Provider: DELISOFT - FZCO, Trade Licence No. 29073.
Scope and roles
This DPA applies when LumaGrid processes personal data in content you host on your behalf. You are the controller or processor as applicable; LumaGrid is your processor or subprocessor. LumaGrid remains a separate controller for its own account, security, billing and legal records.
Instructions
LumaGrid processes your personal data only to provide, secure, support and terminate the service, on your documented instructions in the agreement, or as required by law. LumaGrid will inform you if an instruction appears unlawful where permitted.
Confidentiality
Personnel and contractors with authorized access must be bound by appropriate confidentiality obligations and access only the data needed for their role.
Security
LumaGrid maintains proportionate technical and organizational measures, including access control, protected credentials, encryption in transit, logging, vulnerability and incident handling, backup controls where contracted, and supplier management. Measures are reviewed as the service architecture changes.
Subprocessors
LumaGrid may use subprocessors listed on the published subprocessor page under written data-protection terms. LumaGrid gives you reasonable advance notice of a material new subprocessor and considers your documented data-protection objection in good faith.
International transfers
Restricted transfers will use a lawful mechanism required by the applicable data-protection regime. Data locations and transfer safeguards must be completed after providers are selected.
Individual rights
Taking into account the nature of processing, LumaGrid will reasonably assist you with requests from individuals where you cannot fulfil the request without LumaGrid.
Incidents
LumaGrid will notify you without undue delay after confirming a personal-data breach affecting your data and will provide available information needed for your obligations. Notification is not an admission of fault.
Compliance assistance
LumaGrid will provide reasonable information for security, breach, impact-assessment and regulator-consultation duties relevant to the service, subject to confidentiality, proportionality and tariff or agreed professional-service terms.
Return and deletion
At termination, LumaGrid will return or delete your personal data according to the export/deletion window, unless law requires retention. Backup deletion may follow the documented backup cycle.
Audit
LumaGrid will make appropriate compliance information available and support reasonable audits under agreed confidentiality, scope, frequency, security and cost protections. Independent assurance may replace intrusive audits where appropriate.
Processing details
Subject matter: hosting and support. Duration: the service term plus deletion/retention periods. Nature: storage, transmission, backup where contracted, access for support and security operations, and deletion. You determine the data subjects and categories and must record them in the order or DPA annex.
Precedence
If this DPA conflicts with general terms on protection of your personal data, the DPA controls. Mandatory data-protection law remains unaffected.