Data Processing Agreement
Dated 30.10.2026
1. Subject, duration and details of processing
1.1 This DPA governs the processing of personal data by LUMESO FlexCo ("LUMESO", processor) on behalf of the Customer (controller) in connection with the Product under the Order Form and the GTC. Capitalized terms have the meaning given in the GTC. The Customer is LUMESO's sole contracting party and point of contact, also where it grants access to persons of its Affiliates or of third parties. Where those are separate controllers, the Customer concludes this DPA and gives all instructions on their behalf and confirms that it holds their authority to do so.
1.2 Duration: the term of the Order Form plus the 30-day download period under GTC clause 13.4, until all personal data, including copies in backups under clause 9.2, is deleted or returned.
Detail
Description
Nature and purpose
Hosting, extraction, structuring and transfer of order data to the Customer's ERP; support and maintenance; security and abuse monitoring; creation of Anonymized Data under clause 2.4
Categories of data
User data (names, business email addresses, login data), contact data of the Customer's business partners contained in orders, quotations and correspondence, master data, order data, quotation data, production data, and the contents of emails and attachments submitted to the Product, which may incidentally contain other personal data
Categories of data subjects
Employees of the Customer and its Affiliates; employees and contacts of the Customer's customers and suppliers
Special categories
None intended; the Customer shall not submit special-category data
2. Instructions
2.1 LUMESO processes personal data only on the Customer's documented instructions, including with regard to transfers to third countries, unless required by EU or Member State law; in that case LUMESO informs the Customer before processing, where the law permits.
2.2 The Order Form, the GTC, this DPA and the Customer's use of the Product's configuration options constitute the Customer's instructions. Further instructions must be in writing (email suffices) and may entail additional fees where they exceed the agreed scope.
2.3 The Customer permits LUMESO to let authorized LUMESO personnel bound by confidentiality review individual inputs and outputs where this is needed to resolve errors, extend input-format coverage or keep the Product functioning. This is a documented instruction within the meaning of clause 2.1.
2.4 The Customer instructs LUMESO to anonymize Customer Data for the purposes of GTC clause 5.2 by irreversibly removing everything that could identify a natural person, the Customer or its business partners, taking into account the risk of re-identification; data that LUMESO could still attribute to a person remain personal data. LUMESO documents its anonymization procedure. Once anonymized, the data is no longer personal data and is outside this DPA.
2.5 LUMESO informs the Customer without undue delay if it considers that an instruction infringes data protection law. LUMESO may suspend performance of that instruction until the Customer changes it or shows that it is lawful.
2.6 LUMESO does not use personal data processed on behalf of the Customer to train or fine-tune generative artificial-intelligence models, and does not make Customer Data accessible to any other tenant.
3. Personnel
LUMESO ensures that persons authorized to process personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, have received appropriate data protection training and access only the data they need for their tasks.
4. Security of processing
4.1 LUMESO implements the technical and organizational measures described in Annex 1, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing as well as the risks for data subjects (Art. 32 GDPR).
4.2 LUMESO reviews the effectiveness of the measures regularly and may update them, provided the level of protection is not reduced. The current edition of Annex 1 is available from LUMESO on request.
5. Sub-processors
5.1 The Customer grants LUMESO general authorization under Art. 28 (2) GDPR to engage sub-processors. The current sub-processors, their purpose, processing location and transfer basis are listed at [https://lumeso.com/legal/sub-processors] (the "Sub-processor List"). The Sub-processor List as published at the Effective Date forms part of this DPA.
5.2 LUMESO informs the Customer in writing at least 30 days before adding or replacing a sub-processor. The Customer may object in writing within 14 days of the notice on reasonable data protection grounds. The Parties then negotiate in good faith for 14 days. If no solution is found, the Customer may terminate the Order Form in writing at the end of the current calendar month, with a pro rata refund of any prepaid fees; this is the Customer's sole remedy, and LUMESO may use the sub-processor for other customers. LUMESO does not use the new sub-processor for the objecting Customer's Tenant until the objection is withdrawn or the termination takes effect.
5.3 Where the Parties agree in writing to exclude a sub-processor for the Customer, it is not used for that Customer's Tenant. Where an excluded sub-processor provides functionality to the Product, the Sub-processor List states which functionality is affected.
5.4 LUMESO engages only sub-processors that are bound by a written data processing agreement meeting Art. 28 (4) GDPR, in particular on security, confidentiality and transfers. Providers of generative artificial-intelligence services are used only under terms that exclude training on personal data and limit retention to what the provider needs to perform the processing and to monitor for abuse. LUMESO's goal is zero data retention at every such provider and it works towards that configuration with each of them.
5.5 LUMESO remains fully liable to the Customer for the performance of its sub-processors' obligations.
6. International transfers
6.1 Customer Data is stored at rest within the EEA.
6.2 LUMESO transfers personal data to a country outside the EEA only to sub-processors identified in the Sub-processor List as processing outside the EEA, and only on the basis of an adequacy decision, the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914) with a transfer impact assessment, or another transfer tool under Art. 46 GDPR, as stated for that sub-processor in the Sub-processor List.
6.3 Where the Product uses generative artificial-intelligence services, LUMESO uses EEA-hosted endpoints where the provider offers them. Where only non-EEA endpoints exist, the transfer takes place on the basis identified in the Sub-processor List.
7. Assistance to the Customer
7.1 LUMESO assists the Customer with appropriate technical and organizational measures in responding to data subject requests under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection). If a data subject contacts LUMESO directly, LUMESO forwards the request to the Customer without undue delay and does not respond on the merits unless instructed.
7.2 LUMESO assists the Customer in complying with Art. 32 to 36 GDPR (security, breach notification, data protection impact assessments, prior consultation), taking into account the nature of the processing and the information available to LUMESO.
7.3 LUMESO notifies the Customer of a personal data breach affecting Customer Data without undue delay and in any event within 72 hours of becoming aware of it, providing the information the Customer needs under Art. 33 (3) GDPR. Where not all information is available at that time, LUMESO provides it in phases without undue further delay. LUMESO does not inform data subjects or authorities about a breach of Customer Data unless required by law or instructed by the Customer.
7.4 Assistance beyond what is reasonably expected in the ordinary course of the Product may be charged at LUMESO's then-current rates after prior notice.
8. Audits
8.1 LUMESO makes available all information necessary to demonstrate compliance with Art. 28 GDPR, in the first place through its documentation of technical and organizational measures, current certifications or third-party audit reports where available, and written answers to reasonable questionnaires once per year.
8.2 Where this information is not sufficient to demonstrate compliance, or where a supervisory authority requires it or a personal data breach has occurred, the Customer or an independent auditor bound by confidentiality may audit LUMESO's relevant premises and systems once per contract year, with at least 30 days' written notice, during business hours, without disrupting operations, and accompanied by a LUMESO representative. Audits do not extend to data of other customers or to security-sensitive configurations. Each Party bears its own costs; LUMESO may charge reasonable costs for audits exceeding two person-days.
9. Deletion and return
9.1 After the end of the Order Form, LUMESO makes the Customer Data available for download in a common machine-readable format (e.g. CSV) for 30 days without a separate request. At any time before the end of that period the Customer may instead instruct LUMESO in writing to return the personal data in that format or to delete it earlier; LUMESO follows the instruction.
9.2 After that period LUMESO deletes all personal data processed on behalf of the Customer, including backups within the backup rotation cycle of at most [90] days, unless EU or Member State law requires retention. Anonymized Data under clause 2.4 is not personal data and is not covered by this deletion. LUMESO confirms deletion in writing on request.
10. Requests from authorities
If an authority requests access to Customer Data, LUMESO informs the Customer before disclosing anything, where legally permissible, refers the authority to the Customer, discloses only what is legally required and challenges requests that appear unlawful.
11. Liability
The liability of the Parties under this DPA is governed by GTC clause 12. Art. 82 GDPR remains unaffected.
12. Records and precedence
12.1 LUMESO maintains a record of processing activities under Art. 30 (2) GDPR.
12.2 In case of conflict, this DPA prevails over the GTC on data protection matters. The Order Form may deviate from this DPA only where data protection law permits. Mandatory data protection law prevails over this DPA. GTC clause 17 (governing law and disputes) applies.
Annex 1 — Technical and organizational measures
Measures at the Effective Date; the current edition is available from LUMESO on request.
Area
Measures
Hosting
Data centres of the cloud providers listed in the Sub-processor List, certified to ISO 27001 or equivalent; no Customer Data stored on LUMESO premises
Access control
Multi-factor authentication for LUMESO staff; role-based access on a need-to-know basis; access rights reviewed regularly and removed on offboarding
Tenant separation
Logical isolation per Tenant at application and database level
Encryption
Encryption in transit (TLS 1.2 or higher) and at rest, including backups
Logging and monitoring
Central logging and alerting via the monitoring tool in the Sub-processor List
Availability
Regular backups within the EEA; restore procedures tested; automated availability checks
Development
Code review, separate staging and production environments, no production data in development
AI service configuration
EEA endpoints where available; retention minimized, with zero data retention as the target for all AI providers; no training on Customer Data
Incident management
Documented incident response process; customer notification within 72 hours; post-incident review
Personnel
Confidentiality undertakings; data protection and security training
Sub-processor management
Data processing agreements with all sub-processors; regular review of certifications and transfer tools