Data processing agreement

1. Parties and scope

This agreement ("DPA") is between the customer that accepted the Terms of service (the "controller") and Quietstack OÜ (registry code 17608504), Sepapaja tn 6, 15551 Tallinn, Estonia (the "processor"). It forms part of the terms and applies automatically to personal data the processor processes on the controller's behalf when providing Lumdeck ("customer personal data"). Where the controller is itself a processor for its own client, the processor acts as its sub-processor and the controller passes on the instructions of its client.

This DPA applies where the customer is a controller or processor under data-protection law. Purely personal household use does not by itself make a customer a controller. Words such as "personal data", "processing", "data subject" and "personal data breach" have the meaning given in Regulation (EU) 2016/679 (GDPR).

2. Instructions

The processor processes customer personal data only on the controller's documented instructions. The terms, this DPA and the controller's use and configuration of Lumdeck (uploads, sharing, settings, API calls, deletions) are those instructions. The processor tells the controller if it believes an instruction infringes data protection law, and processes otherwise only where Union or Member State law requires it, telling the controller first unless that law forbids it.

3. Confidentiality

People authorised to process customer personal data are bound by confidentiality. Staff access customer content only to provide support the controller asked for, to handle a notice or security incident, or where the law requires it.

4. Security

The processor implements the technical and organisational measures in Annex II, taking into account the state of the art, costs and the risks of the processing (Article 32 GDPR). It may update the measures if the overall level of protection does not decrease.

5. Sub-processors

• The controller gives general authorisation to engage the sub-processors listed on the sub-processors page (Annex III).
• The processor gives at least 30 days' notice of a new or replaced sub-processor by e-mail to workspace owners and on that page. The controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the controller may end the affected service and receive a refund of prepaid fees for the unused period.
• The processor imposes data protection obligations on each sub-processor that are at least as protective as this DPA and remains liable for their performance.

6. Assistance

• The processor helps the controller respond to data subject requests, mainly through Lumdeck's own tools (download, deletion, sharing controls), and forwards requests it receives directly without answering them unless authorised.
• The processor provides information the controller reasonably needs for security assessments, data protection impact assessments and consultations with supervisory authorities (Articles 32 to 36 GDPR).

7. Personal data breaches

The processor notifies the controller without undue delay, and in any case within 48 hours after becoming aware of a personal data breach affecting customer personal data. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken or proposed. Information that is not yet available follows as soon as it is. Notification is not an admission of fault.

8. Deletion and return

The controller can download its presentations at any time. When a presentation, workspace or account is deleted, the processor deletes the related customer personal data, unless the law requires it to keep it; deleted decks remain in the trash for 30 days unless deleted from there. After the contract ends, the processor deletes remaining customer personal data within 60 days. Backup copies expire within 30 days.

9. Information and audits

The processor makes available the information necessary to demonstrate compliance with Article 28 GDPR, primarily by answering written questions and providing this DPA, the security description and its sub-processors' certifications. If that is not sufficient, or a supervisory authority requires it, the controller may audit with 30 days' notice, at its own cost, once per year, during business hours and under confidentiality, by itself or by an independent auditor that is not a competitor of the processor.

These scheduling and frequency arrangements do not restrict a supervisory authority, an applicable statutory or contractual transfer-safeguard audit right, or an additional urgent audit reasonably needed after a personal data breach or evidence of noncompliance. We cooperate without undue delay in those cases.

10. International transfers

Lumdeck does not offer an EU-only storage or processing guarantee. Cloudflare's global network and the providers listed in Annex III may process data outside the EEA.

For restricted transfers, we must establish a lawful basis, assess the transfer and use appropriate safeguards. Where Standard Contractual Clauses are required, the applicable modules, parties, processing details, security annexes and competent authority must be completed for the actual transfer. UK and Swiss requirements are assessed where applicable. This DPA does not declare every transfer covered by a blanket incorporation of one module.

The providers listed in Annex III incorporate data processing terms into their standard service agreements. Request the applicable provider and transfer record from office@kinesislab.ai before entrusting data subject to a particular residency or transfer requirement.

11. Liability and order of precedence

Liability under this DPA is subject to the limits in the terms, except where the GDPR or the Standard Contractual Clauses do not allow a limit. If this DPA conflicts with the terms, this DPA prevails for customer personal data; the Standard Contractual Clauses prevail over both. This DPA lasts as long as the processor processes customer personal data.

Annex I. Description of the processing

Annex II. Technical and organisational measures

• Encryption: TLS for every connection; data at rest encrypted by the hosting provider.
• Tenant isolation: every request is authorised against the workspace and the person's role; cross-workspace access is refused and covered by automated tests.
• Deck sandbox: uploaded decks are served from a separate origin without access to Lumdeck's cookies or API, under a restrictive content security policy, with short-lived signed viewing grants.
• Upload validation: file-type allow-list, size and archive limits, and rejection of dangerous constructs before publication.
• Authentication: passwords of at least 12 characters stored as salted hashes; verified e-mail required; optional Google sign-in; session expiry; rate limits on sign-in, sign-up and password reset; account blocking ends all sessions.
• Access by staff: a small number of named platform administrators; the console does not open decks; administrative actions are recorded in an audit log kept two years.
• Data minimisation: viewer statistics without cookies or stored IP addresses; security events with salted hashes; e-mail contents erased after 30 days.
• Resilience: managed database with point-in-time recovery; redundant object storage; deployments only through an automated pipeline that runs the test suite.
• Secure development: typed code, automated tests on every change, dependency scanning, pinned build actions, secrets kept out of the code repository.
• Incident handling: security event logging, a security digest for administrators and the breach procedure in section 7.
• Deletion: self-service deletion of decks, workspaces and accounts, with scheduled removal of stored files.

Annex III. Sub-processors

See the sub-processors page, which is part of this DPA.