Data Protection & Processing Agreement

Lumorus Global Data Processing Agreement

Effective date: 16 June 2026 Last Updated: 16 June 2026

Effective date: 16 June 2026
Last Updated: 16 June 2026

Introduction

This Global Data Processing Agreement, referred to as the “DPA”, governs how Lumorus processes personal data in connection with the CoSec Hub, the CoSec Retainer, the Governance Knowledge Centres and related company secretary, governance, compliance, platform and support services.

This DPA is intended for global use. Lumorus is based in the United Kingdom, but its clients, authorised users, directors, officers, shareholders, beneficial owners, employees, advisers and other data subjects may be located in multiple jurisdictions.

This DPA applies where Lumorus processes personal data on behalf of a client. It also explains when Lumorus acts as an independent controller for its own business purposes.

By ticking the relevant acceptance box, clicking “I agree”, creating an account, accessing the CoSec Hub, subscribing to the CoSec Retainer, signing an order form, or otherwise accepting the applicable Lumorus terms, the Client agrees to this DPA.

Parties

This DPA is between:

Lumorus Group Ltd, a company incorporated in England and Wales with company number 12750296 and registered office at City Pavilion, 27 Bush Lane, Cannon Green, United Kingdom, EC4R 0AA, referred to as “Lumorus”, “we”, “us” or “our”; and

The Client, being the person, company, organisation or other legal entity that subscribes to, accesses or uses the CoSec Hub, the CoSec Retainer, the Governance Knowledge Centres or related Lumorus services, referred to as the “Client”, “you” or “your”.

Lumorus and the Client are each a “Party” and together the “Parties”.

Status of this DPA

This DPA forms part of the legal agreement between Lumorus and the Client.

It applies alongside, and is incorporated into the applicable client agreement, including any:

CoSec Retainer Terms and Conditions;

Platform Terms of Use;

order form;

proposal;

statement of work;

service schedule;

online subscription terms;

jurisdiction-specific addendum.

If there is a conflict between this DPA and another agreement in relation to the processing of Client Personal Data, this DPA will take priority unless the other agreement gives stronger protection to personal data or applicable law requires otherwise.

Global application and applicable data protection laws

This DPA is designed to support compliance with data protection and privacy laws that may apply to the Services, including, where relevant:

the UK General Data Protection Regulation and Data Protection Act 2018;

the EU General Data Protection Regulation;

privacy and data protection laws in other jurisdictions where the Client, data subjects, Lumorus personnel, service providers or processing activities are located;

electronic communications, cybersecurity, data transfer, breach notification, records management and similar laws that apply to the relevant processing.

The Parties acknowledge that data protection laws vary by jurisdiction. Where mandatory local data protection laws apply, the Parties will comply with those laws to the extent required.

Nothing in this DPA excludes or limits any rights, obligations or protections that cannot lawfully be excluded under applicable data protection law.

Definitions

In this DPA:

Applicable Data Protection Laws  means all data protection, privacy, electronic communications, cybersecurity, breach notification and related laws that apply to the processing of personal data under this DPA.

Client Personal Data  means personal data that Lumorus processes on behalf of the Client in connection with the Services.

Controller  means the party that determines the purposes and means of processing personal data, or the equivalent role under applicable data protection law.

Data Subject  means an identified or identifiable individual to whom personal data relates.

DPA  means this Global Data Processing Agreement, including its schedules and any documents incorporated by reference.

Governance Knowledge Centres  means the Lumorus expert service delivery centres, knowledge systems, professional workspaces and specialist teams through which company secretaries and other experts deliver governance, company secretary, compliance and advisory support to clients.

Lumorus Controller Data  means personal data that Lumorus processes as an independent controller for its own business, legal, administrative, operational, compliance, security, relationship management, marketing, billing or service improvement purposes.

Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Personal Data.

Processor means the party that processes personal data on behalf of a controller, or the equivalent role under applicable data protection law.

Restricted Transfer means a transfer of personal data to a country, territory or recipient where a transfer safeguard is required under applicable data protection law.

Services  means the CoSec Hub, CoSec Retainer, Governance Knowledge Centres and related company secretary, governance, compliance, platform, support, administrative and professional services provided by Lumorus.

Sub-processor  means another processor engaged by Lumorus to process Client Personal Data on behalf of the Client.

Terms such as “personal data”, “processing”, “controller”, “processor”, “special category data”, “sensitive personal information”, “data subject”, “supervisory authority” and similar terms have the meanings given to them under applicable data protection law.

Roles of the Parties

The Parties acknowledge that their data protection roles depend on the purpose and context of the processing.

6.1 Client as controller

The Client is usually the controller of Client Personal Data because the Client decides why the personal data is processed and the purposes for which it is used.

This includes personal data relating to:

the Client’s directors;

officers;

company secretaries;

employees;

shareholders;

beneficial owners;

persons with significant control or equivalent persons;

board and committee members;

meeting attendees;

authorised signatories;

investors;

members;

trustees;

advisers;

service providers;

KYC or due diligence subjects;

other individuals whose data is uploaded, submitted or provided by or on behalf of the Client.

For example, the Client decides to use Lumorus and the CoSec Hub to maintain statutory registers, manage governance records, store director information, track compliance deadlines, manage meeting records, support filings or coordinate company secretary services. In those cases, the Client determines the purpose of the processing and is the controller.

6.2 Lumorus as processor

Lumorus is usually the processor where it processes Client Personal Data to provide the Services on behalf of the Client.

This includes processing Client Personal Data through or in connection with:

the CoSec Hub;

the CoSec Retainer;

statutory record support;

entity management;

director and officer records;

shareholder and beneficial ownership records;

meeting administration;

board and committee documentation;

governance calendars;

compliance reminders;

filing support;

client document exchange;

service requests;

support tickets;

Governance Knowledge Centre service delivery.

In these cases, Lumorus processes Client Personal Data on the Client’s documented instructions and not for Lumorus’ own independent purposes, except where required by law or expressly permitted under this DPA.

6.3 Lumorus as independent controller

Lumorus acts as an independent controller when it processes personal data for its own business purposes.

This may include processing personal data for:

client onboarding;

account creation and administration;

billing and payment administration;

CRM and relationship management;

marketing and business development;

service improvement;

platform security and fraud prevention;

internal reporting;

legal and regulatory compliance;

complaints handling;

enforcing agreements;

maintaining business records;

professional indemnity, insurance, audit and governance purposes;

responding to legal claims, regulators or authorities.

Lumorus Controller Data is governed by the Lumorus Privacy Policy and applicable law, not by the processor obligations in this DPA.

6.4 Joint controllership

The Parties do not intend to act as joint controllers unless they expressly agree this in writing.

If the Parties jointly determine the purposes and means of a specific processing activity, they will document their respective responsibilities in a separate joint controller arrangement or jurisdiction-specific addendum.

Client instructions

The Client instructs Lumorus to process Client Personal Data as necessary to provide the Services and comply with the applicable agreement.

The Client’s documented instructions include:

this DPA;

the applicable client agreement;

the Platform Terms of Use;

any order form, proposal, statement of work or service schedule;

platform settings selected by the Client;

instructions submitted through the CoSec Hub;

written instructions from authorised Client representatives.

Lumorus will process Client Personal Data only on the Client’s documented instructions, unless applicable law requires otherwise.

Where Lumorus is required by law to process Client Personal Data outside the Client’s instructions, Lumorus will inform the Client before processing unless the law prohibits such notice.

Lumorus will promptly inform the Client if, in Lumorus’ reasonable opinion, an instruction infringes applicable data protection law.

Details of processing

The details of processing are set out in Schedule 1: Processing Details.

The Client acknowledges that the exact personal data processed will depend on:

the Services selected;

the jurisdictions involved;

the data uploaded or provided by the Client;

the Client’s configuration of the CoSec Hub;

the nature of the Client’s governance, company secretary and compliance requirements.

Client responsibilities

The Client is responsible for:

complying with applicable data protection laws in the jurisdictions relevant to the Client, its data subjects and its use of the Services;

ensuring that it has a lawful basis for collecting, using and disclosing Client Personal Data to Lumorus;

providing appropriate privacy notices to data subjects;

obtaining any required consents, approvals or authorisations;

ensuring that Client Personal Data is accurate, relevant and not excessive;

ensuring that Client Personal Data is provided lawfully;

ensuring that only authorised users access the CoSec Hub;

managing user permissions and access levels;

removing access for users who no longer require it;

ensuring that its instructions to Lumorus are lawful;

responding to data subject requests where the Client is the controller;

determining appropriate retention periods for Client Personal Data;

determining whether any local data localisation, regulator registration, transfer approval or sector-specific privacy requirement applies;

ensuring that special category data, sensitive personal information, criminal offence data, children’s data or equivalent high-risk data is provided only where lawful and necessary.

Lumorusresponsibilities as processor

Where Lumorus acts as processor, Lumorus will:

process Client Personal Data only on documented instructions from the Client, unless required by law;

ensure that persons authorised to process Client Personal Data are subject to appropriate confidentiality obligations;

implement appropriate technical and organisational measures to protect Client Personal Data;

assist the Client with data subject requests where required and reasonably possible;

assist the Client with security, breach notification, data protection impact assessments and regulator consultations where required by applicable data protection law;

maintain appropriate records where required by law;

make available information reasonably necessary to demonstrate compliance with this DPA;

use Sub-processors only in accordance with this DPA;

delete or return Client Personal Data at the end of the Services in accordance with this DPA.

Confidentiality

Lumorus will ensure that any person authorised to process Client Personal Data on its behalf is subject to a duty of confidentiality or an appropriate statutory obligation of confidentiality.

Lumorus will take reasonable steps to ensure that access to Client Personal Data is limited to personnel, contractors and Sub-processors who need access for the purpose of providing the Services.

Security measures

Lumorus will implement and maintain appropriate technical and organisational measures designed to protect Client Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include, as appropriate:

access controls;

role-based permissions;

authentication controls;

secure hosting arrangements;

encryption in transit;

encryption at rest where appropriate and available;

audit logs;

user access management;

backup and recovery processes;

malware protection;

security monitoring;

incident response processes;

confidentiality obligations;

supplier due diligence;

staff and contractor awareness;

data minimisation controls;

logical segregation of client records;

periodic review of permissions and security settings.

Further details are set out in Schedule 2: Technical and Organisational Measures.

Security measures may evolve over time as technology, threats, laws and the Services develop, provided that Lumorus does not materially reduce the overall level of protection for Client Personal Data.

Personal Data Breaches

Lumorus will notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data.

The notification will include, where available:

a description of the nature of the breach;

the categories and approximate number of data subjects affected;

the categories and approximate number of records affected;

the likely consequences of the breach;

measures taken or proposed to address the breach;

information reasonably required by the Client to comply with its own notification obligations.

Lumorus may provide information in phases where full details are not immediately available

The Client is responsible for determining whether a Personal Data Breach must be notified to a regulator, supervisory authority, data subject, client, court, registry or other third party, unless Lumorus is independently required by law to notify.

Lumorus’ notification of a Personal Data Breach is not an admission of fault, liability or breach of contract.

Data subject requests

Lumorus will, where required by applicable data protection law and reasonably possible, assist the Client in responding to requests from data subjects exercising their rights.

Such rights may include:

access;

correction or rectification;

deletion or erasure;

restriction;

objection;

portability;

withdrawal of consent;

opt-out rights;

rights relating to automated processing;

equivalent rights under local data protection laws.

If Lumorus receives a request directly from a data subject relating to Client Personal Data, Lumorus will not respond substantively unless authorised by the Client or required by law. Lumorus may acknowledge receipt and direct the data subject to the Client.

The Client is responsible for verifying the identity of the requester, assessing the request and determining the response where the Client is the controller.

Assistancewith compliance

Taking into account the nature of processing and information available to Lumorus, Lumorus will provide reasonable assistance to the Client where required by applicable data protection law in relation to:

security of processing;

Personal Data Breach notifications;

data protection impact assessments;

prior consultation with supervisory authorities or regulators;

responding to regulator enquiries;

demonstrating compliance with controller obligations relating to the Services.

Lumorus may charge reasonable fees for assistance that is complex, extensive, repeated, outside the ordinary scope of the Services, or required because of the Client’s act, omission or instruction, unless prohibited by law.

Sub-processors

The Client gives Lumorus general written authorisation to engage Sub-processors to support delivery of the Services.

Lumorus may use Sub-processors for purposes including:

cloud hosting;

platform infrastructure;

data storage;

CRM;

workflow automation;

email and communications;

identity verification;

electronic signature;

payment processing;

analytics;

support ticketing;

security monitoring;

document management;

professional service support.

Lumorus will ensure that each Sub-processor is subject to written terms that impose data protection obligations no less protective in substance than those in this DPA, to the extent applicable to the services provided by that Sub-processor.

Lumorus remains responsible to the Client for the performance of its Sub-processors’ data protection obligations, except to the extent that liability is limited under the applicable client agreement.

Lumorus will maintain a list of material Sub-processors at [insert URL] or make it available on request.

Lumorus will notify the Client of any intended material change to Sub-processors by updating the Sub-processor list, giving platform notice, email notice or another reasonable method.

If the Client reasonably objects to a new Sub-processor on data protection grounds, the Client must notify Lumorus within [insert number] days of notice. The Parties will work in good faith to resolve the objection. If the objection cannot reasonably be resolved, Lumorus may offer an alternative, restrict the relevant feature, or allow the Client to terminate the affected Services in accordance with the client agreement.

International transfers

Lumorus may process or transfer Client Personal Data internationally where necessary to provide the Services.

This may include transfers to or access from jurisdictions where:

Lumorus personnel or contractors are located;

Lumorus group entities operate;

Sub-processors provide services;

cloud infrastructure or support services are located;

the Client operates;

the Client instructs Lumorus to process or share data.

Lumorus will ensure that Restricted Transfers are protected by appropriate safeguards where required by applicable data protection law. These safeguards may include:

adequacy regulations or adequacy decisions;

standard contractual clauses;

the UK International Data Transfer Agreement;

the UK Addendum to the EU Standard Contractual Clauses;

Binding Corporate Rules;

approved codes of conduct or certification mechanisms;

contractual, technical and organisational safeguards;

another lawful transfer mechanism recognised under applicable law.

Where required, the Parties will execute or be deemed to have incorporated appropriate transfer terms.

The Parties will provide reasonable cooperation in relation to transfer risk assessments, supplementary measures and transfer documentation where required by applicable data protection law.

Audit and information rights

Lumorus will make available to the Client information reasonably necessary to demonstrate compliance with this DPA.

Where required by applicable data protection law, Lumorus will allow for and contribute to audits, including inspections, conducted by the Client or an independent auditor appointed by the Client, subject to the following:

the Client must give reasonable prior written notice;

audits must be conducted during normal business hours;

audits must not unreasonably disrupt Lumorus’ business;

audits must be limited to systems, records and personnel relevant to Client Personal Data;

the auditor must be suitably qualified and subject to confidentiality obligations;

the audit must not compromise the confidentiality, security or data of Lumorus, its personnel, Sub-processors or other clients;

the Client must bear its own costs and Lumorus may charge reasonable costs for extensive audit support unless prohibited by law.

Where Lumorus provides third-party security reports, certifications, policies, attestations or written responses that reasonably address the Client’s audit request, the Client agrees to rely on those materials where appropriate instead of requiring an onsite audit.

Return and deletion of Client Personal Data

At the end of the Services, or on written instruction from the Client, Lumorus will delete or return Client Personal Data in accordance with the applicable client agreement, platform functionality and applicable data protection law.

Unless otherwise agreed, Lumorus may retain Client Personal Data where necessary to:

comply with legal, regulatory, tax, accounting or professional obligations;

maintain business records;

resolve disputes;

enforce agreements;

preserve evidence;

maintain backup records for a limited period;

protect legal rights;

comply with audit, insurance, governance or professional requirements.

Where Client Personal Data is retained for these purposes, Lumorus will continue to protect it in accordance with this DPA or applicable law.

Backup copies may remain in secure backup systems for a limited period until overwritten or deleted in accordance with Lumorus’ normal backup cycles.

Special category data, sensitivedataand regulated data

The Client must not upload or provide special category data, sensitive personal information, criminal offence data, children’s data, biometric data, health data or other high-risk personal data unless:

it is necessary for the Services;

the Client has a lawful basis and any required additional condition for processing;

the Client has provided any required notices;

the processing is permitted by the applicable client agreement and platform functionality;

appropriate safeguards are in place.

Lumorus may process such data where it is included in director, officer, shareholder, beneficial owner, KYC, due diligence, meeting, governance, compliance, investigation, accessibility or regulatory records provided by or on behalf of the Client.

The Client remains responsible for ensuring that such data is provided lawfully.

Automated processing and AI-assisted tools

The CoSec Hub and related Lumorus systems may use automation, analytics or AI-assisted tools to support service delivery, workflow management, search, document handling, compliance reminders, risk flagging, reporting and governance administration.

Lumorus will not use Client Personal Data to make decisions based solely on automated processing that produce legal or similarly significant effects on data subjects, unless expressly agreed with the Client and permitted by applicable data protection law.

Where AI-assisted tools are used in connection with Client Personal Data, Lumorus will apply reasonable safeguards appropriate to the nature of the processing and the Services.

Local law requirements

The Client may operate in jurisdictions with data protection laws outside the United Kingdom and the European Economic Area.

The Client is responsible for identifying local data protection requirements that apply to its use of the Services, including requirements relating to:

data localisation;

regulator registration;

data transfer approvals;

data subject notices;

consent;

employment data;

director or shareholder data;

KYC data;

financial services data;

sensitive data;

retention periods;

regulator access;

sector-specific restrictions.

Lumorus will provide reasonable cooperation where required to support compliance with applicable local requirements, subject to the scope of the Services, technical feasibility and any agreed fees.

Liability

Liability under this DPA is subject to the limitations and exclusions of liability in the applicable client agreement, unless applicable data protection law requires otherwise.

Nothing in this DPA limits liability that cannot lawfully be limited under applicable law.

Term and termination

This DPA begins when the Client accepts it or when Lumorus first processes Client Personal Data on behalf of the Client, whichever occurs first.

This DPA continues for as long as Lumorus processes Client Personal Data on behalf of the Client.

Termination or expiry of the client agreement does not affect any obligations under this DPA that are intended to continue, including confidentiality, security, return or deletion, audit, liability and international transfer obligations.

Changes to this DPA

Lumorus may update this DPA from time to time to reflect changes in:

applicable data protection laws;

regulatory guidance;

the Services;

security measures;

Sub-processors;

international transfer mechanisms;

platform functionality;

business operations.

Where Lumorus makes a material change to this DPA, it will provide notice by email, platform notice, website notice or another reasonable method.

Continued use of the Services after the effective date of the updated DPA will constitute acceptance of the updated DPA, unless applicable law requires a different process.

Governing law andjurisdiction

This DPA is governed by the laws of England and Wales, unless the applicable client agreement states otherwise.

The courts of England and Wales will have jurisdiction, unless the applicable client agreement states otherwise or mandatory applicable law requires a different forum.

Nothing in this clause prevents a data subject, regulator or supervisory authority from exercising rights or powers under applicable data protection law.

Electronic acceptance

The Client agrees that this DPA may be accepted electronically, including by ticking a box, clicking “I agree”, signing electronically, creating an account, submitting an order, accessing the CoSec Hub, or otherwise accepting the applicable Lumorus terms.

Electronic acceptance has the same effect as signing this DPA by hand, to the fullest extent permitted by applicable law.

Schedule 1: Processing Details

Subject matter of processing

Lumorus processes Client Personal Data to provide the CoSec Hub, CoSec Retainer, Governance Knowledge Centres and related company secretary, governance, compliance, platform, administrative and support services.

Duration of processing

Processing continues for the duration of the applicable client agreement and for any additional period required for:

service transition;

return or deletion of data;

legal, regulatory, tax, accounting or professional obligations;

backup retention;

dispute resolution;

enforcement of rights;

audit or evidential purposes.

Nature of processing

Processing may include:

collection;

recording;

organisation;

structuring;

storage;

retrieval;

consultation;

use;

disclosure by transmission;

sharing with authorised users;

alignment or combination;

restriction;

erasure;

destruction;

hosting;

backup;

support;

migration;

analysis;

reporting;

workflow management;

document handling;

audit logging.

Purpose of processing

The purpose of processing is to:

provide and operate the CoSec Hub;

deliver the CoSec Retainer;

support company secretary services;

manage governance records and workflows;

maintain statutory records;

support filings and compliance deadlines;

support board, committee and shareholder meeting processes;

support director, officer, shareholder and beneficial owner records;

manage KYC and due diligence information where required;

support governance calendars and reminders;

provide client support;

manage service requests;

produce governance reports and outputs;

maintain audit trails;

secure the platform;

comply with the client agreement and documented instructions.

Categories of data subjects

Client Personal Data may relate to:

directors;

officers;

company secretaries;

shareholders;

beneficial owners;

persons with significant control or equivalent persons;

authorised signatories;

board and committee members;

meeting attendees;

client employees;

client contractors;

client advisers;

client representatives;

investors;

trustees;

partners;

members;

regulators or registry contacts;

service providers;

complainants or whistleblowers where relevant to the Services;

other individuals whose data is uploaded or provided by the Client.

Categories of personal data

Client Personal Data may include:

name;

title;

role;

employer or organisation;

business contact details;

personal contact details where provided;

date of birth;

nationality;

residential address;

service address;

identification documents;

proof of address;

tax identification information;

company registration and appointment details;

shareholding or ownership details;

beneficial ownership information;

signatures;

declarations of interest;

conflict information;

meeting attendance records;

board and committee records;

minutes and resolutions;

governance documents;

filing records;

compliance deadline records;

communication records;

user account data;

audit logs;

support requests;

uploaded documents;

task and workflow records.

Special category, sensitive and high-risk data

Client Personal Data may include special category data, sensitive personal information or other high-risk data where provided by the Client or required for the Services.

This may include information relating to:

identity verification;

KYC or due diligence;

sanctions or politically exposed person screening;

diversity reporting;

accessibility needs for meetings;

whistleblowing or complaints;

regulatory investigations;

legal or governance matters.

The Client is responsible for ensuring that such data is provided lawfully and only where necessary.

Categories of processing locations

Processing may take place in:

the United Kingdom;

the European Economic Area;

countries where Lumorus group companies, personnel, contractors, Sub-processors or technology providers operate;

other jurisdictions where processing is necessary for the Services and lawful transfer safeguards are in place where required.

Frequency of processing

Processing may be continuous, recurring, periodic or ad hoc, depending on the Client’s use of the Services.

Client instructions

The Client instructs Lumorus to process Client Personal Data as necessary to provide the Services and perform the applicable agreement.

Client instructions

The Client instructs Lumorus to process Client Personal Data as necessary to provide the Services and perform the applicable agreement.

Schedule 2: Technical and Organisational Measures

Lumorus will maintain appropriate technical and organisational measures designed to protect Client Personal Data. These may include the measures below, as applicable to the Services.

Governance and accountability

Data protection responsibilities assigned internally.

Policies and procedures for handling personal data.

Supplier and Sub-processor due diligence.

Periodic review of data protection and security practices.

Access control

Role-based access permissions.

User authentication.

Restricted administrative access.

User access review processes.

Removal or adjustment of access where users leave or roles change.

Confidentiality

Confidentiality obligations for personnel and contractors.

Access to Client Personal Data limited to authorised persons.

Internal controls over sharing and disclosure.

Security controls

Secure hosting and infrastructure arrangements.

Encryption in transit.

Encryption at rest where appropriate and available.

Malware and threat protection where applicable.

Security monitoring and logging.

Vulnerability and patch management processes where applicable.

Data segregation

Client records logically separated where appropriate.

Access permissions designed to prevent unauthorised cross-client access.

Platform controls for client-specific user permissions.

Audit and logging

Administrative activity logging where available.

Record of material changes to key governance data where supported by the platform.

Backup and resilience

Backup processes appropriate to the Services.

Disaster recovery and business continuity arrangements proportionate to risk.

Procedures for restoring access or data where reasonably possible.

Incident management

Internal incident escalation processes.

Procedures for assessing suspected Personal Data Breaches.

Client notification process where Client Personal Data is affected.

Remediation and lessons learned processes where appropriate.

Data minimisation and retention

Processing limited to what is necessary for the Services.

Retention practices aligned with legal, contractual and operational requirements.

Deletion, return or archiving processes at the end of the Services where applicable.

Personnel awareness

Appropriate confidentiality and data protection awareness for relevant personnel.

Guidance on secure handling of client data.

Access to Client Personal Data limited by role and need.

Physical security

Reasonable physical security controls for Lumorus offices or work locations where Client Personal Data may be accessed.

Remote working controls where applicable.

Sub-processor controls

Written agreements with Sub-processors.

Data protection obligations imposed on Sub-processors.

Review of material Sub-processors where appropriate.

Schedule 3: Sub-processors

Lumorus may use Sub-processors to support the Services. A current list of material Sub-processors will be made available at:

or on request by contacting:

[email protected]

The Sub-processor list may include providers of:

cloud hosting;

platform infrastructure;

Zoho services;

CRM;

workflow automation;

document storage;

email and communications;

payment processing;

identity verification;

electronic signature;

analytics;

support ticketing;

security tools;

professional support services.

Lumorus will notify Clients of material changes to Sub-processors in accordance with this DPA.

Schedule 4: International Transfer Terms

Where Lumorus makes a Restricted Transfer of Client Personal Data, the Parties agree that the transfer will be protected by appropriate safeguards where required by applicable data protection law.

UK transfers-For transfers of Client Personal Data subject to UK data protection law to countries without an applicable UK adequacy regulation, the Parties agree that the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses may apply, as appropriate.

2. EU transfers – For transfers of Client Personal Data subject to EU data protection law to countries without an applicable EU adequacy decision, the Parties agree that the EU Standard Contractual Clauses may apply, as appropriate.

3. Other international transfers – For transfers subject to other data protection laws, Lumorus and the Client will use a lawful transfer mechanism required or recognised under the relevant law where applicable.

4. Transfer cooperation – The Parties will provide reasonable cooperation in relation to transfer risk assessments, supplementary measures and transfer documentation where required by applicable data protection law.

Lumorus Global Data Processing Agreement

Centralise Your CoSec Operations

Platform

Company

Legal

Contact Us