Data Processing Agreement (DPA)
Last Updated: August 20, 2026
Effective Date: Concurrently with the activation of the Customer's Service Subscription or Free Trial.
USING THIS DPA
This DPA consists of two parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at commonpaper.com/standards/data-processing-agreement/1.1, which is incorporated herein by reference.
If there is any inconsistency between the parts of this DPA, the Cover Page and Additional Modifications will control over the DPA Standard Terms. All capitalized terms not defined herein have the meanings given in the DPA Standard Terms or the Master Agreement.
Key Terms
- UK Transfers: United Kingdom (England and Wales)
- EEA Transfers: Ireland
Service Provider Relationship & US Privacy Laws
To the extent that the California Consumer Privacy Act (CCPA) or equivalent US state privacy laws apply, the parties acknowledge and agree that Provider acts as a Service Provider / Processor receiving Personal Data from Customer solely to perform the Services set forth in the Agreement.
Provider certifies that it will not sell, share, retain, use, or disclose Customer Personal Data for any cross-context behavioral advertising or for any purpose other than the specific business purposes defined in the Agreement and this DPA.
Approved Subprocessors
To deliver our automated white-labeled platform, conversational interfaces, and workflow integrations, Provider utilizes the following third-party infrastructure subprocessors:
| Subprocessor | Location | Purpose |
|---|---|---|
| Supabase | United Kingdom / eu-west-2 | Primary relational database hosting, secure audit trail logging, and customer consent verification records. |
| Twilio | United States / United Kingdom | Telephony infrastructure, inbound/outbound 0333 call routing, SMS capabilities, and voice call metadata processing. |
| Vercel | United States / Global Edge | Frontend web application hosting, CDN routing, and secure IP address request handling. |
| Stammer.ai | United States | Back-end platform infrastructure hosting, workflow orchestration, and core white-label agent management. |
| OpenAI | United States | Core artificial intelligence processing and large language model (LLM) APIs. |
| Anthropic, PBC | United States | Advanced conversational artificial intelligence processing (Claude models). |
| xAI Corp. | United States | Specialized natural language model processing APIs (Grok). |
| Clerk | United States | User authentication, identity verification, and token access control. |
| Stripe | United States | PCI-compliant merchant payment processing, billing infrastructure, and subscription management. |
AI Non-Training Commitment: Provider contractually verifies that API-based AI subprocessors (OpenAI, Anthropic, xAI) process data strictly on-demand and are legally restricted from utilizing Customer Personal Data to train, fine-tune, or improve their foundational artificial intelligence models.
Annex I(A): List of Parties
Data Exporter (Controller)
- Name: The Customer entering into this DPA or subscribing to the Service.
- Role: Controller
Data Importer (Processor)
- Name: Luminaxis Ltd (Registered in England & Wales)
- Contact Person: Adam Thomas, Director / Founder
- Registered Office: Derwyn Fawr, The Links, Pembrey, Burry Port, Carmarthenshire, SA16 0HT, United Kingdom
- Role: Processor
Annex I(B): Description of Processing Activities
1. Scope of Service
Luminaxis Ltd provides a cloud-based Software-as-a-Service (SaaS) platform enabling business clients to deploy white-labeled AI conversational agents, automated voice/text workflows, and third-party integrations.
2. Categories of Data Subjects
- Direct end-users, callers, leads, prospects, and web visitors interacting with conversational agent interfaces.
- Customer's internal employees, account administrators, operators, and platform managers.
3. Categories of Personal Data
- Identity & Contact Data: Full names, business email addresses, telephone numbers, and inbound caller ID metadata.
- Interaction & System Data: Conversational transcripts, prompt inputs, system logs, device attributes, IP addresses, and audio call recordings generated via voice agents.
- Commercial & Custom Knowledgebase Data: Structural business documentation, custom account variables, transaction records, and user-submitted data sources.
4. Special Category Data Restrictions & Indemnity
Prohibition: Is Special Category Data (as defined under Article 9 of UK GDPR, including medical records, biometric identification, or sensitive personal beliefs) processed? NO.
Indemnification: The Customer shall not submit or route Special Category Data through the Service. The Customer assumes sole responsibility for any unauthorized submission of Special Category Data and agrees to fully indemnify and hold harmless Luminaxis Ltd against any regulatory fines, claims, or damages resulting from the Customer's breach of this restriction.
5. Frequency & Duration
- Frequency: Continuous and on-demand for the active term of the Customer's subscription or workspace.
- Duration: Provider will process Customer Personal Data for the duration required to deliver the Service or as mandated by statutory retention requirements under UK law.
Additional Modifications to the DPA Standard Terms (UK GDPR Article 28 Direct Obligations)
Pursuant to Article 28 of the UK GDPR and the Data Protection Act 2018, Provider agrees to the following express operational terms:
Personal Data Breach Notification: Provider shall notify Customer without undue delay, and in any event within 48 hours of confirming a Personal Data Breach affecting Customer Personal Data.
Data Deletion & Return: Upon termination or expiration of the Master Agreement, Provider shall, at the election of the Customer, securely delete or return all Customer Personal Data within 30 days, unless retention is explicitly required by applicable UK statutory laws.
Subprocessor Notification & Objection: Provider shall inform Customer at least 15 days in advance of adding or replacing any subprocessor via dashboard notification or email update, providing Customer reasonable opportunity to object.
Execution & Authorization
PROVIDER
Company: Luminaxis Ltd
Signature: Adam Thomas
Name: Adam Thomas
Title: Director / Founder
Legal Address: Derwyn Fawr, The Links, Pembrey, Burry Port, Carmarthenshire, SA16 0HT, United Kingdom
© 2026 Lumin Axis Ltd. All rights reserved. Registered in England & Wales.