Data Processing Agreement (DPA)

Parties

Data controller ("the Agency"): the agency that holds the Lumen account.

Data processor ("Lumen"): SCHWAB NICOLAS, contact contact@getlumen.lat.

1. Roles, subject matter and duration

The Agency is the controller of the personal data it loads into Lumen about its clients and team; Lumen processes it as processor, solely on the Agency's behalf. This DPA applies while Lumen provides the service and until the data is returned or deleted (clause 11).

2. Purpose and data processed

Purpose: providing the AI-engine visibility monitoring service the Agency has subscribed to (running prompts, calculating metrics, generating reports and recommendations).

Data: name, email and photo of the Agency's users; brand names, domains, competitors, locations and prompts of its clients; execution results; and data from integrations the Agency connects. Data subjects: the Agency's users and, possibly, contacts of its clients. The Agency must not upload sensitive data or data it does not need for the service.

3. Instructions

Lumen will process data only on the Agency's documented instructions, being this DPA, the Terms and the Agency's use of the service settings. If it believes an instruction infringes applicable law, it will inform the Agency. Lumen does not use the Agency's data to train AI models or for its own purposes other than providing the service, except for producing the aggregated, anonymized statistics and studies described in the Privacy Policy, which do not identify the Agency, its clients or their brands.

4. Confidentiality

Lumen ensures that the people authorized to process the data are bound by a duty of confidentiality.

5. Security measures

Lumen applies appropriate technical and organizational measures, described on the Security page, including:

• Encryption in transit (HTTPS/TLS) and encrypted storage.
• Integration credentials encrypted at the application level (AES-256-GCM).
• Authentication through Google OAuth 2.0 or an email sign-in link, and separation of data by account and client.
• Optional, disconnectable, read-only Google Search Console and GA4 connections.
• Team access restricted to authorized personnel, with a log of who and when, and two-factor authentication.

6. Subprocessors

The Agency gives general authorization to use the subprocessors listed on the Subprocessors page. Lumen will impose equivalent data protection obligations on them and remains liable to the Agency for their compliance.

Lumen will notify the Agency 30 days in advance by email of adding or replacing a subprocessor. Within that period the Agency may object on reasonable data protection grounds; if no agreement is reached, it may terminate the affected service.

7. International transfers

Data is hosted in the United States (Supabase, us-east-2 region, Ohio; Vercel, cle1 region, Cleveland), so it involves an international transfer from Argentina, Colombia or other countries. By accepting this DPA, the Agency expressly authorizes that transfer and declares that it has informed the data subjects of it where the applicable law requires.

8. Data subject rights

Lumen will assist the Agency, with reasonable technical measures and within timeframes that let it comply with the law, in responding to requests for access, rectification, deletion, objection and portability. If Lumen receives a request directly, it will refer it to the Agency.

9. Security incidents

Lumen will notify the Agency without undue delay, and within 72 hours of becoming aware, of any security breach affecting the Agency's personal data, stating its nature, the data affected, the measures taken and a contact point, and will assist the Agency in notifying authorities and data subjects where required.

10. Audit

Lumen will make available to the Agency the information reasonably necessary to demonstrate compliance with this DPA. Once a year, on prior notice, the Agency may request it; Lumen will provide it by answering a security questionnaire and supplying documentation on the measures described on the Security page.

11. Return and deletion

When the service ends, the Agency may export its data and Lumen will delete it within 30 days, unless the law requires keeping it. On request, Lumen will confirm deletion in writing.

12. Liability and governing law

Each party's liability is governed by the Terms of Service. This DPA is governed by the law of the Argentine Republic and is subject to the jurisdiction stated in the Terms.

Acceptance

This DPA forms part of the Terms of Service and applies to the Agency from the moment it accepts them when creating its account or using the service; no separate signature is needed. If the Agency needs a signed copy, it can request one at contact@getlumen.lat.