Data Processing Agreement

This Data Processing Agreement (the "DPA") forms part of the Lumiday Terms of Service (the "Agreement") between LUMIDAY, SAS with a share capital of €56,000, 38 rue des Mathurins, 75008 Paris, France, RCS Paris 108 184 516 ("Lumiday"), and the customer that has accepted the Agreement (the "Customer"). It applies automatically, without signature, from the moment the Customer accepts the Agreement. A countersigned copy is available on request at {CONTACT_EMAIL}.

1. Definitions

• "Data Protection Laws" means Regulation (EU) 2016/679 (the "GDPR"), French Law No. 78-17 of 6 January 1978 (Loi Informatique et Libertés), and any other data protection law applicable to the processing of Customer Personal Data under the Agreement.
• "Customer Personal Data" means personal data processed by Lumiday on behalf of the Customer in the course of providing the Service. This includes personal data contained in Customer content, connected tools, repositories, databases and files.
• "Sub-processor" means any third party engaged by Lumiday to process Customer Personal Data.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• Terms such as "controller", "processor", "data subject", "processing" and "supervisory authority" have the meanings given in the GDPR.

2. Scope and roles of the parties

2.1 This DPA applies to the processing of Customer Personal Data by Lumiday as a processor on behalf of the Customer.

2.2 The Customer acts as controller, or as processor on behalf of its own customers; in the latter case, Lumiday acts as its sub-processor.

2.3 The subject matter, duration, nature and purpose of the processing, and the categories of data and data subjects, are described in Annex I.

2.4 This DPA does not apply to personal data that Lumiday processes as a controller, such as account, billing and website data. That data is governed by the Lumiday Privacy Policy.

3. Customer obligations

The Customer:

• is responsible for the lawfulness of the processing of Customer Personal Data, including having a valid legal basis and providing the required information to data subjects;
• warrants that its instructions comply with Data Protection Laws;
• is responsible for the tools it connects and the permissions it grants to the Service;
• shall not submit special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR), unless strictly necessary for its use of the Service and adequately protected.

4. Processing on documented instructions

4.1 Lumiday processes Customer Personal Data only on the Customer's documented instructions, unless required to do so by Union or Member State law. In that case, Lumiday informs the Customer of the legal requirement before processing, unless the law prohibits it.

4.2 The Agreement, this DPA and the Customer's use and configuration of the Service, including instructions given to the AI agents, constitute the Customer's complete documented instructions.

4.3 Lumiday shall immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.

4.4 Lumiday does not sell Customer Personal Data. Lumiday does not use it for its own purposes, including advertising or training artificial intelligence models.

5. Confidentiality

Lumiday ensures that persons authorised to process Customer Personal Data:

• have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• access only the data necessary for their tasks.

6. Security

6.1 Lumiday implements and maintains the technical and organisational measures described in Annex II. These measures ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR.

6.2 Lumiday may update these measures as technology evolves, provided that the overall level of security is not reduced.

7. Sub-processors

7.1 General authorisation. The Customer grants Lumiday a general authorisation to engage Sub-processors. The Sub-processors in place on the date of this DPA are listed in Annex III.

7.2 Changes. Lumiday will inform the Customer of any intended addition or replacement of a Sub-processor at least thirty (30) days in advance, by email or within the platform.

7.3 Objection. The Customer may object to the change on reasonable data protection grounds within that period. The parties will then discuss the objection in good faith. If no solution is found, the Customer may terminate the affected part of the Service without penalty before the change takes effect.

7.4 Flow-down. Lumiday imposes on each Sub-processor, by written contract, data protection obligations that provide at least the same level of protection as this DPA. Lumiday remains fully liable to the Customer for the performance of its Sub-processors' obligations.

7.5 Tools connected by the Customer. Third-party tools that the Customer chooses to connect to the Service, such as its Odoo instance, Gmail, Slack or GitHub repositories, are not Sub-processors of Lumiday. They are engaged directly by the Customer under its own agreements with them.

8. International transfers

8.1 Lumiday and its Sub-processors may process Customer Personal Data outside the European Economic Area only in compliance with Chapter V of the GDPR.

8.2 Such transfers rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified recipients, or on the Standard Contractual Clauses concluded with the recipient.

8.3 Where required, Lumiday carries out a transfer impact assessment and implements supplementary measures.

8.4 To the extent Lumiday itself transfers Customer Personal Data outside the EEA, the SCCs (Module Two: controller to processor, or Module Three: processor to processor, as applicable) are incorporated into this DPA by reference, with the following options:

• Clause 7 (docking clause) applies;
• under Clause 9, option 2 (general written authorisation) applies, with the notice period set out in section 7.2;
• the optional language in Clause 11 does not apply;
• under Clauses 17 and 18, the governing law is French law and the competent courts are the courts of Paris, France;
• Annexes I to III of the SCCs are completed by Annexes I to III of this DPA.

9. Personal Data Breach

9.1 Lumiday notifies the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

9.2 The notification describes, to the extent known:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• its likely consequences;
• the measures taken or proposed to address it and mitigate its effects;
• a contact point for further information.

Where all the information is not available at once, it may be provided in phases.

9.3 Lumiday takes all reasonable measures to contain the breach and mitigate its effects. It assists the Customer in meeting its own notification obligations to supervisory authorities and data subjects.

9.4 Notification of a breach is not an acknowledgement of fault or liability by Lumiday.

10. Assistance to the Customer

10.1 Data subject requests. Taking into account the nature of the processing, Lumiday assists the Customer through appropriate technical and organisational measures in responding to requests from data subjects exercising their rights. If Lumiday receives such a request directly, it forwards it to the Customer without undue delay and does not respond itself, unless authorised by the Customer.

10.2 Other assistance. Lumiday provides reasonable assistance to the Customer:

• with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to Lumiday;
• in responding to requests from supervisory authorities concerning the processing.

11. Return and deletion

11.1 Upon termination of the Agreement, or upon deletion of a project, workspace or account by the Customer, Lumiday deletes the corresponding Customer Personal Data within thirty (30) days, unless Union or Member State law requires its retention.

11.2 Before deletion, the Customer may export its content and Output as provided in the Terms of Service.

11.3 Residual copies in backups are overwritten within thirty (30) additional days and remain protected by this DPA until then.

11.4 Lumiday confirms deletion in writing on request.

12. Audits

12.1 Lumiday makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR. This includes, where available, its security documentation and third-party certifications or audit reports.

12.2 If this information is insufficient, or if required by a supervisory authority, the Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, under the following conditions:

• no more than once a year, except following a Personal Data Breach;
• with at least thirty (30) days' prior written notice;
• during business hours and without disrupting Lumiday's operations;
• in a way that does not compromise the security or confidentiality of other customers' data.

12.3 Each party bears its own costs of the audit.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement, to the extent permitted by Data Protection Laws. Nothing in this DPA limits either party's liability towards data subjects under Article 82 GDPR.

14. Term and precedence

14.1 This DPA remains in force for as long as Lumiday processes Customer Personal Data on behalf of the Customer.

14.2 In the event of a conflict, the following order of precedence applies:

1. the SCCs, where applicable;
2. this DPA;
3. the Agreement.

15. Governing law and jurisdiction

This DPA is governed by French law. Any dispute relating to it falls within the exclusive jurisdiction of the competent courts of Paris, France.

Annex I — Description of the processing

Parties

• Data exporter / controller: the Customer, as identified in its Lumiday account. Contact: the account owner or workspace administrator.
• Data importer / processor: LUMIDAY, 38 rue des Mathurins, 75008 Paris, France. Contact: {CONTACT_EMAIL}.

Categories of data subjects

• Users of the Service authorised by the Customer: employees, contractors and consultants.
• People whose data is contained in the Customer's systems, files and connected tools. These include the Customer's clients, prospects, suppliers, employees, partners and their contacts.

Categories of personal data

• Identification and contact data: names, email addresses, telephone numbers, postal addresses, job titles, company names.
• Business and transactional data: orders, quotes, invoices, payments, contracts, tickets and communications, as stored in the Customer's ERP (Odoo) or connected tools.
• Content: content submitted to the Service, such as messages, instructions, files, uploaded databases and code.
• Technical data: user identifiers, logs and usage data relating to the Customer's use of the Service.
• Screen captures: screenshots and recordings of the interfaces being built, which may display any of the above.

Special categories of data

None intended. The Customer shall not submit special categories of data unless strictly necessary, in accordance with section 3.

Frequency of processing

Continuous, for the duration of the Agreement.

Nature of the processing

The processing consists of:

• collection through connected tools and uploads;
• hosting and storage;
• structuring and analysis, including by AI models;
• generation and modification of software, configurations and data;
• testing in isolated environments;
• transmission to the repositories and environments designated by the Customer;
• deletion.

Purpose of the processing

Providing the Service under the Agreement: creating, connecting, modifying, testing and deploying the Customer's business software at the Customer's request, and the related support, security and maintenance.

Duration and retention

For the duration of the Agreement, then deletion in accordance with section 11.

Annex II — Technical and organisational security measures

1. Encryption.
   • Data in transit is encrypted with TLS 1.2 or higher.
   • Data at rest is encrypted, including databases, file storage, backups, access credentials and OAuth tokens for connected tools.
2. Access control.
   • Every access to the platform and its services is authenticated.
   • Role-based permissions apply within workspaces.
   • Connector tokens are made available only to the environment of the project for which they were granted.
   • Access to the Customer's ERP is limited to the rights of the connected user and is read-only, unless the Customer expressly authorises a change.
3. Isolation. Each project runs in a dedicated, isolated execution environment, with its own credentials and storage, logically separated from other customers.
4. Staff access.
   • Access is granted on a least-privilege and need-to-know basis.
   • Multi-factor authentication is required on administrative and infrastructure accounts.
   • Access is logged and reviewed periodically.
   • Access is revoked promptly when no longer needed.
5. Confidentiality. All staff and contractors with access to Customer Personal Data are bound by confidentiality obligations and receive data protection awareness training.
6. Secure development.
   • Code review and automated tests are performed before release.
   • Secrets are managed outside source code.
   • Dependencies are updated regularly and vulnerabilities are managed.
7. Availability and resilience. Customer data is hosted with providers holding recognised certifications (such as ISO 27001 or SOC 2), with regular backups and documented restoration procedures.
8. Logging and monitoring. Security-relevant events are logged and monitored; logs are retained for 12 months.
9. Incident management. A documented incident response procedure covers detection, containment, assessment, notification within the time limits of section 9, and post-incident review.
10. Sub-processor management. Sub-processors are assessed before engagement and bound by written data protection obligations.
11. Data minimisation and deletion.
    • Only the data necessary for each request is transmitted to AI models.
    • Data is deleted according to the retention periods of the Privacy Policy and section 11.
12. AI providers. AI model providers process data under commercial terms that prohibit its use for training their models.

Annex III — Authorised Sub-processors

Transfers to Sub-processors located in the United States are governed by section 8.