used to serve another.

4. Storage and encryption

Customer data is encrypted in transit, over current TLS, and at rest in the storage layer. Backups are encrypted on the same terms as the primary store.

Each customer’s data is held in a logically separated workspace, so that a query can only reach the records belonging to the workspace it was made in. Credentials and secrets used to connect a customer’s sources are stored separately from the data itself and are not exposed in the interface.

5. Access controls

Within the customer’s organization, access is granular and granted by the customer: per person, per team, and per department. An administrator decides which records and which parts of the organizational memory each person may reach, and the AI answers only from the records the person asking is entitled to see. Access rights can be changed or withdrawn at any time by the customer.

Within our organization, access to customer environments is restricted to the personnel who need it for a defined purpose, such as resolving a support request or investigating an incident. Access is authenticated individually, granted on a least privilege basis, logged, and removed when the reason for it ends or when the person leaves the role. Our personnel are bound by confidentiality obligations.

6. Retention and deletion

We retain customer records for as long as the customer instructs, which is normally the duration of the agreement. Customers can delete records from their workspace during the term.

On termination, customer data is returned or deleted within the window set out in the agreement. A customer may export its data during that window. After it closes, the data is deleted from active systems, and encrypted backups age out on the ordinary backup cycle, except where we are required by law to keep something for longer, in which case we keep only what the law requires and for no other purpose.

7. International transfers

We are established in France, inside the European Economic Area, so personal data originating in the EEA does not leave it on our account. Where personal data originating in the EEA or the United Kingdom is transferred to a service provider established outside those areas, we rely on appropriate safeguards under Chapter V of the GDPR, in particular the European Commission’s Standard Contractual Clauses, in the modules that match the roles of the parties.

Those safeguards are supported by the technical and organizational measures described on this page: encryption in transit and at rest, least privilege access, logging, and contractual limits on the purposes for which data may be used. Customers may request a copy of the transfer mechanism applying to their agreement.

8. Breach notification

We notify affected customers without undue delay after becoming aware of a personal data breach affecting data we process on their behalf. The notification describes what we know about the nature of the breach, the categories and approximate volume of data and people concerned, the likely consequences, and the measures taken or proposed to address it and to mitigate its effects.

We provide the information and assistance a customer reasonably needs in order to meet its own obligations to a supervisory authority and to data subjects. As processor, we do not notify supervisory authorities or data subjects on a customer’s behalf unless the agreement says otherwise. Where a breach affects data for which we are the controller, we handle the notifications ourselves as the law requires.

To report a suspected vulnerability or incident, write to info@lensx.tech.

9. Subcontracting

We use a small number of service providers to host and secure the infrastructure, to provide the AI model capability the platform reasons with, and to support our own business operations. Each one is engaged under a written contract imposing data protection obligations no less protective than those we owe our customers: processing only on instructions, confidentiality, security measures, restrictions on onward transfer, and deletion or return at the end of the engagement.

We remain responsible to the customer for the performance of any provider we engage. Customers are informed of the providers used in their deployment, and of any intended change, under the terms of their agreement, which is where the current list and the objection procedure live. Providers acting for us are not permitted to use customer data for their own purposes, including model training.

10. Contact

For a security review, a due diligence questionnaire, or a question about anything on this page:

• By email: info@lensx.tech
• By post: Gruther, 19 boulevard Malesherbes, 75008 Paris, France

Our wider security posture is described on the Security page.