Data Processing Agreement

This Agreement applies when you use LayPattern Pro to store information about your own customers — their name, contact details, address and the jobs you carry out for them. For that information you are the data controller and LayPattern AS is your data processor under Article 28 of the GDPR.

It does not apply to your own account data (your email, your subscription), where LayPattern AS is the controller — see the Privacy Policy for that.

1. Subject matter and duration

We process your customer data solely to provide LayPattern: storing customer records, associating them with projects and rooms, and producing the drawings, cut lists and exports you ask for. Processing lasts for as long as your Pro subscription is active, plus the retention period in section 6.

2. Categories of data and data subjects

Data subjects are your customers and their contact people. Categories are limited to what you choose to enter: name, company, contact name, email address, telephone number, postal address, free-text notes, and the measurements and designs of the work at their property. We ask you not to enter special categories of personal data (Article 9) — the product has no need for it.

We also keep an activity record: which of your team did what, and when — creating, renaming, sharing, filing and deleting jobs, rooms and customer records. It stores the action and the name of the thing acted on, never the contents of a customer record. You can read it yourself on any job page and on your profile.

3. Our obligations

• We process customer data only on your documented instructions, which the use of the product constitutes.
• Everyone with access is bound by confidentiality.
• Data is encrypted in transit and at rest, access is restricted at the database level, and each team can reach only its own records.
• We assist you, as far as we reasonably can, with data subject requests, security incidents and impact assessments.
• We notify you without undue delay after becoming aware of a personal data breach affecting your customer data.

4. Your obligations

You are responsible for having a lawful basis to enter your customers' data, for telling them how it is used, and for the accuracy of what you enter. You are responsible for who you invite to your team and for the access you grant them.

5. Sub-processors

You authorise us to use the sub-processors listed in the Privacy Policy — currently our hosting, database, email and payment providers. Each is bound by equivalent obligations. We will give you notice of any intended change, and you may object on reasonable data-protection grounds.

6. Erasure and retention

You can erase a customer's personal data at any time from the customer page using Anonymise. This permanently removes their name, contact details and notes while keeping the job record — the rooms, measurements and history of work carried out — because that remains your business and warranty record and is not, by itself, personal data.

A customer left archived for more than a year is anonymised automatically. On termination of your subscription we delete or return your customer data on request, except where we are required by law to retain records (for example accounting records relating to payments).

The activity record is kept on two clocks: ordinary editing for 90 days, and anything that deletes, restores, shares or changes team access for 12 months — longer than the 30-day window in which a deleted job can still be restored, so that “who deleted this?” can still be answered by someone recovering it.

Anonymising a customer removes their name from the activity record as well as from their customer page. The entries themselves remain, because what your team did is your business record; what is erased is the personal data inside it. The same applies to a person whose LayPattern account is deleted: the entries stay, their name does not.

If we need to look at a job to help you with a support request, that is written into the same record, on the job itself, naming who looked and when. Being looked at is something you can see.

7. International transfers

Customer data is stored in the EU. Where a sub-processor transfers data outside the EEA, it is done under an approved transfer mechanism such as the EU Standard Contractual Clauses.

8. Audit

On reasonable written request, and no more than once a year unless required by a supervisory authority, we will provide the information needed to demonstrate compliance with this Agreement.

9. Contact

For data protection enquiries, use the contact form and we’ll get back to you. Postal address: LayPattern AS, Flatsethøgda 9, 6531 Averøy, Norway.

Version 2026-08-20 — the version in force. All published versions: 2026-08-20, 2026-08-10.