Data Processing Addendum

Last updated: April 2026

This Data Processing Addendum ("DPA") forms part of the agreement between Emergia Marketing LLC (d/b/a Lumenaios) ("Processor") and the Client ("Controller") for the provision of services described in the main agreement.

1. Roles

Client is the Controller of personal data submitted to or processed by Lumenaios. Lumenaios is the Processor and processes data only on documented instructions from the Client.

2. Categories of data

• Lead contact information (name, phone, email, address)
• Call recordings and transcriptions
• SMS message content
• Campaign performance metrics
• Account user information (name, email, role)

3. Subprocessors

Client authorizes Lumenaios to engage subprocessors as listed in the Privacy Policy. Lumenaios will provide notice of changes and the opportunity to object.

4. Security

Lumenaios implements appropriate technical and organizational measures including: encryption at rest and in transit, row-level security in the database, role-based access controls, audit logs, and tenant isolation per client.

5. Breach notification

Lumenaios will notify Client without undue delay (within 72 hours of confirmation) of any personal data breach affecting Client data, with scope, impact, and remediation steps.

6. Data subject rights

Lumenaios will assist Client in responding to data subject requests (access, deletion, correction) within 10 business days of receiving a documented request.

7. International transfers

All processing occurs within the United States. Lumenaios does not transfer Client data outside the US.

8. Term and termination

This DPA remains in effect for the duration of the main agreement. Upon termination, Lumenaios will return or delete Client data per the retention schedule in the Privacy Policy.

9. Contact

Data Protection contact: privacy@lumenaios.com