# LumiPad data processing addendum — discussion draft

Last verified: 2026-08-23
Status: not signed; legal review required.

This template is not legal advice and creates no processor/controller relationship, SLA or transfer mechanism until incorporated into a signed agreement. The parties must reconcile it with Vietnam's Personal Data Protection Law 91/2025/QH15, applicable child-data rules and, where relevant, GDPR Article 28 and a valid international-transfer mechanism.

## Parties and roles

- Customer/legal entity: `[TO COMPLETE]`
- LumiPad contracting entity: `[TO COMPLETE]`
- Customer role and lawful basis: `[TO COMPLETE]`
- LumiPad role for each processing activity: `[TO COMPLETE]`
- Effective date, term and precedence: `[TO COMPLETE]`

## Processing instructions

LumiPad will process personal data only on documented customer instructions within the configured service, signed order form and support requests, unless applicable law requires otherwise. The customer determines authorized users, educational purpose, notices, consent where required, retention and optional integrations.

## Annex A — processing description

| Field | Draft scope |
|---|---|
| Purpose | Operate an isolated collaborative learning workspace and agreed support |
| Data subjects | Authorized educators, learners, administrators and invited participants |
| Data | Account/role/school identifiers, user-provided board content, comments, attachments, audit/security metadata and optional integration data |
| Sensitive data | Not requested; customer must prevent unnecessary upload and document any approved exception |
| Duration | Pilot term plus signed export, retention and deletion periods |
| Geography | Current database endpoint indicates US East (Ohio); runtime/blob locations must be verified and written into the order form |

## Security and confidentiality baseline

Least-privilege server authorization, tenant scoping, encrypted transport, provider-managed storage encryption, private attachment access, protected secrets, audit logging, rate/body/origin controls, dependency/CI checks and controlled data export/deletion are the current technical baseline. This statement is not an ISO/SOC certification.

## Assistance and rights

The customer authenticates and validates requests. LumiPad will use its governed account/school export, correction, restriction/freeze and deletion workflows to provide reasonable assistance under the signed process. Response deadlines, contact channels and any fees must be completed in the order form.

## Security incidents

LumiPad will notify the named customer contact without undue delay after confirming a personal-data incident affecting the customer's pilot and will provide available scope, likely consequences, containment and remediation information. A numeric notification deadline is `[TO COMPLETE]` and applies only when signed; this draft does not promise one.

## Providers and changes

The dated registry in `docs/data-flow-and-subprocessors.md` is the review baseline. The parties must decide which services are processors/subprocessors or independent controllers for the actual configuration, the advance-notice period for material changes, and the objection/remedy process.

## International transfers

Before production data is entered, the parties must document applicable locations, transfer basis, supplementary safeguards and any required assessment. If GDPR applies, select and execute an appropriate Chapter V mechanism (including current Standard Contractual Clauses where applicable); a link to a vendor DPA alone is not proof that the customer-to-LumiPad transfer is complete.

## Return and deletion

At authorized exit, LumiPad provides the supported export, then follows the signed retention/hold/deletion instruction. Deletion uses preflight, freeze, recoverable stages and final authorization; provider backup expiry and legally required retention must be stated in the final schedule.

## Child data

The customer is responsible for age-appropriate notices and valid authorization/consent. For Vietnam, the final agreement must account for the rules applying to children aged seven or older and their legal representatives. Optional AI stays disabled until provider eligibility, paid-service data terms, DPA and under-18 controls are confirmed in writing.