Data Processing Addendum

1. Parties and how this addendum applies

This Data Processing Addendum (“DPA”) is between the customer that owns a FileMentra workspace (the “Customer”) and LUMI TECHOLOGY CORPORATION - FZCO (the “Processor” or “FileMentra”):

It forms part of the Terms of Service and applies whenever FileMentra processes personal data contained in Customer Content on the Customer’s behalf. It takes effect when the Customer accepts the Terms. A Customer that needs a countersigned copy can request one at [email protected]. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data; if it conflicts with the Standard Contractual Clauses, the Clauses prevail.

2. Definitions

“Data Protection Law” means all laws on the processing of personal data that apply to the processing, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the UAE Federal Decree-Law No. 45 of 2021, and the California Consumer Privacy Act. “Personal data”, “controller”, “processor”, “data subject”, “processing” and “personal data breach” have the meanings given in the GDPR. “Customer Personal Data” means personal data in Customer Content.

3. Roles and instructions

The Customer is the controller of Customer Personal Data, or a processor acting for its own client, and FileMentra is its processor or subprocessor. FileMentra processes Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use and configuration of the Service are the Customer’s complete instructions. FileMentra will tell the Customer if it believes an instruction infringes Data Protection Law, and may process data otherwise only where the law requires it, in which case it will tell the Customer first unless the law forbids that.

The Customer is responsible for having a lawful basis for the processing, for giving data subjects the information the law requires, and for the accuracy of the data it uploads. Where the California Consumer Privacy Act applies, FileMentra is a service provider and will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship with the Customer, or combine it with other data except as the law permits.

4. Confidentiality

FileMentra ensures that everyone authorised to process Customer Personal Data is bound by a duty of confidentiality, and that staff access it only where needed to provide support the Customer asked for, to handle a security incident or abuse report, or to comply with the law. Staff access to customer workspaces is logged.

5. Security

FileMentra implements and maintains the technical and organisational measures described in Annex II. It may update them over time, provided the overall level of protection is not reduced.

6. Subprocessors

The Customer gives general authorisation for FileMentra to engage the subprocessors listed on the Subprocessors page. FileMentra imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible to the Customer for its subprocessors’ performance. FileMentra will give at least 30 days’ notice of a new subprocessor. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected service and receive a refund of prepaid fees for the remainder of the term.

7. Assistance with data subject requests

Taking into account the nature of the processing, FileMentra gives the Customer tools in the Service to access, correct, export and delete Customer Personal Data. If FileMentra receives a request from a data subject about Customer Personal Data, it will pass it to the Customer without undue delay and will not answer it itself except to direct the person to the Customer. FileMentra will provide reasonable further assistance where the tools are not enough.

8. Personal data breaches

FileMentra will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences and the measures taken or proposed. FileMentra will take reasonable steps to contain and remedy the breach and will provide updates as more information becomes available. Notifying the Customer is not an admission of fault.

9. Impact assessments and consultations

FileMentra will provide reasonable information and assistance the Customer needs to carry out data protection impact assessments and prior consultations with supervisory authorities relating to the Service.

10. Return and deletion

The Customer can export or delete Customer Content at any time during the term. When a workspace is deleted, it can be restored for 30 days, after which FileMentra deletes the Customer Personal Data from its active systems, and from backups as they rotate, unless the law requires it to be kept or a legal hold applies. On request, FileMentra will confirm the deletion in writing.

11. Audits

FileMentra will make available the information reasonably necessary to demonstrate compliance with this DPA, including its security documentation and, once available, independent audit reports. Where that information is not enough, or a supervisory authority requires it, the Customer may carry out an audit once a year, at its own cost, with at least 30 days’ notice, during business hours, in a way that does not disrupt the Service or compromise other customers’ data, and under a confidentiality agreement.

12. International transfers

Customer Content is stored in the European Union. Where FileMentra, which is established in the United Arab Emirates, or a subprocessor processes Customer Personal Data from outside the European Economic Area, the United Kingdom or Switzerland in a country without an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference, as follows:

• Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where it is a processor;
• Clause 7 (docking clause) applies;
• Clause 9: option 2 (general written authorisation), with the notice period in section 6 of this DPA;
• Clause 11: the optional language does not apply;
• Clauses 17 and 18: the law and courts of Ireland, unless the Customer is established in another EU member state, in which case that member state;
• Annexes I and II: as set out below; Annex III: the Subprocessors page.

For transfers subject to UK law, the International Data Transfer Addendum issued by the UK Information Commissioner applies, completed with the information in this DPA. For transfers subject to Swiss law, references to the GDPR are read as references to the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner is the competent authority.

13. Liability and term

Each party’s liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the Standard Contractual Clauses do not allow this. This DPA lasts as long as FileMentra processes Customer Personal Data.

Annex I: Description of the processing

Annex II: Technical and organisational measures

• Encryption: TLS for all traffic; files encrypted at rest by the storage provider (AES-256); sensitive fields additionally encrypted at the application level with keys held in a dedicated key management service.
• Isolation: every workspace separated from every other by row-level security enforced in the database, not only in application code.
• Access control: role-based permissions, least privilege, optional mandatory two-factor sign-in and single sign-on per workspace, step-up verification for sensitive actions, short session lifetimes.
• Staff access: a separate staff console with its own accounts, mandatory two-factor authentication, role-based permissions, two-person approval for destructive actions, and an audit trail of every staff action.
• Threat protection: every upload quarantined and scanned for malware on an isolated server before it becomes available; rate limiting; blocking of abusive networks.
• Logging: a tamper-evident, append-only audit log for each workspace; hash-chained evidence for signatures and data-room access.
• Resilience: managed database with automated backups and point-in-time recovery; monitoring and alerting; tested restore procedures.
• Data minimisation: IP addresses and browser details stored as one-way digests wherever the full value is not needed; secrets never placed in URLs.
• Secure development: code review, automated security regression tests that attack isolation and access boundaries, dependency and secret scanning.
• Incident response: documented procedures for detecting, containing, notifying and learning from security incidents.
• Deletion: controlled deletion with a recovery window, followed by permanent erasure, with legal hold support.