Data Processing Addendum

1. Scope and roles

This DPA applies to Provider’s processing of Personal Data contained in Customer Data submitted to or generated by the Services under Customer’s instructions (for example account-configured jobs whose retrieved content includes personal data). Provider acts as processor (or “service provider” under applicable U.S. state laws); Customer acts as controller (or “business”).

This public page is the form of DPA offered for online acceptance with the Terms of Use / customer agreement. Execution may also occur by signed order form referencing this URL. Provider’s own account data processed as controller is covered by the Privacy Policy, not this DPA.

2. Customer instructions

Provider will process Personal Data only on documented instructions from Customer, including the Agreement, this DPA, API requests, and workspace configuration. Customer instructs Provider to process Personal Data to provide the Services. Customer is responsible for the lawfulness of its instructions and for notices/consents owed to data subjects.

Customer must not submit Restricted Data (government IDs, PHI subject to HIPAA, payment card PAN/CVC for storage, children’s data under 16, or special-category data) unless the parties have agreed in writing that the Services support it.

3. Security and incidents

Provider will implement appropriate technical and organisational measures designed to protect Personal Data, taking into account the nature of the Services. A high-level description appears on the Luni security page. Provider may update measures without materially decreasing overall protection.

Provider will notify Customer without undue delay after becoming aware of a personal-data breach affecting Personal Data, and will provide information reasonably available to assist Customer’s own notification duties. Customer remains responsible for notifying regulators and individuals when legally required.

Current measures include:

• TLS encryption for all traffic to the Site, API and authentication service.
• API keys stored only as SHA-256 hashes, with optional scopes and expiry.
• The production database accepts connections only from Provider’s private network and named administrator addresses.
• Nightly encrypted (AES-256) database backups to separate storage, kept for up to 12 months.
• Saved extraction results deleted automatically after seven days.
• Administrative access limited to Provider personnel using key-based authentication.

4. Assistance

Taking into account the nature of processing, Provider will provide reasonable assistance for data-subject requests, DPIAs, and consultations with supervisory authorities, to the extent Personal Data is in Provider’s control. Provider will redirect data subjects who contact Provider directly to Customer where appropriate.

5. Subprocessors

Customer authorises Provider to engage subprocessors to process Personal Data as needed to deliver the Services, under written terms no less protective than this DPA in relevant respects. Provider remains responsible for subprocessors’ performance.

Provider will give Customer notice of new subprocessors (for example by updating a published list and/or email) and a reasonable objection window on grounds relating to data protection. If the parties cannot resolve an objection, Customer may terminate the affected Services as its sole remedy.

Current subprocessors:

6. International transfers

Where Provider’s processing involves a restricted transfer from the UK, EEA, or Switzerland, the parties will rely on an adequacy decision or appropriate safeguards (including the EU SCCs and UK IDTA/Addendum as applicable). Module Two (controller→processor) or Module Three (processor→processor) applies according to the parties’ roles. Details of transfer mechanisms are available on request to hello@luni.gg.

Completed transfer annexes (parties, categories of data and data subjects, frequency and retention) are available on request for customers who need a signed copy.

7. Return and deletion

On termination of Services involving Personal Data, Provider will, within a commercially reasonable period and subject to technical feasibility and legal retention duties, delete or return Personal Data on Customer’s written election made within 30 days, then delete remaining copies except where law requires retention (in which case Provider will isolate and protect such data and process it only as required by that law).

8. Artificial intelligence

Provider will not use Personal Data to train, fine-tune, or improve generalised AI/ML models of Provider or third parties except (a) as reasonably necessary to provide the Services under Customer’s instructions, or (b) with Customer’s written authorisation.

9. Audits

Customer may audit Provider’s compliance with this DPA up to once per year (and additionally if required by Applicable Data Protection Laws), on reasonable notice, during business hours, without unreasonably disrupting operations. Provider may satisfy an audit request with recent independent security reports covering the relevant controls when available. Audits are at Customer’s expense; Customer will reimburse reasonable documented Provider costs.

10. Liability and order of precedence

Liability under this DPA is subject to the limitations in the Agreement, except where Applicable Data Protection Laws prohibit such limitation. If this DPA conflicts with the Agreement on data-protection subject matter, this DPA controls. Governing law matches the Agreement (England and Wales unless otherwise agreed in writing).

Notices under this DPA: hello@luni.gg, or by post to NeuroLeash Ltd, 124 City Road, London, EC1V 2NX, United Kingdom.