Data Processing Agreement

At a glance

A plain-language summary. The full text below is what applies.

The broker owns its client data and decides how it is used. Lacspace processes it only to run LSNEP for that broker.
Each brokerage's data is kept in its own separate data store, protected by roles, two-factor staff sign-in, audit logs and encryption in transit.
We tell you quickly about any incident affecting your data and follow up in writing.
When you leave, you get a full export, then we delete the data on your request.

Contents (13 sections)

1. Parties and scope
2. Roles
3. What is processed
4. Lacspace's obligations
5. Security measures
6. Sub-processors
7. Personal data incidents
8. Assistance to the Client
9. Audits and information
10. Location and transfers
11. Retention, export and deletion
12. Liability and precedence
13. Contact

01Parties and scope

1.1

This Data Processing Agreement ("DPA") is between the licensed firm using LSNEP (the "Client") and Lacspace Corporation Private Limited (Reg. No. 377566/82/83, PAN 622468837), Bhimsengola, Sinamangal-31, Kathmandu 44600, Nepal ("Lacspace").

1.2

It applies whenever Lacspace processes personal data on the Client's behalf in providing LSNEP, and forms part of the client agreement between the parties. A signed version of this DPA, if different, prevails.

02Roles

2.1

The Client is the controller: it decides why and how its clients' and staff's personal data is processed and is responsible for having a lawful basis and giving its clients any required notice.

2.2

Lacspace is the processor: it processes that personal data only to provide, support and secure LSNEP for the Client, and only on the Client's documented instructions, including those given through the platform's settings.

03What is processed

3.1

Data subjects: the Client's investors and applicants, authorised persons and nominees, and the Client's staff who use LSNEP.

3.2

Categories of data, depending on the modules the Client uses:

identity and KYC details, including national ID and the documents the Client collects for account opening;
contact details;
account references such as client codes, BOID or demat details and bank account details for payouts;
holdings, orders and trades received from the Client's systems, ledgers, settlement and fee records;
margin, collateral and limit records; and
support tickets and messages.

3.3

Purpose and duration: to run LSNEP for the Client for the term of the client agreement and the exit period described below.

04Lacspace's obligations

4.1

Lacspace will:

process the data only on the Client's instructions, and tell the Client if it believes an instruction breaks the law;
ensure that everyone authorised to process the data is bound by confidentiality;
apply the measures in our Security and Service Commitments;
never sell the Client's data or use it for its own purposes, advertising or to train models for other customers; and
keep each Client's data logically separate from every other Client's.

05Security measures

5.1

The measures include: a separate data store per brokerage; role-based access set per brokerage; two-factor sign-in for all staff; a full audit log of actions; encryption of traffic in transit with modern TLS; daily backups tested by restoring them; continuous monitoring; and an independent security test before each brokerage goes live.

5.2

Lacspace may improve these measures over time but will not reduce their overall level of protection during the term.

06Sub-processors

6.1

The Client authorises Lacspace to use infrastructure and service providers ("sub-processors") to deliver LSNEP, such as cloud hosting, messaging and notification services.

6.2

Lacspace will bind each sub-processor to data-protection terms no less protective than this DPA, remain responsible for its sub-processors, provide the current list on request, and give the Client notice before adding or replacing a sub-processor so the Client can raise a reasonable objection.

07Personal data incidents

7.1

Important

If Lacspace becomes aware of a breach of security affecting the Client's personal data, it will notify the Client without undue delay, keep it updated until the incident is resolved, and provide a written incident report describing what happened, the data affected and the measures taken.

7.2

Lacspace will cooperate with the Client so the Client can meet any duty to notify regulators or affected individuals.

08Assistance to the Client

8.1

Lacspace will help the Client, taking into account the nature of the processing, to:

respond to requests from individuals to access, correct or delete their data;
meet its security, record-keeping and incident obligations; and
respond to inspections, IT audits or information requests from SEBON, NEPSE, CDSC or other competent authorities, by providing relevant logs, records and documentation about LSNEP.

09Audits and information

9.1

Lacspace will make available the information reasonably needed to show compliance with this DPA, including security documentation and the results of security tests. The Client, or an auditor it appoints under confidentiality, may carry out a reasonable audit on prior written notice, during business hours and without disrupting other clients.

10Location and transfers

10.1

Data may be processed by Lacspace and its sub-processors in the countries where their infrastructure operates. Lacspace will apply appropriate safeguards to any such processing, and will comply with any data-location requirement that applies to the Client under Nepali law where the Client tells Lacspace about it.

11Retention, export and deletion

11.1

The Client decides how long its records are kept, including any period required by securities regulation. Lacspace keeps the data for as long as the Client's configuration and the client agreement require.

11.2

Important

At the end of the agreement, or earlier on request, Lacspace will give the Client a full export of its data in a usable format and then delete it from LSNEP, including from backups as they expire, unless the law requires Lacspace to keep it.

12Liability and precedence

12.1

Each party's liability under this DPA is subject to the limits in the client agreement, except where the law does not allow a limit.

12.2

If this DPA conflicts with the client agreement on data protection, this DPA prevails.

13Contact

13.1

Data-protection questions and requests: compliance@lacspace.com. Your named rollout contact can also route any request.

Document control

Data Processing Agreement · v1.0 · effective 2 November 2026 · ref. LSNEP-LEGAL-DATA-PROCESSING-AGREEMENT-V1.0

Published by Lacspace Corporation Private Limited, Reg. No. 377566/82/83, PAN 622468837. The version on this page is the current, authoritative text.

Download PDF