Data processing agreement

In short: if you use Lumos for a business and upload documents containing other people's personal data (for example your clients' bank statements), you are the controller and we are your processor. This agreement sets out how we look after that data, as Article 28 of the UK GDPR requires. It forms part of our terms of service and applies automatically to business customers.

1. Parties and roles

This agreement is between you, the business customer (the "controller"), and [Company legal name] Ltd (the "processor"). It applies to personal data we process on your behalf when you use Lumos ("customer data"). It does not cover your own account details, which our privacy notice covers.

2. Details of the processing

Subject matter

Converting bank statements and other documents you upload into structured data for you, reading and organising handwritten notes you upload, and sending documents you choose to your signers for electronic signature.

Duration

Each document is processed only for the time it takes to convert it, normally seconds, for as long as you use Lumos. Documents sent for signing and their signing records are kept until deleted as set out in section 3.

Nature and purpose

Receiving documents over an encrypted connection, reading their text (with OCR for scanned statements, or an AI model for handwritten notes), extracting transactions or organising notes, and returning the results to you. For E-Signature: storing the document, emailing your signers, recording how they sign, and creating the signed document and signing certificate. No profiling or other use.

Types of personal data

Names, addresses, account numbers and sort codes, transaction details, payee and payer names, balances, contents of handwritten notes, signers' names, email addresses, IP addresses, device details, signatures and signing times, and any other information in the documents. Transactions may incidentally reveal special category data (for example health, religion or trade union membership).

Data subjects

Your clients, account holders, the people and organisations named in their transactions or documents, and the people you ask to sign documents.

3. Our obligations

We will:

process customer data only on your documented instructions, which are these terms and your use of Lumos, unless the law requires otherwise (in which case we will tell you first unless the law forbids it);
make sure anyone authorised to process customer data is bound by confidentiality;
take the security measures in section 5;
use sub-processors only as section 4 allows;
help you, taking into account what we process, respond to requests from people exercising their data protection rights, and handle data protection complaints;
help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO;
tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer data, with the information you need to meet your own obligations;
delete customer data when processing ends. Documents for conversion are not stored, so this happens automatically; temporary copies held by sub-processors are deleted within 24 hours (OCR) or 30 days (handwritten notes). Documents sent for signing and their records are deleted 12 months after completion, or 30 days after a request is declined, cancelled or expires, or sooner when you delete them;
make available the information you need to show compliance with Article 28, and allow audits as set out in section 6;
tell you straight away if we think an instruction from you breaks data protection law.

4. Sub-processors

You authorise us to use the following sub-processors. We have a written contract with each that gives customer data the same protection as this agreement.

Sub-processor

Purpose

Location

Vercel Inc.

Runs the statement reader and the signing service

London (UK)

Supabase Inc.

Stores documents sent for signing and their signing records

London (UK)

Microsoft (Azure AI Document Intelligence)

Reads scanned statement pages (OCR)

UK South (UK)

Anthropic PBC

Reads and organises handwritten notes

USA, under the UK International Data Transfer Addendum

Resend, Inc.

Sends signing requests, reminders and signed copies to your signers

USA, under the UK International Data Transfer Addendum

We will email you at least 30 days before adding or replacing a sub-processor of customer data. If you object on reasonable data protection grounds and we can't resolve it, you may end your subscription and we will refund any period paid for but not used.

5. Security measures

Encryption in transit (TLS) for all uploads, results and connections to sub-processors.
Documents for conversion are processed in memory and never written to disk, databases or logs.
Documents sent for signing are stored encrypted at rest in a private store that only our server can access. Signers reach them through links unique to each signer that stop working when the request closes.
Processing takes place in UK data centres, except as section 7 describes.
Access to production systems is limited to named staff and protected by multi-factor authentication.
Logs record technical events only, never document contents.
Software is kept up to date and security fixes applied promptly.
Card details are handled only by Stripe and never reach our systems.

6. Information and audits

We will answer reasonable written questions about our compliance. If that isn't enough, you may audit our compliance once a year, at your cost, with at least 30 days' notice, during business hours and under confidentiality. An audit may not give access to other customers' data.

7. International transfers

Customer data is processed in the UK, except handwritten notes, which Anthropic processes in the USA, and signers' names, email addresses and signed copies, which Resend handles in the USA to send emails. Those transfers are protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. We won't transfer customer data outside the UK without appropriate safeguards under UK data protection law.

8. Liability and term

The limits of liability in our terms of service apply to this agreement. This agreement lasts for as long as we process customer data for you. When Lumos CRM and Lumos Finance open, we will update this agreement to cover them before any customer data is processed in them.