Data Processing Agreement
For when Lumen holds your customers’ data on your behalf — enquiries, orders, chat.
Last updated
This document is not finished: the business's legalName, address, jurisdiction, grievanceOfficer have not been filled in yet.
This applies when you publish a site with Lumen and your site collects information from your own customers: an enquiry form, a shop order, a conversation with the assistant.
For that data you are the controller — it is your customers’ information and you decide what happens to it — and Lumen is your processor, acting on your instructions. This sets out what that means. It forms part of the Terms of Service and applies automatically; you do not need to sign anything.
1.What is covered
- Enquiries submitted through a form on a site you published: the name, contact details and message your visitor typed.
- Shop orders: the customer’s name, phone number, email, delivery address and what they ordered.
- Conversations with a site assistant you set up.
- Page-view counts for your site, which carry no identifier.
2.What we will do
- Process this data only to provide the service, and only on your instructions. Using it for anything of our own would require your agreement, and we do not ask.
- Keep it confidential, and make sure anyone with access is under the same obligation.
- Apply the measures described in the Security Policy.
- Help you respond if one of your customers asks for their data, and help you meet your own obligations if something goes wrong.
- Tell you without undue delay if we become aware of a breach affecting your data.
- Delete it when you delete it, or when you close your account.
3.Sub-processors
We use the providers listed in the Privacy Policy — Supabase, Vercel, OpenAI, Razorpay and Google — and each is bound to terms no weaker than these. If we add or change one in a way that affects your data, we will say so in the product, and you may object by closing your account and exporting your site.
4.Your responsibilities
- Having a lawful basis for collecting what your site collects, and telling your visitors what you do with it — your own site needs its own privacy notice.
- Not putting special category data, payment card numbers or government identifiers into a Lumen form. The forms are not built for them and we do not want them.
- Responding to your own customers’ requests. We will help; we cannot answer for you.
5.Audits and duration
On reasonable written notice we will provide the information needed to show we are meeting these obligations. This agreement lasts as long as we hold data on your behalf and ends when that data is deleted.
6.Contact
socialsprouts1@gmail.com.
Something here unclear, or not matching what the product does? Tell us — a policy that does not describe the real thing is a bug.