LEGAL

Data Processing Agreement

Terms under which Lunxa processes personal data on behalf of business customers.

Version:: 0.9-draft
Last updated:: November 7, 2026

Draft — pending legal review. This document is a working draft and has not yet been approved by legal counsel. Bracketed items will be completed before final publication.

This DPA forms part of the agreement between the business customer ("Controller") and [Registered legal entity name — to be completed] ("Processor").

1. Roles

The Controller determines the purposes and means of processing Customer Content. Lunxa processes it only as Processor on documented instructions.

2. Instructions

The agreement, the Controller's configuration of the Services and its users' actions constitute the instructions. Lunxa will inform the Controller if an instruction appears to infringe data protection law.

3. Purpose and duration

Processing to provide, secure and support the Services for the term of the agreement plus the deletion period in section 12.

4. Confidentiality

Personnel with access are bound by confidentiality and access customer content only when necessary.

5. Security

Lunxa implements the measures in Annex B.

6. Subprocessors

The Controller authorises the subprocessors in Annex C. Lunxa will give at least 30 days' notice of new subprocessors; the Controller may object on reasonable grounds.

7. International transfers

Transfers outside the EEA rely on adequacy decisions or Standard Contractual Clauses.

8. Breach notification

Lunxa notifies the Controller without undue delay (and within 48 hours where feasible) after becoming aware of a personal data breach and cooperates in remediation.

9. Data subject requests

Lunxa provides tools (export, deletion) and reasonable assistance for requests.

10. Audits

Lunxa provides information necessary to demonstrate compliance and allows reasonable audits on 30 days' notice, once per year.

11. Liability

As set out in the main agreement.

12. Return and deletion

On termination Lunxa deletes Customer Content within 30 days, with backups expiring within a further 30 days, unless law requires retention.

13. Precedence

This DPA prevails over the main agreement for data protection matters.

Annex A — Processing details

Data subjects: the Controller's users, and people referenced in Customer Content.
Categories: account identifiers, workspace content (projects, tasks, documents, files, comments), AI conversations, usage logs.
Operations: storage, retrieval, indexing for search and AI retrieval, transmission to AI providers on request, backup, deletion.

Annex B — Technical and organisational measures

TLS encryption in transit; encryption at rest provided by infrastructure providers; Argon2id password hashing; TOTP MFA; AES-256-GCM encryption of stored secrets; role-based access with server-side workspace isolation; private object storage with short-lived presigned URLs; rate limiting; append-only audit logs; automated backups; incident response procedure.

Annex C — Subprocessors

See the Subprocessors page.