Data processing agreement
1. Purpose and scope
| Role | Party |
|---|---|
| Data controller | The customer that has subscribed to the LUMMI platform (the Customer) |
| Data processor | LUMMI Systems ApS, company reg. no. (CVR) 46738896, Tømrervej 7, 4600 Køge, Denmark (LUMMI) |
By electronically accepting the subscription agreement, by signature, or by continuing to use LUMMI after this agreement takes effect, the Customer accepts this data processing agreement. If there is a conflict between this agreement and other agreements on the processing of personal data, this agreement takes precedence on the data protection question.
1.1 LUMMI provides a digital platform for, among other things, sales, finance, quality management, planning, and handling enquiries and cases. When the Customer uses the platform, LUMMI may process personal data for which the Customer determines the purpose and means.
1.2 The agreement meets the requirements for an agreement between a data controller and a data processor under Article 28(3) of the GDPR. The appendices describe the content of the processing, the approved sub-processors, and the technical and organisational security measures.
1.3 LUMMI is independently the data controller for information LUMMI processes for its own purposes, for example contract administration, invoicing, compliance with legal obligations and its own security logging. Such processing is not covered by this agreement.
2. Roles and responsibility
2.1 The Customer’s responsibility
The Customer determines the purposes of the processing and is responsible for ensuring that the information entered or otherwise processed in LUMMI is lawful, relevant and accurate. In particular, the Customer must ensure:
- that a valid legal basis for processing exists and that data subjects are given the necessary information
- that users are only given the access their tasks require
- that the Customer’s instructions are lawful and sufficiently clear
- that information not necessary for the use of LUMMI is not registered in the platform
- that special categories of personal data and data on criminal offences are only processed if separately agreed in writing with LUMMI.
2.2 LUMMI’s responsibility
LUMMI only processes personal data on the Customer’s documented instructions, unless EU or Danish law requires LUMMI to process it otherwise. If the law requires processing without the Customer’s instructions, LUMMI informs the Customer before the processing takes place, unless the law prohibits this.
If LUMMI considers that an instruction conflicts with data protection law, the Customer is notified without undue delay. LUMMI may suspend the affected processing until the instruction has been changed or its lawfulness has been documented.
3. Instructions and permitted processing
3.1 The Customer’s ongoing use and configuration of the platform, written support requests, and this agreement with its appendices constitute the Customer’s documented instructions.
3.2 LUMMI may carry out the processing activities necessary to deliver, secure, maintain, fix and support the platform, including receiving, recording, structuring, storing, retrieving, displaying, transferring at the Customer’s choice, backing up and deleting information.
3.3 A new or changed instruction that goes beyond the platform’s agreed functionality or requires materially extra work must be agreed separately. LUMMI may charge a reasonable fee for the work if the Customer is informed of this in advance.
4. Access and confidentiality
4.1 Only people with a work-related need may access the Customer’s personal data. LUMMI regularly reviews access rights and removes access when the need ends.
4.2 Employees and other persons acting under LUMMI’s authority must be subject to a binding confidentiality obligation or a statutory duty of confidentiality, and must receive relevant instruction in the secure processing of personal data.
4.3 LUMMI may not disclose the Customer’s information to unauthorised parties or use it for its own marketing purposes.
5. Information security
5.1 LUMMI implements and maintains appropriate technical and organisational measures, taking into account the nature, scope and purpose of the processing, the current state of the art, the costs of implementation, and the risk to the rights and freedoms of data subjects.
5.2 The measures must support confidentiality, integrity, availability and resilience. The detailed minimum measures are set out in appendix 3.
5.3 LUMMI may improve or change the security measures as long as the overall level of protection is not reduced. The Customer is informed of material changes that affect the Customer’s risk assessment.
6. Sub-processors
6.1 The Customer gives LUMMI a general written authorisation to use sub-processors. The sub-processors approved when the agreement is entered into are set out in appendix 2, or in LUMMI’s current published list of sub-processors, if the appendix refers to it.
6.2 LUMMI notifies the Customer in writing at least 30 days before a new sub-processor is engaged or an existing one is replaced. The notice must state its identity, the location of processing and its main task.
6.3 Before the notice period expires, the Customer may raise a reasoned, data-protection-related objection. The parties must work in good faith to find a solution. If a reasonable solution cannot be found, the Customer may terminate the affected service with effect from the date the change takes effect.
6.4 LUMMI enters into written agreements with sub-processors that impose data protection obligations at least equivalent to the relevant obligations in this agreement. LUMMI is liable to the Customer for the sub-processor’s performance of these obligations.
7. International transfers
7.1 Personal data may only be processed outside the EU and EEA, or made accessible from a third country, when this follows from the Customer’s documented instructions and the requirements of Chapter V of the GDPR are met.
7.2 Where no adequacy decision exists, LUMMI must ensure a valid transfer mechanism, for example the European Commission’s standard contractual clauses, and implement any necessary supplementary measures based on an assessment of the transfer.
7.3 Information about relevant transfers and their legal basis must be set out in appendix 2 or the sub-processor list referred to there.
8. Assistance to the Customer
8.1 Taking into account the nature of the processing, LUMMI assists the Customer, as far as possible, with appropriate technical and organisational measures so the Customer can respond to requests for access, rectification, erasure, restriction, data portability, objection, and rights related to automated decisions.
8.2 LUMMI forwards, without undue delay, a request from a data subject that relates to the Customer’s information. LUMMI does not respond to the request on the Customer’s behalf without documented instructions.
8.3 LUMMI also assists the Customer with relevant information for:
- assessing and reporting personal data breaches
- notifying affected individuals, when required
- data protection impact assessments
- prior consultation with Datatilsynet
- documenting that the Customer’s processing through LUMMI complies with applicable law.
8.4 Assistance that goes beyond LUMMI’s ordinary product features and statutory standard documentation may be invoiced based on time spent, provided the Customer has been informed of the expected scope and price before the work begins. LUMMI does not charge for assistance made necessary by LUMMI’s own breach of the agreement.
9. Personal data breaches
9.1 LUMMI notifies the Customer without undue delay after becoming aware of a personal data breach concerning the Customer’s information. Where practically possible, the first notification is given no later than 24 hours after discovery.
9.2 The notification is given on an ongoing basis if all information is not available at once, and must, to the extent the information is available, describe:
- the nature and timing of the breach and the systems and information affected
- the categories and approximate number of data subjects and records concerned
- the likely consequences
- the remedial measures taken or planned
- the point of contact for follow-up.
9.3 LUMMI documents the breach and takes reasonable measures to limit damage, restore secure operations and prevent recurrence. The Customer is responsible for any notification to Datatilsynet and for informing the data subjects.
10. Audit and control
10.1 LUMMI makes available the information reasonably necessary to demonstrate compliance with Article 28 and this agreement. The documentation may consist of security descriptions, questionnaire responses, statements, certifications or audit reports.
10.2 If the documentation does not provide sufficient assurance, the Customer may, once a year, have a further audit carried out by an independent, competent auditor. The Customer must give at least 30 days’ notice, limit the audit to relevant systems, and ensure that the audit does not compromise other customers’ information, security or trade secrets.
10.3 The Customer bears its own and LUMMI’s reasonable costs of a Customer-requested audit, unless the audit demonstrates a material breach attributable to LUMMI. Supervisory authorities’ access and powers are not limited by this section.
11. Termination, deletion and return of data
11.1 When the subscription ends, the Customer may, for 30 days, export the information made available by the platform’s features, unless otherwise agreed. The Customer is responsible for carrying out the desired export in time.
11.2 After the export period, LUMMI deletes or anonymises the Customer’s personal data from active production environments, unless EU or Danish law requires continued retention. Information in backups is deleted through the ordinary, controlled overwrite cycle and may until then only be used to restore and secure operations.
11.3 Before termination, the Customer may request in writing that data be provided in another common, machine-readable format, if technically possible. Extraordinary work may be invoiced by prior agreement.
12. Duration, changes and governing law
12.1 The agreement takes effect at the same time as the subscription agreement and cannot be terminated separately for as long as LUMMI processes personal data on the Customer’s behalf. Provisions on confidentiality, deletion, documentation and liability survive termination to the extent their nature requires.
12.2 LUMMI may amend the agreement when necessary due to legislation, regulatory requirements, changed features or security considerations. Material changes are notified at least 30 days before they take effect, unless a legal or security requirement necessitates faster action.
12.3 The agreement is governed by Danish law. Disputes are handled under the venue provision in the subscription agreement. This does not limit the powers of Datatilsynet or other competent authorities.
13. Contact between the parties
The Customer can contact LUMMI through the data protection contact channel stated on LUMMI’s website or in the subscription agreement. LUMMI may contact the Customer via the Customer’s administrator or the contact person the Customer has registered in the platform. The Customer must keep its contact details up to date.
Appendix 1 Description of the processing
Categories of data subjects
- the Customer’s current, former and prospective employees, temporary staff and other associated individuals
- the Customer’s current, former and prospective customers, suppliers and partners, and their contact persons
- individuals referred to in work schedules, quality cases, documentation, enquiries or tickets
- the Customer’s administrators and other authorised users.
Categories of personal data
| Category | Examples |
|---|---|
| Identity and contact | Name, address, phone number, e-mail, user ID, employee number and contact person. |
| Employment and operations | Job title, workplace, start date, working hours, shift schedule, tasks, absence codes, competencies, documents and instructions. |
| Customer and sales | Contact details, quotes, agreements, locations, correspondence, meeting notes and customer activities. |
| Finance | Invoice and payment details, payroll-related base data, bank details, VAT and business registration numbers, when the Customer chooses to register them. |
| Quality and cases | Inspection results, photos, comments, non-conformities, complaints, incidents, tickets and follow-up history. |
| Technical data | Login and security logs, timestamps, IP address, device and browser information, and change history. |
| Identification numbers | National ID number or equivalent identifiers, if the chosen feature supports it and the Customer has a lawful basis. |
The LUMMI platform is not intended for the systematic processing of special categories of data under Article 9 or data on criminal offences under Article 10. Such data may only be entered under a separate, documented agreement and with appropriate supplementary security measures.
Appendix 2 Sub-processors and locations of processing
LUMMI maintains a current list of the suppliers that may process the Customer’s information on LUMMI’s behalf, including their task, location of processing and transfer mechanism. The list is provided to the Customer on request and is updated in accordance with the notice procedure in section 6.
Appendix 3 Technical and organisational measures
LUMMI must, as a minimum, have controls proportionate to the risk that cover the following areas. The description sets out binding objectives; the specific technical solutions may change without reducing the level of protection.
| Area | Minimum requirement |
|---|---|
| Access control | Unique user accounts, role-based access, strong authentication for privileged access, a process for granting and revoking access, and periodic review. |
| Encryption | Encryption of traffic over public networks using current protocols, and appropriate protection of stored data and keys based on risk. |
| Logging | Logging of relevant login, administration and security events, and protection against unauthorised alteration and access. |
| Operations and vulnerabilities | Controlled change management, timely security patching, vulnerability management, monitoring and separation of relevant environments. |
| Backup and contingency | Regular backups, protection of copies, restore testing, and documented procedures for operational disruptions and security incidents. |
| Confidentiality | Binding confidentiality obligations, security instruction, need-based support access, and limited export of production data. |
| Development | A secure development process with code review, testing, secrets management and risk assessment of material changes. |
| Suppliers | Security assessment before use, binding data processing obligations, and ongoing follow-up on suppliers with access to personal data. |
| Deletion | Controlled procedures for deletion, anonymisation, media disposal and expiry of backups. |
| Physical security | Use of processing locations with appropriate access control, protection against environmental incidents, and secure disposal of equipment. |
Appendix 4 Special instructions and options
This appendix is only completed if the Customer’s use requires instructions beyond ordinary use of the platform. Unless otherwise specifically agreed with the Customer, the following applies:
| Matter | Terms |
|---|---|
| Special categories of data | Not permitted, unless otherwise approved in writing by LUMMI. |
| Special retention periods | None beyond section 11, unless otherwise agreed. |
| Special security requirements | None beyond appendix 3, unless otherwise agreed. |
| Special export format | The platform’s standard export, unless otherwise agreed. |
Signatures
The agreement can be accepted electronically as part of the subscription agreement. If the parties wish to sign separately, signed copies are exchanged between the Customer and LUMMI Systems ApS.