Data processing agreement

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 as amended, and, where they apply to a customer's processing, the EU GDPR. "Customer Personal Data" means personal data within Customer Content that we process on the customer's behalf. "Customer Content" means the research requests, conversations, attachments, knowledge-base material, brand voices, edits and reports of a customer's workspaces. "controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "sub-processor" carry their meaning in Data Protection Law.

For Customer Personal Data the customer is the controller and Lumman Ltd is the processor. The customer decides what to research, what to submit, what to publish and to whom to send it, and confirms that it has a lawful basis for that processing and has given the notices its own data subjects are owed.

For account, billing, usage, audit and security data about the customer and its users, Lumman Ltd is a controller in its own right, and the Privacy Policy governs it. This agreement does not apply to that data.

We process Customer Personal Data only to provide the service under the Terms of Service, on the customer's documented instructions, and as the law requires. Using the platform - starting a run, storing knowledge-base material, publishing a report - is a documented instruction. Annex 1 records the subject matter, duration, nature and purpose of the processing.

We will tell the customer if an instruction appears to breach Data Protection Law, and we may suspend that processing until it is resolved. Where the law requires us to process beyond the instructions we will tell the customer first, unless the law forbids it.

Access to Customer Personal Data is limited to people who need it to provide or support the service. Each is bound by confidentiality obligations that survive their engagement, and each is instructed to process the data only as this agreement permits.

We implement the technical and organisational measures in Annex 2, appropriate to the risk. Those measures may change as the service and the threat change, and we will not reduce the overall level of protection. We assess and test them as part of ordinary engineering change control.

The customer authorises the sub-processors listed at /sub-processors, which is Annex 3 to this agreement. Each is engaged under a written contract imposing data protection obligations no less protective than these, and we remain responsible for its performance.

We will give at least 30 days' notice before adding or replacing a sub-processor, by updating that page and telling account holders. A customer with a reasonable, data-protection-grounded objection may raise it within that period; if we cannot resolve it, the customer may terminate the affected part of the service and receive a refund of the unused portion of any prepaid period and any unspent balance.

We will assist the customer, so far as the platform allows and at the customer's cost where the work is substantial, with:

• responding to a data subject exercising a right - the customer can find, export, correct and delete Customer Content itself through the dashboard and the API, which is the fastest route;
• a data protection impact assessment and any consultation with a supervisory authority it leads to;
• demonstrating the customer's own compliance with Data Protection Law.

Where a data subject approaches us directly about Customer Personal Data, we will not answer on the customer's behalf; we will pass the request on without undue delay.

We will tell the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event in time for the customer to meet its own deadlines. The notice will describe what we know: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken or proposed. We will provide further information as the investigation progresses and cooperate with the customer's own notifications. A notice is not an admission of fault.

The customer can delete Customer Content at any time through the product, and deleting a workspace deletes its reports. On termination of the Terms of Service we delete Customer Personal Data, except where the law requires us to keep a record, in which case we keep only that record and protect it accordingly. Customer Content is available for export through the product until the account is deleted; export what is needed before terminating.

On reasonable written request, and no more than once a year unless a supervisory authority or a breach requires otherwise, we will provide the information reasonably needed to demonstrate compliance with this agreement. Where that is not enough, we will cooperate with an audit on reasonable notice, during business hours, under confidentiality, without disrupting the service or exposing another customer's data, and at the customer's cost.

Customer Personal Data is processed outside the United Kingdom, and reached from outside it, as Annex 3 records. Where a transfer is restricted under Data Protection Law we rely on an adequacy determination where one applies, and otherwise on the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, or the EU standard contractual clauses where EU law governs the transfer, with the data protection test and transfer risk assessment the law requires. The customer instructs us to make those transfers, and authorises us to enter into transfer terms with a sub-processor on the customer's behalf where that is the mechanism required.

This agreement runs for as long as we process Customer Personal Data. Each party's liability under it is subject to the limitations in the Terms of Service. Where this agreement conflicts with the Terms of Service on the processing of Customer Personal Data, this agreement prevails; where either conflicts with a mandatory requirement of Data Protection Law, the law prevails.

Access control and tenancy

• Every tenant table enforces row-level access in the database, so data is reachable only by members of the workspace that owns it. Tenancy is not enforced in application code alone.
• Privileged database credentials are server-side only and never reach a browser. Identity and audit tables are read-only to the application's privileged principal.
• Internal staff surfaces are role-gated and answer a non-staff request as if the page did not exist, so their existence is not disclosed.
• Access to production is least-privilege and granted by role, not by person.

Authentication

• Sign-in is a federated Google identity or a one-time link to a verified email address. No password is set, transmitted or stored, so there is no password to breach or reuse.
• API keys are high-entropy machine secrets, stored as an irreversible hash with a short recognisable prefix, displayed once, scoped, and revocable.
• Session claims are refreshed when a role or membership changes, so a revoked permission does not persist in a live session.

Encryption

• All traffic to the platform is over TLS. Internal calls to providers are over TLS.
• Data at rest in the database and in file storage is encrypted by the provider.
• Private storage buckets are not publicly readable, and archived page snapshots are keyed per workspace with no anonymous read path.

Application hardening

• A firewall and bot detection sit in front of the application; browser-facing writes pass the bot gate before doing work.
• Requests are rate-limited per address and per API key. Write operations that must not double-apply are idempotent.
• Outbound fetches made while collecting sources pass a guarded boundary that refuses internal addresses and unexpected redirects.
• Input crossing a trust boundary is schema-validated before use.

Logging and accountability

• An append-only audit log records compliance-relevant events, including role and permission changes, publication and withdrawal, and billing events, with the actor who performed them.
• Application and platform logs are retained by our providers for a bounded period and are not used to profile end users.

Resilience and change control

• Managed backups are taken by the database provider.
• Infrastructure is provider-managed and redundant at the platform level.
• Every change ships through peer review and an automated check suite. Schema changes are reviewed as migrations before they reach production.
• Development and test environments hold no production personal data.

Vendors and people

• Sub-processors are contracted, listed publicly with processing locations, and reviewed before engagement.
• Personnel are bound by confidentiality obligations, and access is removed when an engagement ends.

The current list, with what each does and where it processes, is published at /sub-processors and forms Annex 3 to this agreement. Clause 6 governs how it changes.

Lumman Ltd, 86-90 Paul Street, London, EC2A 4NE, United Kingdom. Registered in England and Wales, No. 15425759. in@deeperer.com.