Data processing agreement

This is a translation for convenience. The German version is legally binding.

between
the customer (account holder as per registration) – hereinafter the "Controller" –

and
Luminant Mind e.U., owner Youns Murhidj, Johannagasse 29-35/14/5, 1050 Vienna, Austria, company register no. FN 665878h (Commercial Court of Vienna, Handelsgericht Wien), email office@luminantmind.com – hereinafter the "Processor" or "Lumeya" –

1. Subject Matter and Duration

1.1 Lumeya creates and hosts a website (customer website) for the Controller and provides a contact form, visitor statistics and an account with an overview (main contract: Lumeya's Terms of Use). In doing so, Lumeya processes personal data on behalf of the Controller.

1.2 This agreement applies for the duration of the main contract. It ends upon its termination and the deletion or return of the data pursuant to clause 10.

1.3 For Controllers based in Switzerland, this agreement also constitutes a data processing agreement under Art. 9 of the Swiss Federal Act on Data Protection (Datenschutzgesetz, DSG); references to the GDPR apply accordingly.

2. Nature and Purpose of the Processing, Types of Data, Data Subjects

Nature of the processing: Storing, displaying, making available to the Controller (account, export), counting, backing up, deleting; technical processing of images (re-encoding, removal of metadata).

Purpose: Operation of the customer website, receipt and display of enquiries via the contact form, spam detection, visitor statistics, data backup.

Categories of personal data:

• Contact form enquiries: name, email address or telephone number, message, where applicable desired appointment and selected service, time, spam score; plus excerpts thereof (name, contact details, beginning of the message), to the extent the Controller has enquiries displayed in the chat "Ask Lumeya".
• Content of the customer website, to the extent it contains personal data (e.g. name of the owner, staff photos, testimonials).
• Visitor statistics: When delivering a page, Lumeya briefly processes the requested address, the browser identifier, the previously visited page and the IP address truncated to the network (IPv4 /24, IPv6 /48; in working memory only, for about one hour at most) in order to count the page view. Only daily totals are stored (page views in total, per page, by rough origin and by device category mobile, tablet or computer; enquiries), no identifier per visitor.

Categories of data subjects: Visitors and prospects of the customer website; persons named or depicted on the customer website (owner, staff, customers of the Controller).

Not subject matter of this agreement: The logs of the web server and the operating system (including IP address, time, requested address and browser identifier of visitors) are kept by Lumeya for the entire platform, including the customer websites, as an independent controller in order to operate the platform securely and stably (Art. 6(1)(f) GDPR). Purpose, scope and retention period are set out in Lumeya's Privacy Policy (section 3); the Controller may refer to it in its own privacy policy.

Special categories (Art. 9 GDPR): not envisaged. The Controller ensures that the contact form does not request health data or other special categories, or takes its own precautions for this (e.g. in the case of medical practices).

3. Instructions

3.1 Lumeya processes the data only on documented instructions from the Controller. Instructions result from the main contract, this DPA and the settings in the account (e.g. deleting an enquiry, publishing or taking a website offline). The Controller issues further instructions in text form to office@luminantmind.com.

3.2 Lumeya informs the Controller without undue delay if, in Lumeya's opinion, an instruction infringes data protection law. Lumeya may suspend execution until the matter is clarified.

3.3 If Lumeya is required to process data under Union or Member State law, Lumeya will inform the Controller of this before the processing, unless the law prohibits this.

4. Obligations of Lumeya

4.1 Confidentiality: All persons who have access to the data are bound to confidentiality (also under Section 6 DSG). Currently only one person, the owner, has administrative access.

4.2 Security: Lumeya implements the technical and organisational measures set out in Annex 1 and keeps them in line with the state of the art (Art. 32 GDPR). Measures may be further developed provided the level of protection does not decrease.

4.3 Assistance with data subject rights: If a data subject contacts Lumeya, Lumeya forwards the request to the Controller without undue delay. Lumeya assists the Controller with functions in the account (display, export as JSON and CSV, deletion of individual enquiries, deletion of individual or all chats of "Ask Lumeya") and upon request. If the Controller has had an enquiry displayed in the chat "Ask Lumeya" or has handled it there and deletes the enquiry, Lumeya also replaces the answers and follow-up questions in the chat that mention it with a notice; what the Controller itself wrote in the chat remains until the Controller deletes the chat or its account.

4.4 Assistance under Arts. 32 to 36 GDPR: Lumeya assists the Controller with security, notification of personal data breaches, data protection impact assessment and consultation of the supervisory authority, to the extent the information is held by Lumeya.

4.5 Personal data breaches: Lumeya notifies the Controller of any personal data breach without undue delay, as a rule within 24 hours of becoming aware of it, at the email address stored in the account. The notification contains, to the extent known: nature of the breach, categories of data concerned and approximate number of data subjects, likely consequences, measures taken and proposed, contact point.

4.6 Evidence and audits: Lumeya makes available to the Controller the information necessary to demonstrate compliance (this DPA, Annex 1, list of sub-processors, and upon request evidence from the data centre operator). The Controller may carry out audits after giving reasonable notice (14 days), as a rule by written information; on-site audits are to be limited to what is necessary and take place during business hours. The Controller bears the costs of disproportionate audits.

4.7 Records: Lumeya maintains a record of processing activities pursuant to Art. 30(2) GDPR.

4.8 Place of processing: The processing takes place exclusively in the European Union (servers in Germany at Hetzner Online GmbH, administration from Austria).

5. Obligations of the Controller

5.1 The Controller is responsible for the lawfulness of the processing, in particular for informing visitors (privacy policy on the customer website, notice at the contact form) and for the legal basis.

5.2 The Controller keeps its email address in the account up to date so that notifications under clause 4.5 are received.

5.3 The Controller deletes enquiries it no longer needs itself in the account or instructs Lumeya to do so.

6. Sub-processors

6.1 The Controller authorises the sub-processors named in Annex 2.

6.2 Lumeya informs the Controller of intended changes (addition or replacement) by email at least 4 weeks in advance. The Controller may object within this period for an important data protection reason. In the event of an objection, either party may terminate the main contract effective upon the change taking effect if no amicable solution is found.

6.3 Lumeya contractually binds each sub-processor to the obligations of this agreement, in particular to security measures under Art. 32 GDPR, and remains responsible to the Controller for the sub-processor's performance of its obligations.

6.4 Ancillary services such as telecommunications, postal services, maintenance without access to data or disposal of data carriers do not constitute sub-processing.

7. Transfers to Third Countries

The commissioned data is not transferred to countries outside the EU or the EEA. Should this change, clause 6 and Art. 44 et seq. GDPR (adequacy decision or appropriate safeguards) apply.

8. Liability

Liability is governed by Art. 82 GDPR and the main contract. The liability provisions of the Terms of Use also apply to claims under this agreement, unless Art. 82 GDPR mandatorily provides otherwise.

9. Requests for Information from Third Parties

If authorities or third parties request information about the Controller's data, Lumeya informs the Controller without undue delay and refers them to the Controller, to the extent legally permissible. Lumeya discloses data only if there is a legal obligation to do so.

10. Deletion and Return after the End of the Contract

10.1 The Controller can export its data at any time during the term of the contract (content of the customer websites with all stored versions, blog posts, statistics as daily totals and enquiries as JSON, enquiries additionally as CSV; images retrievable individually). If only the subscription ends (e.g. through cancellation, withdrawal or with the end of the beta phase), the data remains stored until the Controller deletes its account; the customer website is then no longer publicly accessible.

10.2 If the main contract ends through deletion of the account, Lumeya immediately deletes all data processed on behalf of the Controller, that is, enquiries, content of the customer websites with all versions, images including image files, statistics and the chats of "Ask Lumeya". Data that Lumeya processes as an independent controller (e.g. the proof of deletion, server logs) is governed by Lumeya's Privacy Policy. If the main contract ends in another way, in particular through termination by Lumeya for good cause, Lumeya makes the data available for export upon request for a further 30 days and deletes it thereafter.

10.3 Individual data is not removed from backup copies prematurely; the copies expire completely: on the server after 14 days, in the encrypted secondary copy after 12 months at the latest. Lumeya's statutory retention obligations (e.g. invoices, 7 years under Section 132 Federal Fiscal Code (Bundesabgabenordnung, BAO)) remain unaffected; this data is blocked.

10.4 Upon request, Lumeya confirms the deletion in text form.

11. Final Provisions

11.1 Amendments to this agreement require text form. Lumeya may amend Annex 1 (TOMs) provided the level of protection does not decrease, and Annex 2 in accordance with clause 6.

11.2 In the event of conflicts between this agreement and the main contract, the provisions of this agreement prevail in data protection matters.

11.3 Austrian law applies. The place of jurisdiction for businesses is Vienna (Commercial Court of Vienna). For consumers, Section 14 Consumer Protection Act (Konsumentenschutzgesetz, KSchG) applies.

Concluded electronically by confirmation at registration (Art. 28(9) GDPR). The version valid at the time of conclusion is stored with checksum and timestamp. Version of 26 September 2026.

Annex 1 – Technical and Organisational Measures (TOMs) pursuant to Art. 32 GDPR

As of: 26 September 2026. The measures describe the operation of Lumeya on its own server at Hetzner Online GmbH (data centre in Germany).

1. Confidentiality

Physical access control (data centre): Operation in the data centre of Hetzner Online GmbH with access control, video surveillance and security staff; Hetzner is certified under ISO/IEC 27001.

System access control (systems):

• Server administration via SSH exclusively with a cryptographic key; password login and direct root login are disabled. Repeated failed attempts lead to an automatic block of the sender address.
• The firewall allows only SSH, HTTP and HTTPS from outside; the application itself is reachable only via the upstream web server.
• The administration area of the application is reachable only from a private, encrypted network (VPN); admin sessions expire after 12 hours.
• Customer accounts: passwords as Argon2id hash, minimum length 10 characters, blocking of known passwords; rate limiting per address and per account; log of login attempts for 30 days (IP address only as HMAC key).
• Session cookie with the attributes Secure, HttpOnly and SameSite=Lax; CSRF protection cookie with Secure and SameSite=Strict (readable by the platform's own script, contains no login secret). Session identifiers are stored in the database only as a hash. Customers can see their logged-in devices and log them out.

Data access control (data):

• Published customer websites are delivered per customer from a separate, isolated environment (sandbox with its own namespaces, without network access, with read access only to that customer's files). In the event of a fault in this environment, the application delivers the page directly.
• Tenant separation in the application: data is always queried with the customer's account identifier.
• Uploaded images are checked and re-encoded in a disposable sandbox without network access and without privileges, with time and memory limits; the original is not stored.
• Interventions by the operator in customer accounts (e.g. blocking, credit, deletion) as well as security-relevant account actions are logged.
• The application runs under its own system user without administrator rights. Secrets (keys, credentials) are stored only in configuration files with restricted permissions, not in the code.

Separation control: Development does not take place on the production server. The automated tests before each update run with a separate test database in a separate directory; test data is not real data.

Pseudonymisation and data minimisation: The access log of the web server (with IP addresses) is rotated daily and deleted after about 7 days at most; none is kept for customer websites under their own domain. The system log of the server is likewise deleted after about 7 days at most (details in Lumeya's Privacy Policy, section 3); application logs contain no IP addresses. In the dispatch records of emails, links with keys are made unrecognisable before storage. For login protection and rate limiting, the IP address is used only as an HMAC key. The statistics store only daily totals without an identifier per visitor; for this purpose the IP address is only truncated (IPv4 /24, IPv6 /48) and used only in working memory. Image metadata is removed upon upload. Email notifications of new enquiries contain no details of the person making the enquiry.

2. Integrity

Transfer control: All connections (visitor, customer and administration to the server) are encrypted with TLS (HTTPS enforced, HSTS). Emails are sent only over encrypted connections (STARTTLS or TLS). The secondary copy of the backup is encrypted before transfer.

Input control: Changes to customer websites are versioned (versions of the website with timestamp). Security-relevant actions are logged.

Software security: Automatic security updates of the operating system; regular updating of dependencies; Content Security Policy; protection against CSRF; validation of all inputs; rate limiting.

3. Availability and Resilience

• Daily backup of database and images; each database backup is checked for integrity when created. Retention on the server: 14 days.
• Encrypted secondary copy on separate storage at Hetzner (Storage Box) with 14 daily, 8 weekly and 12 monthly snapshots; the repository is checked monthly.
• Restoration from a backup is documented and possible with a single command.
• Self-check of the application every 5 minutes with automatic restart upon failure; rate limiting against overload.
• Updates are built in a separate directory and checked before switching over; switching over takes place, as a rule, with almost no interruption. A brief outage is possible (measurement 2026-09-27: upper limit 0.43 s). Switching back to the previous version is possible at any time.
• Data centre with redundant power supply and network connection (Hetzner).

4. Procedures for Regular Review

• Data protection management: This TOM catalogue is reviewed at least annually and upon material changes.
• Handling of security incidents: detection, containment, notification under clause 4.5, follow-up.
• Data protection by default: no cookies on customer websites, no external services when loading customer websites, suspected spam deleted after 30 days, retention periods are enforced automatically every six hours.
• Control of commissioned processing: sub-processors are vetted before deployment and contractually bound (Annex 2).

5. What Lumeya Does Not Do

No advertising, no tracking, no sale or sharing of data, no use of customer data to train AI models. The “Ask Lumeya” chat uses a language model from an external provider; if the controller has enquiries displayed there, these details may go to this provider. For the website texts, Lumeya uses a language model from an external provider; enquiries are not part of this.

Annex 2 – Authorised Sub-processors

Hetzner Online GmbH
Address: Industriestraße 25, 91710 Gunzenhausen, Germany
Service: Data centre, server hosting, storage for encrypted backup copies
Place of processing: EU (servers in Germany)
Safeguard: Data processing agreement under Art. 28 GDPR (Hetzner DPA)

The provider of the external language model in the “Ask Lumeya” chat receives enquiries that the controller has displayed there and is a sub-processor to that extent. Lumeya sends notifications of new enquiries via its email provider to the Controller's email address; they contain no details of the person making the enquiry. The email provider therefore processes no commissioned data.

Changes are communicated in accordance with clause 6. The current list is always available on this page.