Data Processing Agreement

    Last updated: 3 October 2026 · Version 2026-10-03.2

    1. Parties and Scope

    This Data Processing Agreement ("DPA") forms part of, and is subject to, the Lumenbase Terms of Service (the "Agreement") between Cosmic Fantasy, LLC, a limited liability company registered in the State of Wyoming, USA, with its registered office at 30 N Gould St, Sheridan, WY 82801, USA, which operates Lumenbase ("Lumenbase", "we", "us", or the "Processor") and the customer organization (the "Customer", "you", or the "Controller") that operates a Lumenbase workspace. This DPA applies where, and to the extent that, Lumenbase processes Personal Data on behalf of the Customer in the course of providing the Service.

    This DPA covers all Personal Data that Lumenbase processes on the Customer's behalf in providing the Service ("Customer Personal Data"), whatever its source, including data entered, imported, or synced from connected services, and data collected through public pages and forms the Customer publishes ("Pages"). For Customer Personal Data, the Customer is the Controller and Lumenbase is the Processor. Services the Customer connects to its workspace are not Sub-processors of Lumenbase; the Customer's own terms with those providers govern them. Where Lumenbase processes Personal Data for its own purposes (for example account administration, billing, and securing the Service), it acts as an independent controller under its Privacy Policy.

    In the event of a conflict between this DPA and the Agreement with respect to the processing of Personal Data, this DPA prevails.

    2. Definitions

    Terms such as "Controller", "Processor", "Data Subject", "Personal Data", "Processing", "Sub-processor", "Supervisory Authority", and "Personal Data Breach" have the meanings given to them in applicable Data Protection Laws, including the EU General Data Protection Regulation 2016/679 ("GDPR") and the UK GDPR. "Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Data under the Agreement.

    3. Subject Matter and Duration

    The subject matter of the Processing is the provision of the Service to the Customer, including the collection, storage, and management of Customer Personal Data in the Customer's workspace. The duration of the Processing is the term of the Agreement, plus any additional period during which Lumenbase retains Personal Data as permitted or required under Section 13 (Return and Deletion) and applicable law.

    4. Nature and Purpose of Processing

    Lumenbase processes Customer Personal Data to provide the Service under the Agreement. This includes hosting, storing, organizing, retrieving, transmitting, and deleting it; syncing data from services the Customer connects; sending messages on the Customer's behalf; transcribing meetings, enriching records, and generating content with AI features when the Customer or its users request it; capturing registrations through the Customer's Pages; and otherwise following the Customer's documented instructions. Lumenbase does not sell Customer Personal Data or use it for its own marketing.

    5. Categories of Data Subjects and Personal Data

    Categories of Data Subjects

    • The Customer's contacts, leads, prospects, and customers, and people at the companies it stores in the workspace;
    • The Customer's employees and other users of the Service;
    • People who correspond with the Customer through synced email, calendar, and messaging accounts;
    • Participants in meetings the Customer records or transcribes;
    • People who register for, or submit information through, the Customer's Pages;
    • Any other individuals whose Personal Data the Customer chooses to store in the workspace.

    Categories of Personal Data

    • Identification and contact details, such as name, email address, telephone number, job title, and company;
    • Relationship and sales information, such as notes, tasks, activities, and deals;
    • Content of communications, such as email messages and attachments, calendar events, and chat messages;
    • Meeting recordings, transcripts, and summaries;
    • Documents and files the Customer uploads or creates;
    • Form responses and consent records from the Customer's Pages;
    • Technical data, such as IP addresses and timestamps.

    The Customer must not use the Service to process special categories of Personal Data (as defined in Article 9 GDPR) unless it has a lawful basis to do so and has informed Lumenbase in writing. The Customer is responsible for the lawfulness of the data it chooses to collect, store, or sync.

    6. Controller Obligations

    The Customer, as Controller, represents and warrants that:

    • It has a valid legal basis for the collection and Processing of Customer Personal Data and for instructing Lumenbase to process it;
    • It will give Data Subjects all required information and obtain any consents required by Data Protection Laws, including before collecting data through its Pages or recording a meeting;
    • Its instructions to Lumenbase regarding the Processing comply with Data Protection Laws;
    • It is responsible for the accuracy, quality, and legality of the Personal Data and the means by which it acquired the Personal Data.

    7. Processor Obligations

    Lumenbase, as Processor, will:

    • Process Personal Data only on the Customer's documented instructions, including as set out in the Agreement and this DPA, and as necessary to provide and secure the Service, unless required to do otherwise by applicable law (in which case Lumenbase will inform the Customer of that requirement before Processing, unless prohibited from doing so by law);
    • Ensure that personnel authorized to process Personal Data are bound by appropriate confidentiality obligations;
    • Implement and maintain the technical and organizational security measures described in Section 9;
    • Assist the Customer, taking into account the nature of the Processing, in fulfilling its obligations under Sections 8, 9, and 10;
    • Promptly inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.

    8. Data Subject Rights Assistance

    Taking into account the nature of the Processing, Lumenbase will assist the Customer by appropriate technical and organizational measures, insofar as this is possible, to respond to requests from Data Subjects to exercise their rights under Data Protection Laws (including rights of access, rectification, erasure, restriction, portability, and objection). The Service lets the Customer access, export, correct, and delete records in its workspace directly. If Lumenbase receives a request from a Data Subject relating to the Customer's data, Lumenbase will, where legally permitted, direct the Data Subject to the Customer and will not respond to the request itself except on the Customer's instructions.

    9. Security Measures

    Lumenbase implements and maintains appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, having regard to the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing. These measures include, as appropriate:

    • Encryption of Personal Data in transit and at rest;
    • Logical access controls, including role-based permissions and separation of each customer's data;
    • Authentication controls for the Service and administrative systems;
    • Logging, monitoring, and backup of production systems;
    • Measures to ensure the ongoing confidentiality, integrity, availability, and resilience of Processing systems;
    • Procedures for regularly testing and evaluating the effectiveness of these measures.

    10. Personal Data Breach Notification

    Lumenbase will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting the Customer's Personal Data. The notification will, to the extent known and reasonably available to Lumenbase, describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Lumenbase will provide reasonable cooperation and assistance to help the Customer meet its own breach-notification obligations to Supervisory Authorities and affected Data Subjects. A notification under this section is not an acknowledgement by Lumenbase of fault or liability.

    11. Sub-processors

    The Customer provides a general authorization for Lumenbase to engage Sub-processors to support the provision of the Service (for example, cloud hosting and database infrastructure, transactional email delivery, and payment processing). Lumenbase will impose data protection obligations on each Sub-processor that are no less protective than those set out in this DPA, and Lumenbase remains responsible for the performance of its Sub-processors' obligations.

    Lumenbase publishes its current Sub-processors, with each one's purpose and processing region, in its subprocessor list. Lumenbase will give the Customer reasonable advance notice before adding or replacing a Sub-processor, and the Customer may object on reasonable data-protection grounds. If the parties cannot agree on a resolution, the Customer may terminate the affected part of the Service.

    12. International Transfers

    Lumenbase and its Sub-processors may process Personal Data in countries other than the country in which the Customer or its Data Subjects are located. Where such Processing involves a transfer of Personal Data subject to GDPR or UK GDPR to a country that has not been recognized as providing an adequate level of protection, Lumenbase will ensure an appropriate transfer mechanism is in place, such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with any supplementary measures required to protect the Personal Data.

    13. Return and Deletion of Personal Data

    Upon termination or expiry of the Agreement, Lumenbase will, at the Customer's choice, delete or return the Personal Data processed on the Customer's behalf, and delete existing copies, unless applicable law requires continued storage. The Customer may also delete records and export its data at any time during the term. Backups containing Personal Data are deleted in line with Lumenbase's standard backup-retention cycle.

    14. Audit and Demonstration of Compliance

    Lumenbase will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer. Such audits will be conducted on reasonable prior written notice, no more than once per year (except where required by a Supervisory Authority or following a Personal Data Breach), during normal business hours, and subject to confidentiality obligations. Lumenbase may satisfy an audit request by providing relevant certifications, third-party audit reports, or security documentation where these reasonably address the Customer's request.

    15. Liability

    Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement. This DPA does not limit any rights a Data Subject may have under Data Protection Laws.

    16. Term and Changes

    This DPA takes effect on the date the Customer accepts it (including at workspace signup) or first uses the Service, whichever is earlier, and remains in effect for as long as Lumenbase processes Personal Data on the Customer's behalf. We may update this DPA to reflect changes in our Processing or in Data Protection Laws. We will tell the Customer about material changes by email or in the Service at least 30 days before they take effect, unless a change is required by law sooner. If the Customer does not agree to a change, it may cancel before the change takes effect. Continuing to use the Service after that date means the Customer accepts the updated DPA.

    17. Contact

    For questions about this DPA, or to make a request described above, contact legal@lumenbase.io.