Data Processing Agreement

1. Scope and parties

This agreement forms part of the Terms of Service between Hellmai Ltd (company number 16412231), registered in England and Wales (“we”, the processor), and the customer (“you”, the controller). It applies to personal data contained in the content you submit to LumenFlow Cloud, and applies from first use of the service. For personal data we collect for our own purposes, such as account and billing records, we are the controller; see the Privacy Policy.

2. Subject matter, nature and duration

• Subject matter: operating the LumenFlow Cloud service for your workspaces.
• Nature and purpose: storing, retrieving, transmitting and analysing your content, running governed agent actions you configure, and recording evidence of those actions.
• Categories of data subjects: your users, and any individuals whose data you place in your workspaces.
• Categories of personal data: the content you submit, account identifiers, and the evidence and audit records produced by your use of the service.
• Duration: for as long as you use the service, plus the deletion period in section 9.

3. Our obligations

We will:

• process personal data only on your documented instructions, which are these terms and your configuration and use of the service, unless the law requires otherwise, in which case we tell you first where the law allows;
• ensure that people authorised to process the data are bound by confidentiality;
• apply the security measures in section 5;
• respect the conditions for sub-processors in section 6;
• help you respond to requests from individuals exercising their rights, and help you meet your obligations on security, breach notification, impact assessments and prior consultation, taking account of the nature of the processing;
• delete or return personal data as set out in section 9;
• give you the information needed to show compliance with Article 28 of the UK GDPR and the EU GDPR, and allow audits as set out in section 8;
• tell you if we believe an instruction infringes data protection law.

4. Your obligations

You confirm that you have a lawful basis to submit the content you place in LumenFlow, that your instructions comply with data protection law, and that you have given individuals the information the law requires. Do not submit protected health information (PHI) to LumenFlow: we do not currently offer a Business Associate Agreement.

5. Security

We maintain technical and organisational measures appropriate to the risk, including encryption at rest and in transit, workspace isolation at the database layer, access controls, audit logging and tamper-evident evidence records. The current measures are described on the Security page.

6. Sub-processors

You give us general written authorisation to use the sub-processors on the sub-processor register. We give 30 days’ notice before a new sub-processor receives your personal data. You may object on reasonable data-protection grounds by emailing privacy@lumenflow.cloud within that period; if we cannot reasonably accommodate the objection, you may end the affected service. We bind each sub-processor to data protection obligations no less protective than these, and we remain responsible for their performance.

7. International transfers

Production hosting is in the EU (Frankfurt). Where a sub-processor processes personal data outside the UK and the EEA, the transfer is covered by an adequacy decision or by the standard contractual clauses approved by the European Commission (Decision 2021/914) together with the UK International Data Transfer Addendum issued by the Information Commissioner, as shown against each sub-processor in the register. Between you and us, where a transfer of your personal data to us is a restricted transfer, the same clauses and addendum apply as incorporated by reference: module two (controller to processor), with the details in sections 2 and 5 as the annexes, and the register as the list of sub-processors.

8. Personal data breach and audit

We tell you without undue delay, and in any event within 72 hours of becoming aware, of a personal data breach affecting your personal data, with the information we have to help you meet your own notification duties. We make available the information needed to show compliance with this agreement and allow reasonable audits by you or an auditor you appoint, on reasonable notice, during business hours, no more than once a year unless a breach or a regulator requires otherwise, and subject to confidentiality. We may meet an audit request by providing current independent assurance reports or evidence exports where they answer the request.

9. Deletion and return

Retention follows your plan and your workspace settings. You can export your content before you end the service. After the service ends we delete your personal data within 30 days unless the law requires us to keep it, and we tell you what we keep and why on request.

10. Liability and precedence

Liability under this agreement is subject to the limits in the Terms of Service. If this agreement conflicts with the Terms of Service on the processing of personal data, this agreement applies; the standard contractual clauses prevail over both.

11. Contact

Questions about this agreement: privacy@lumenflow.cloud. You may complain to the Information Commissioner’s Office or to your own supervisory authority.