Data Processing Addendum

1. Who this is between

This Data Processing Addendum (“DPA”) is between Lumenus LLC, doing business as Lumen Global Sourcing (“we”, “us”, the processor), and the company that has an account with us (“you”, the controller). It forms part of our Terms of Service (the “Terms”) and applies automatically while you use the service. You do not need to sign anything for it to apply; if you need a countersigned copy, email hello@lumenglobalsourcing.com.

Where US state privacy laws apply, “controller” also means “business” and “processor” also means “service provider” or “processor” as those laws define them. Words such as “personal data”, “processing” and “data subject” have the meanings given by the data protection law that applies, including the EU and UK GDPR, Canada’s PIPEDA and US state privacy laws (“data protection law”).

2. What we process, and why

• Subject matter and purpose: providing the Lumen Global Sourcing service to you: reading the documents you upload or forward, letting your team review and approve what was read, creating the records you ask for (shipments, purchase orders, tracking links, charges, carrier bill checks, broker packs), sending the emails you approve, and supporting and securing the service.
• Duration: for as long as you use the service, and then until the data is deleted under section 10.
• Types of personal data: what your documents and records contain, usually names, job titles, business email addresses, phone numbers and postal addresses of contacts at shippers, consignees, suppliers, carriers, brokers and clients, plus the names and email addresses of your own users.
• Data subjects: your users, and the people at your clients, suppliers, carriers, brokers and other business contacts who appear in your documents.
• Sensitive data: the service is not built for special categories of personal data, government identification numbers or payment card numbers, and you agree not to submit them unless a document you must process happens to contain them.

Personal data about the people who sign up for and pay for the service, and about visitors to our website, is ours as controller and is covered by our Privacy Policy, not by this DPA.

3. Your instructions

We process personal data only on your documented instructions. The Terms, this DPA and the way you configure and use the service are your instructions. If we are required by law to process it some other way, we will tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we will tell you and may decline to follow it.

We do not sell your personal data or share it for cross-context behavioral advertising. We do not keep, use or disclose it outside our direct business relationship with you, and we do not combine it with personal data from other sources except as the service needs to work for you. We do not use your documents to train AI models.

4. Confidentiality

Everyone at Lumenus LLC who can access your personal data is bound by a duty of confidentiality, and gets access only as far as they need it to run, support or secure the service.

5. Security

We keep technical and organizational measures in place that are appropriate to the risk. Today they include:

• HTTPS on every page, upload, API call and tracking link, with HSTS;
• each company’s data kept separate, with every request checked against the company it belongs to;
• role-based access inside each account, and passwords stored only as hashes;
• our administration panel restricted to approved network addresses and two-factor sign-in;
• nothing created from a document until a person on your team approves it, and every approval recorded in an audit log;
• daily database backups, with restores tested, kept for 14 days;
• monitoring that checks the service every fifteen minutes and alerts us when it fails.

We may change these measures over time, but we will not reduce the overall level of protection. You are responsible for the security of your own accounts, including keeping login details safe and choosing who on your team has access.

6. Sub-processors

You authorize us to use the sub-processors below. Each one is bound by a written contract that protects personal data at least as well as this DPA does, and we remain responsible to you for what they do.

Before we add or replace a sub-processor that will handle your personal data, we will update this list and email your account administrators at least 30 days in advance. If you object on reasonable data protection grounds, tell us within that time and we will work with you in good faith on an alternative; if there is none, you may end the affected part of the service and we will refund any fees you prepaid for it.

7. Helping you with requests and assessments

If a person asks us directly to access, correct or delete their personal data in your documents, we will pass the request to you and not answer it ourselves unless you ask us to. Taking into account what the service does, we will help you respond to such requests, and give you the information you reasonably need for a data protection impact assessment or a consultation with a regulator.

8. Personal data breaches

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to your personal data, we will tell you without undue delay, and within 72 hours. We will say what we know about what happened, the data and people affected, the likely consequences and what we are doing about it, and keep you updated as we learn more. Telling you is not an admission of fault.

9. Audits

On reasonable written request, no more than once a year unless a regulator requires it or after a breach, we will answer your security questionnaire in writing and give you the information you reasonably need to show that we meet this DPA. Lumen Global Sourcing does not currently hold a SOC 2 report or an ISO 27001 certificate. Where data protection law gives you the right to an audit and our written answers are not enough, we will agree a scope, timing and confidentiality terms with you; you bear your own costs.

10. Deleting or returning data

While your account is active you can download your records as files, delete documents attached to a shipment, and ask us to delete documents or your whole account at hello@lumenglobalsourcing.com. When the service ends, you can ask us within 30 days for a copy of your data. After that, or sooner if you ask, we delete your company’s data from the live service within 30 days. Database backups roll over after 14 days, so deleted data is gone from them by then. We keep only what the law requires us to keep, and keep it protected under this DPA for as long as we hold it.

11. Where your data is processed

Your data is hosted in the United States. Our sub-processors process it in the countries shown above, and our own staff may access it from other countries to support and secure the service, under the same commitments.

• EEA, UK and Switzerland. Where personal data from these places is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) apply and are incorporated by reference: Module Two where you are a controller, and Module Three where you are a processor for someone else. Clause 7 (docking) applies; the optional wording in Clause 11 does not; for Clause 13 and Clauses 17 and 18, the supervisory authority, governing law and courts are those of the EU member state where you are established, or Ireland if you are not. Annex I is section 2 of this DPA, Annex II is section 5, and Annex III is section 6. For UK data, the UK International Data Transfer Addendum to the Clauses applies, and for Swiss data, the Clauses apply with references to the Swiss Federal Data Protection Act where needed.
• Canada. We protect personal data transferred outside Canada through this DPA and our contracts with sub-processors, so that it receives a comparable level of protection, as PIPEDA and provincial laws such as Quebec’s Law 25 expect. Data held in another country may be accessible to that country’s courts and authorities under its laws.
• Other countries. Where another law requires a transfer mechanism, we will work with you to put an appropriate one in place.

12. How this fits with the Terms

This DPA is governed by the governing law and dispute terms in the Terms of Service, except where the Standard Contractual Clauses require otherwise. Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms. If this DPA conflicts with the Terms about personal data, this DPA wins; if the Standard Contractual Clauses conflict with either, the Clauses win. This DPA ends when we no longer process personal data for you.

13. Contact

Questions about this DPA, a request for a signed copy, or a security questionnaire: email hello@lumenglobalsourcing.com. Our Security page explains the same measures in plain terms.