Data Processing Addendum

Effective Date: October 5, 2026

This Data Processing Addendum ("DPA") supplements the Loomis Terms of Service. It outlines the obligations of the parties regarding the processing of personal data under GDPR Article 28.

1. Roles and Scope

Controller: The Business Client (Tenant) acts as the Data Controller.
Processor: Loomis Technologies LLC acts as the Data Processor.
Scope: The processing of personal data is solely for the purpose of operating the AI chatbot on behalf of the controller.

2. Processing Instructions

The Processor shall process personal data only on documented instructions from the Controller, unless required by applicable law.

3. Confidentiality

The Processor shall ensure that persons authorized to process the personal data have committed themselves to confidentiality.

4. Sub-processors

The Controller authorizes the Processor to engage the following sub-processors:

  • Google LLC
  • Supabase Inc.
  • Stripe Inc.
  • Meta Platforms Inc.
  • Telegram FZ-LLC

5. Security of Processing

The Processor shall implement appropriate technical and organizational measures to ensure security, including AES-128 encryption for credentials, access controls, and Row Level Security (RLS) database isolation.

6. Data Subject Rights

The Processor shall assist the Controller by appropriate technical and organizational measures for the fulfillment of the Controller's obligation to respond to requests for exercising the data subject's rights (e.g., access, deletion, portability).

7. Deletion or Return of Data

Upon termination of the provision of services, the Processor shall, at the choice of the Controller, delete or return all personal data to the Controller, unless law requires storage of the personal data.

8. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with these obligations and allow for and contribute to audits.

9. Standard Contractual Clauses

International transfers of data shall be governed by the EU Standard Contractual Clauses (2021/914 Module 2).

10. Governing Law

This DPA shall be governed by the laws of Wyoming, USA, without regard to conflict of law principles.