EXHIBIT C
DATA PROCESSING AGREEMENT
to the Channel Reseller Program Agreement dated March 22, 2024
between
LUMOS ANALYTICS INC. a Delaware C-Corporation ("Lumos" or "Processor")
and
MERIDIAN DATA SOLUTIONS GmbH a GmbH registered under German law ("Meridian" or "Controller")
This Data Processing Agreement ("DPA") is entered into as of March 22, 2024 and becomes effective April 1, 2024. This DPA constitutes Exhibit C to the Channel Reseller Program Agreement (the "Principal Agreement") between Lumos Analytics Inc., a Delaware C-Corporation with its principal place of business at 4700 Sandhill Road, Suite 300, Palo Alto, CA 94304 (the "Licensor"), and Meridian Data Solutions GmbH, a GmbH registered at Amtsgericht München, HRB 274581, with its principal place of business at Leopoldstraße 78, 80802 München, Germany (the "Reseller").
Right-click to update Table of Contents
RECITALS
WHEREAS, the parties have entered into the Channel Reseller Program Agreement dated March 22, 2024 (the "Principal Agreement"), pursuant to which Lumos has appointed Meridian as its authorized, non-exclusive reseller of Lumos Prism™ SaaS subscriptions in the EMEA Territory (as defined in the Principal Agreement and Exhibit B thereto);
WHEREAS, in the course of performing its obligations under the Principal Agreement, Lumos will Process Personal Data on behalf of Meridian and/or Meridian's end-user customers in the EMEA Territory in connection with the provision, hosting, maintenance, and technical support of the Lumos Prism™ AI-powered financial analytics and risk-modeling SaaS platform;
WHEREAS, the parties intend to ensure that all Processing of Personal Data undertaken pursuant to or in connection with the Principal Agreement complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), the United Kingdom General Data Protection Regulation as incorporated into United Kingdom law by the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (the "UK GDPR"), and all other applicable data protection and privacy legislation in force in any jurisdiction within the EMEA Territory;
WHEREAS, Lumos Analytics Inc. is a Delaware C-Corporation, EIN 84-3291056, headquartered at 4700 Sandhill Road, Suite 300, Palo Alto, California 94304, United States of America;
WHEREAS, Meridian Data Solutions GmbH is a Gesellschaft mit beschränkter Haftung organized under the laws of the Federal Republic of Germany, registered at Amtsgericht München under HRB 274581, with its headquarters at Leopoldstraße 78, 80802 München, Germany;
WHEREAS, because the Processing of Personal Data under the Principal Agreement will involve the transfer of Personal Data from the European Economic Area and the United Kingdom to the United States of America, where Lumos is headquartered, the parties wish to incorporate the Standard Contractual Clauses adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 to provide appropriate safeguards for the protection of Personal Data in connection with such cross-border transfers; and
WHEREAS, the parties further wish to incorporate the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the United Kingdom Information Commissioner's Office pursuant to Section 119A(1) of the Data Protection Act 2018, to the extent that Personal Data is transferred from the United Kingdom to the United States.
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:
SECTION 1 — DEFINITIONS AND INTERPRETATION
1.1 Definitions. For the purposes of this DPA, the following terms shall have the meanings set forth below:
"Applicable Data Protection Law" means the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection (FADP), and any other applicable data protection, privacy, or electronic communications legislation of any EU/EEA Member State, the United Kingdom, or any other country within the EMEA Territory, in each case as amended, supplemented, or superseded from time to time, together with any binding guidance, codes of practice, or approved codes of conduct issued by competent supervisory authorities thereunder.
"Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, as defined by Article 4(7) of the GDPR. In the context of this DPA, the Controller is Meridian Data Solutions GmbH and/or end-user customers in the EMEA Territory who use the Lumos Prism™ platform and on whose behalf Lumos Processes Personal Data.
"Data Subject" means an identified or identifiable natural person whose Personal Data is Processed under or in connection with this DPA.
"EEA" means the European Economic Area, comprising the Member States of the European Union together with Iceland, Liechtenstein, and Norway.
"EMEA Territory" means all countries within Europe (including the United Kingdom, Switzerland, and non-EU European states), the Middle East, and Africa, as more fully defined and listed in Exhibit B to the Principal Agreement.
"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
"Lumos Prism™" means Lumos's proprietary AI-powered financial analytics and risk-modeling software-as-a-service (SaaS) platform, which constitutes the licensed product under the Principal Agreement, including all updates, patches, enhancements, and new releases made available to Meridian and its end-user customers during the term of the Principal Agreement.
"Personal Data" means any information relating to an identified or identifiable natural person (i.e., a Data Subject) as defined by Article 4(1) of the GDPR. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed, as defined by Article 4(12) of the GDPR.
"Processing" (and its cognates, including "Process," "Processed," and "Processes") means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction, as defined by Article 4(2) of the GDPR.
"Processor" means a natural or legal person, public authority, agency, or other body which Processes Personal Data on behalf of the Controller, as defined by Article 4(8) of the GDPR. In the context of this DPA, the Processor is Lumos Analytics Inc.
"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, as annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as may be amended, supplemented, or replaced from time to time by the European Commission. Unless otherwise specified, references to the SCCs in this DPA are to Module Two (Controller-to-Processor) thereof.
"Sub-Processor" means any third party (including any affiliate of Lumos, but excluding Lumos's own employees) engaged by Lumos, or by any subsequent Sub-Processor, to Process Personal Data on behalf of the Controller in connection with the provision of the Lumos Prism™ platform.
"UK GDPR" means the United Kingdom General Data Protection Regulation, being the GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019, and as read together with the Data Protection Act 2018.
"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0, issued by the UK Information Commissioner under Section 119A(1) of the Data Protection Act 2018, as may be revised from time to time by the UK Information Commissioner in accordance with the mandatory clauses thereof.
1.2 Interpretation.
1. Capitalized terms used but not defined in this DPA shall have the meanings ascribed to them in the Principal Agreement.
2. References in this DPA to specific Articles of the GDPR shall be construed as including corresponding or equivalent provisions of the UK GDPR and any other Applicable Data Protection Law, unless the context requires otherwise.
3. References to any statute, regulation, or legislative instrument shall include any amendment, re-enactment, or successor legislation thereto.
4. The headings in this DPA are for convenience of reference only and shall not affect the interpretation of any provision.
5. Words importing the singular include the plural and vice versa, and words importing any gender include all genders.
6. In the event of any conflict or inconsistency between the provisions of this DPA and the provisions of the Principal Agreement, this DPA shall prevail with respect to all matters relating to data protection, the Processing of Personal Data, and the rights and obligations of the parties as Controller and Processor, respectively. In the event of any conflict between this DPA (excluding the SCCs and UK Addendum) and the SCCs or UK Addendum, the SCCs or UK Addendum (as applicable) shall prevail.
SECTION 2 — SCOPE AND ROLES
2.1 Scope of Processing
This DPA applies to all Personal Data Processed by Lumos in connection with the provision, hosting, operation, maintenance, and technical support of the Lumos Prism™ platform as contemplated by the Principal Agreement. Without limitation, this DPA covers Personal Data Processed in connection with:
(a) the provisioning of user accounts and authentication credentials for end-user customers and their authorized users in the EMEA Territory;
(b) the operation of the Lumos Prism™ platform, including the receipt, storage, analysis, and return of data uploaded by end-user customers;
(c) platform performance monitoring, usage analytics, and optimization;
(d) the provision of technical support and incident resolution services;
(e) subscription billing and payment processing; and
(f) any other Processing activities undertaken by Lumos on behalf of the Controller in connection with the Principal Agreement.
This DPA applies equally to Personal Data Processed in connection with the activities of Meridian's approved sub-distributors, Meridian Data Solutions UK Ltd and Meridian Data Solutions SARL, and their respective end-user customers in the EMEA Territory.
The subject matter, duration, nature, and purpose of the Processing, the categories of Data Subjects, and the categories of Personal Data are described in detail in Annex I to this DPA.
2.2 Roles of the Parties
The parties acknowledge and agree that, with respect to the Personal Data Processed through the Lumos Prism™ platform:
(a) Meridian (and/or its end-user customers in the EMEA Territory) acts as Controller, determining the purposes and means of the Processing of Personal Data. Where an end-user customer of Meridian determines the purposes and means of Processing with respect to its own Personal Data, such end-user customer is the Controller and Meridian acts in an intermediary capacity under the Principal Agreement.
(b) Lumos acts as Processor, Processing Personal Data solely on behalf of and in accordance with the documented instructions of the Controller. Lumos does not determine the purposes or means of the Processing of Personal Data in connection with the Lumos Prism™ platform, except to the extent necessary for the provision of the platform in accordance with the Principal Agreement and this DPA.
Nothing in this DPA shall be construed to make either party a joint controller with the other within the meaning of Article 26 of the GDPR, unless the parties enter into a separate written agreement expressly establishing a joint controllership arrangement.
2.3 Relationship to Sub-Distributors
The parties acknowledge that Meridian has designated the following entities as approved sub-distributors under the Principal Agreement:
(a) Meridian Data Solutions UK Ltd, a company incorporated in England and Wales, registered at Companies House under number 12847391, with its registered office at 14 Fenchurch Place, London EC3M 5AJ, United Kingdom, acting as sub-distributor for the UK and Ireland territory; and
(b) Meridian Data Solutions SARL, a société à responsabilité limitée organized under the laws of the French Republic, registered with the Registre du Commerce et des Sociétés under SIREN number 912 483 057, with its registered office at 27 Rue de la Boétie, 75008 Paris, France, acting as sub-distributor for France, Belgium, Luxembourg, and French-speaking Switzerland.
Where either of the foregoing sub-distributors acts in its capacity as sub-distributor under the Principal Agreement and its end-user customers are Controllers with respect to Personal Data Processed through the Lumos Prism™ platform, this DPA shall apply mutatis mutandis to the Processing of those end-user customers' Personal Data. The sub-distributors may accede to the SCCs incorporated in this DPA as additional data exporters pursuant to the Docking Clause (Clause 7 of the SCCs).
SECTION 3 — OBLIGATIONS OF THE CONTROLLER (MERIDIAN)
3.1 Lawful Basis for Processing
Meridian shall ensure, and shall use commercially reasonable efforts to ensure that each of its end-user customers has ensured, that there is a valid lawful basis under Article 6 of the GDPR (and, where applicable, a condition for Processing under Article 9 of the GDPR with respect to special categories of Personal Data) for all Processing of Personal Data that Meridian instructs Lumos to perform. Meridian shall further ensure that Data Subjects have been provided with all requisite transparency information pursuant to Articles 13 and 14 of the GDPR, including information regarding the transfer of Personal Data to Lumos as Processor and the engagement of Sub-Processors.
3.2 Instructions. Meridian shall provide Lumos with documented Processing instructions. The Principal Agreement, this DPA (including all Annexes), and the service specifications set forth in Exhibit E (Service Level Agreement) to the Principal Agreement constitute the initial documented instructions from the Controller to the Processor. Meridian shall ensure that any additional or supplementary Processing instructions issued to Lumos during the term of this DPA are lawful, reasonable, technically feasible, and consistent with Applicable Data Protection Law. Additional instructions shall be provided in writing (which, for the avoidance of doubt, includes electronic mail) and shall be directed to the Lumos contact identified in Section 6.1 of this DPA.
3.3 Controller's Compliance
Meridian is solely responsible for compliance with its obligations as Controller under Applicable Data Protection Law. Without limitation, Meridian shall be responsible for:
(a) determining the lawful basis for Processing;
(b) providing requisite notices to Data Subjects;
(c) responding to Data Subject requests in accordance with Chapter III of the GDPR (with the assistance of Lumos as provided in Section 4.6);
(d) conducting data protection impact assessments pursuant to Article 35 of the GDPR where required by the nature of the Processing; and
(e) consulting with the competent supervisory authority pursuant to Article 36 of the GDPR where required.
SECTION 4 — OBLIGATIONS OF THE PROCESSOR (LUMOS)
4.1 Processing Instructions
Lumos shall Process Personal Data only on the basis of documented instructions from the Controller, including with respect to transfers of Personal Data to a third country or an international organization, unless required to do so by Union or Member State law to which the Processor is subject. In such a case, Lumos shall inform the Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest. Lumos shall immediately inform the Controller if, in Lumos's opinion, an instruction from the Controller infringes the GDPR, the UK GDPR, or any other Applicable Data Protection Law.
4.2 Confidentiality. Lumos shall ensure that all persons authorized to Process Personal Data under this DPA, including Lumos's employees, contractors, and agents, have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Such confidentiality obligations shall survive the termination or expiration of the relevant individual's engagement with Lumos. Lumos shall ensure that access to Personal Data is limited to those personnel who require access in order to perform the Processing activities described in this DPA and the Principal Agreement.
4.3 Security Measures
Lumos shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk presented by the Processing, in accordance with Article 32 of the GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. The specific technical and organizational measures implemented by Lumos as of the Effective Date are described in detail in Annex II to this DPA. Such measures include, without limitation:
(a) the encryption of Personal Data in transit (using TLS 1.2 or higher) and at rest (using AES-256 encryption);
(b) the pseudonymization of user identifiers in analytics processing pipelines where feasible;
(c) measures to ensure the ongoing confidentiality, integrity, availability, and resilience of Processing systems and services, including role-based logical access controls, multi-factor authentication for administrative access, network segmentation, firewall protections, and intrusion detection and prevention systems;
(d) the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident, including through automated daily backups with off-site storage within the EU, and a disaster recovery plan with a Recovery Time Objective (RTO) of four (4) hours and a Recovery Point Objective (RPO) of one (1) hour; and
(e) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing, including annual SOC 2 Type II audits, periodic internal data protection audits, and regular employee training on data protection and information security.
Lumos shall review and, where appropriate, update the technical and organizational measures from time to time to reflect changes in the state of the art, applicable regulatory requirements, and the risk profile of the Processing. Any material changes to the measures described in Annex II shall be communicated to the Controller in writing.
4.4 Data Localization
Lumos shall host and maintain all EMEA customer Personal Data on EU-based cloud infrastructure, specifically the Frankfurt am Main, Germany data center operated by Stratos Cloud Services AG (registered address: Bahnhofstrasse 42, 8001 Zürich, Switzerland), which holds ISO 27001 and SOC 2 Type II certifications.
Personal Data shall not be transferred outside the EEA or the United Kingdom except:
(a) to the United States of America, in accordance with the Standard Contractual Clauses (Module Two — Controller-to-Processor) incorporated in this DPA pursuant to Section 5, and subject to the technical and organizational measures described in Annex II; or
(b) as otherwise permitted by Applicable Data Protection Law, and only with the Controller's prior written consent, which consent shall specify the destination country, the categories of Personal Data to be transferred, and the transfer mechanism relied upon.
4.5 Sub-Processing. (a) Authorization. Lumos shall not engage any Sub-Processor to carry out specific Processing activities on behalf of the Controller without the prior specific or general written authorization of the Controller.
(b) General Authorization. The Controller hereby provides general written authorization for Lumos to engage the Sub-Processors identified in Annex III to this DPA as of the Effective Date. The list of Sub-Processors set forth in Annex III is the complete and exhaustive list of Sub-Processors engaged by Lumos as of the Effective Date.
(c) Notification of Changes. Lumos shall notify the Controller in writing of any intended changes to the list of Sub-Processors (whether by addition of a new Sub-Processor or replacement of an existing Sub-Processor) at least thirty (30) calendar days prior to engaging the new Sub-Processor. Such notification shall include: (i) the name and registered address of the proposed Sub-Processor; (ii) a description of the Processing to be performed by the proposed Sub-Processor; (iii) the location(s) of the Processing; and (iv) a summary of the measures taken to ensure the proposed Sub-Processor's compliance with Applicable Data Protection Law.
(d) Objection. The Controller may object to any proposed new Sub-Processor on reasonable grounds related to data protection by providing written notice to Lumos within fifteen (15) calendar days of receiving Lumos's notification. If the Controller objects, the parties shall negotiate in good faith to resolve the objection within a reasonable period not to exceed thirty (30) calendar days from the date of the Controller's objection. If the parties are unable to resolve the objection within such period, the Controller may terminate this DPA and the relevant Processing activities affected by the proposed Sub-Processor, without prejudice to any other rights or remedies available to the Controller under the Principal Agreement or Applicable Data Protection Law.
(e) Sub-Processor Agreements. Lumos shall impose on each Sub-Processor, by way of a written agreement, data protection obligations that are no less protective than those set out in this DPA, including, in particular, sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the Processing will meet the requirements of the GDPR and this DPA.
(f) Liability. Lumos shall remain fully liable to the Controller for the performance of each Sub-Processor's obligations under this DPA and Applicable Data Protection Law. Where a Sub-Processor fails to fulfill its data protection obligations, Lumos shall be liable to the Controller for the acts and omissions of the Sub-Processor as if they were the acts and omissions of Lumos itself.
4.6 Assistance with Data Subject Rights
Lumos shall assist the Controller, by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Controller's obligations to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR, including but not limited to the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of Processing (Article 18), data portability (Article 20), and objection (Article 21). Such assistance shall include, without limitation, promptly implementing technical configurations to facilitate Data Subject requests and providing the Controller with relevant information held by Lumos that is necessary to respond to such requests.
If Lumos receives a request directly from a Data Subject with respect to Personal Data Processed under this DPA, Lumos shall promptly (and in any event within five (5) business days) notify the Controller of such request. Lumos shall not respond to such request independently without the Controller's prior written instructions, except to inform the Data Subject that Lumos is a Processor acting on behalf of the Controller and to direct the Data Subject to contact the Controller.
4.7 Assistance with Compliance Obligations
Lumos shall assist the Controller in ensuring compliance with its obligations under Articles 32 through 36 of the GDPR, taking into account the nature of the Processing and the information available to Lumos. Such assistance shall include, without limitation:
(a) Security of Processing (Article 32): cooperation with the Controller in implementing and maintaining appropriate technical and organizational security measures as described in Annex II;
(b) Notification of Personal Data Breaches to Supervisory Authorities (Article 33): providing timely notification and supporting information as described in Section 4.8 below;
(c) Communication of Personal Data Breaches to Data Subjects (Article 34): assisting the Controller in preparing communications to affected Data Subjects, including providing information regarding the nature and scope of the breach;
(d) Data Protection Impact Assessments (Article 35): providing the Controller with information reasonably necessary to conduct data protection impact assessments relating to the Processing activities performed by Lumos under this DPA; and
(e) Prior Consultation with Supervisory Authorities (Article 36): cooperating with the Controller and providing information reasonably requested in connection with any prior consultation with a supervisory authority regarding the Processing activities under this DPA.
4.8 Personal Data Breach Notification
(a) Notification. Lumos shall notify the Controller without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Personal Data Processed under this DPA. Such notification shall be directed to the Controller's designated contact identified in Section 6.2 of this DPA (or such other contact as the Controller may designate in writing) and shall be provided by electronic mail with a follow-up telephone call to confirm receipt.
(b) Content of Notification. The notification shall include, to the extent reasonably available at the time of notification, the following information:
(i) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned;
(ii) the name and contact details of Lumos's data protection contact or other contact point from which further information may be obtained;
(iii) a description of the likely consequences of the Personal Data Breach; and
(iv) a description of the measures taken or proposed to be taken by Lumos to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.
(c) Supplementary Information. Where it is not possible to provide all of the foregoing information simultaneously, Lumos shall provide the information in phases without undue further delay as additional information becomes available.
(d) Cooperation and Remediation. Lumos shall cooperate with the Controller and take all commercially reasonable steps to assist in the investigation, mitigation, and remediation of the Personal Data Breach. Lumos shall maintain a written record of all Personal Data Breaches, including the facts relating to the breach, its effects, and the remedial action taken, and shall make such records available to the Controller and, where required, to the competent supervisory authority.
4.9 Deletion and Return of Data
(a) Controller Election. Upon termination or expiration of the Principal Agreement, or upon the earlier written request of the Controller, Lumos shall, at the Controller's election (to be communicated in writing):
(i) return all Personal Data to the Controller in a commonly used, machine-readable format (such as CSV, JSON, or via API), together with any copies thereof; or
(ii) securely delete all Personal Data in its possession, including all copies thereof, using industry-standard methods (e.g., cryptographic erasure),
unless applicable law (including applicable U.S. federal or state law) requires the continued storage of some or all of the Personal Data, in which case Lumos shall inform the Controller of such requirement and shall continue to protect the retained Personal Data in accordance with this DPA.
(b) Certification. Following completion of the deletion or return of Personal Data, Lumos shall certify to the Controller in writing, signed by an authorized officer of Lumos, that it has complied with the obligations set forth in this Section 4.9.
(c) Post-Termination Wind-Down Period. The obligations in this Section 4.9 are subject to the post-termination wind-down period of up to twelve (12) months as set forth in the Principal Agreement, during which Lumos may retain Personal Data to the extent necessary to fulfill existing end-user subscription obligations. Upon expiration of the wind-down period, Lumos shall promptly complete the deletion or return in accordance with this Section 4.9.
4.10 Audit and Inspection
(a) Information. Lumos shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and Article 28 of the GDPR.
(b) Audit Rights. Lumos shall allow for and contribute to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller, subject to the following conditions:
(i) audits shall be conducted no more than once per calendar year, except in the event of a Personal Data Breach or where required by a competent supervisory authority;
(ii) the Controller shall provide Lumos with at least thirty (30) calendar days' prior written notice of any proposed audit, specifying the scope, timing, and duration of the audit;
(iii) all auditors (whether the Controller's personnel or third-party auditors) shall be bound by written confidentiality obligations no less protective than those contained in the Principal Agreement;
(iv) audits shall be conducted during normal business hours (8:00 a.m. to 6:00 p.m. Pacific Time, Monday through Friday, excluding U.S. federal holidays) and shall be conducted in a manner that does not unreasonably disrupt Lumos's operations or the operations of any other customer of Lumos; and
(v) the Controller shall bear its own costs in connection with any audit, including the fees and expenses of any third-party auditor engaged by the Controller.
(c) SOC 2 Reports. Lumos may, at its reasonable discretion, satisfy the Controller's audit requests by providing the Controller with copies of Lumos's most recent SOC 2 Type II audit report (or equivalent independent third-party certification or audit report), provided that such report addresses the subject matter of the Controller's audit request. Provision of such report shall be deemed to satisfy the Controller's audit rights under this Section 4.10 for the period covered by the report, except where the Controller reasonably demonstrates that the report does not adequately address a specific compliance concern.
SECTION 5 — CROSS-BORDER DATA TRANSFERS
5.1 Transfer Mechanism
The parties acknowledge that the Processing of Personal Data under this DPA involves the transfer of Personal Data from the EEA and the United Kingdom to the United States of America, where Lumos is headquartered at 4700 Sandhill Road, Suite 300, Palo Alto, California 94304. To ensure that such transfers are made in compliance with Applicable Data Protection Law, the parties agree that transfers of Personal Data from the EEA to the United States shall be governed by the Standard Contractual Clauses (Module Two — Controller-to-Processor) as set forth in the Appendix to this DPA and incorporated by reference herein, and that transfers of Personal Data from the United Kingdom to the United States shall be governed by the UK Addendum as set forth in Annex IV to this DPA.
5.2 EU Standard Contractual Clauses
The Standard Contractual Clauses adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 are hereby incorporated by reference in their entirety into this DPA and shall form an integral part hereof. The parties agree that the following module and options shall apply:
(a) Module: Module Two (Controller-to-Processor) shall apply to all transfers of Personal Data from the Controller (data exporter) to the Processor (data importer) under this DPA.
(b) Clause 7 (Docking Clause): The optional docking clause is included. Accordingly, additional data exporters (including Meridian Data Solutions UK Ltd and Meridian Data Solutions SARL) or additional data importers may accede to the SCCs in accordance with the terms of Clause 7, subject to the agreement of all existing parties.
(c) Clause 9(a) (Use of Sub-Processors): Option 2 (General Written Authorization) shall apply. The data importer (Lumos) has the Controller's general written authorization for the engagement of the Sub-Processors listed in Annex III. The data importer shall inform the data exporter of any intended changes to the list of Sub-Processors by way of addition or replacement at least thirty (30) calendar days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the Sub-Processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.
(d) Clause 11 (Redress): The optional clause providing for the involvement of an independent dispute resolution body is not included.
(e) Clause 13(a) (Supervisory Authority): The competent supervisory authority shall be the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA — Bavarian Data Protection Authority), Promenade 18, 91522 Ansbach, Germany, being the supervisory authority with responsibility for ensuring compliance with Regulation (EU) 2016/679 with regard to the data exporter's establishment in Germany.
(f) Clause 17 (Governing Law): Option 1 shall apply. The SCCs shall be governed by the law of the Federal Republic of Germany.
(g) Clause 18 (Choice of Forum and Jurisdiction): Any dispute arising from the SCCs shall be resolved by the courts of München, Germany.
The Annexes to the SCCs are completed as set forth in Annexes I, II, and III to this DPA.
5.3 UK International Data Transfer Addendum
For transfers of Personal Data from the United Kingdom to the United States, the UK Addendum (International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0, issued by the UK Information Commissioner under Section 119A(1) of the Data Protection Act 2018) is incorporated into this DPA and completed as follows:
(a) Part 1, Table 1 (Parties):
• Start Date: April 1, 2024
• Data Exporter(s): Meridian Data Solutions GmbH, Leopoldstraße 78, 80802 München, Germany (and Meridian Data Solutions UK Ltd, 14 Fenchurch Place, London EC3M 5AJ, United Kingdom, acting in its capacity as sub-distributor for the UK and Ireland territory);
• Data Importer: Lumos Analytics Inc., 4700 Sandhill Road, Suite 300, Palo Alto, CA 94304, United States.
(b) Part 1, Table 2 (Selected SCCs, Modules, and Selected Clauses): The Approved EU SCCs referenced in Section 5.2 of this DPA shall apply, being Module Two (Controller-to-Processor), with the specific clause selections set forth in Section 5.2(a) through (g) above.
(c) Part 1, Table 3 (Appendix Information): The Appendix Information is as set forth in Annexes I, II, and III to this DPA.
(d) Part 1, Table 4 (Ending this Addendum when the Approved Addendum Changes): Either party may end the UK Addendum as set out in Section 19 of the mandatory clauses of the UK Addendum.
The UK Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, shall be the competent supervisory authority for UK transfers.
5.4 Transfer Impact Assessment
Lumos shall cooperate with Meridian (and its UK/EU regulatory counsel, Thornbridge Whitaker LLP, 22 Bishopsgate, London EC2N 4BQ, United Kingdom) in conducting any Transfer Impact Assessment required to supplement the Standard Contractual Clauses in accordance with the guidance of the European Data Protection Board and the UK Information Commissioner's Office. Such cooperation shall include, without limitation:
(a) providing information regarding the legal framework applicable in the United States with respect to government surveillance and law enforcement access, including relevant provisions of the Foreign intelligence Surveillance Act (FISA), Executive Order 12333, the CLOUD Act, and any other applicable legislation;
(b) disclosing Lumos's experience with government access requests (including the volume and types of any such requests received, to the extent not prohibited by law), and providing transparency reports where available;
(c) describing the technical and organizational measures implemented by Lumos to protect transferred Personal Data against government access, including encryption, access controls, and data segregation measures as set forth in Annex II; and
(d) engaging in good faith consultations with the Controller and its regulatory counsel to assess whether supplementary measures are necessary and, if so, implementing such measures in a timely manner.
5.5 Alternative Transfer Mechanisms
If, at any time during the term of this DPA, an alternative valid transfer mechanism becomes available under Applicable Data Protection Law that would permit the lawful transfer of Personal Data from the EEA or the United Kingdom to the United States without reliance on the SCCs or the UK Addendum (including, without limitation, an adequacy decision adopted by the European Commission or the UK Secretary of State, an approved certification mechanism pursuant to Article 42 of the GDPR, or an approved code of conduct pursuant to Article 40 of the GDPR), the parties may agree in writing to rely on such alternative mechanism in place of, or in addition to, the SCCs and/or the UK Addendum, provided that such alternative mechanism provides appropriate safeguards for the protection of Personal Data in accordance with Applicable Data Protection Law.
SECTION 6 — DATA PROTECTION OFFICER AND CONTACTS
6.1 Lumos Contact
Lumos's designated contact for all data protection matters arising under this DPA shall be:
Daniel Ostroff Vice President, Legal & Compliance Lumos Analytics Inc. 4700 Sandhill Road, Suite 300 Palo Alto, CA 94304 United States of America
Email: d.ostroff@lumosanalytics.com
Telephone: +1 (650) 555-0172
6.2 Meridian Contact
Meridian's designated contact for all data protection matters arising under this DPA shall be:
Dr. Anneliese Brandt General Counsel Meridian Data Solutions GmbH Leopoldstraße 78 80802 München, Germany
Email: a.brandt@meridiandata.de
Telephone: +49 (89) 555-0234
Each party shall promptly notify the other in writing of any change to its designated contact.
SECTION 7 — LIABILITY AND INDEMNIFICATION
7.1 Liability. Each party's liability arising under or in connection with this DPA (including the SCCs and the UK Addendum) shall be subject to the limitations and exclusions of liability set forth in the Principal Agreement, including the aggregate indemnification cap of Fifteen Million United States Dollars ($15,000,000), which represents fifty percent (50%) of the total contract value (TCV) of the Principal Agreement. Notwithstanding the foregoing, the parties acknowledge that, pursuant to the Principal Agreement, breaches of confidentiality obligations (including the unauthorized disclosure, loss, or misuse of Personal Data attributable to a party's breach of this DPA) are expressly excluded from the aggregate liability cap and are therefore uncapped. Nothing in this Section 7.1 shall limit or exclude any liability that cannot be limited or excluded under Applicable Data Protection Law, including liability to Data Subjects under the GDPR or UK GDPR.
7.2 Indemnification. Lumos shall indemnify, defend, and hold harmless Meridian, its affiliates, and their respective officers, directors, employees, and agents from and against any and all third-party claims, actions, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and regulatory fines, to the extent permissible by law) arising from or in connection with Lumos's breach of this DPA or Applicable Data Protection Law, to the extent that such claims are solely caused by Lumos's acts or omissions. The indemnification obligations set forth in this Section 7.2 are subject to the indemnification procedures set forth in the Principal Agreement, including the requirements for prompt notice, cooperation, and sole control of the defense.
SECTION 8 — TERM AND TERMINATION
8.1 Term. This DPA shall become effective on April 1, 2024 (the "Effective Date"), being the Effective Date of the Principal Agreement, and shall remain in full force and effect for the entire duration of the Principal Agreement, including any renewal periods. The initial term of the Principal Agreement is five (5) years, commencing April 1, 2024 and expiring March 31, 2029, with automatic renewal for successive one (1)-year periods unless either party provides written notice of non-renewal at least ninety (90) days prior to the end of the then-current term (i.e., by December 31, 2028 for the initial term). This DPA shall co-terminate with the Principal Agreement and shall not be renewed independently of the Principal Agreement.
8.2 Survival. The following provisions of this DPA shall survive the termination or expiration of this DPA and the Principal Agreement for any reason, and shall continue in full force and effect until all obligations thereunder have been satisfied:
(a) Section 4.9 (Deletion and Return of Data);
(b) Section 4.10 (Audit and Inspection), to the extent that Lumos retains any Personal Data following termination;
(c) Section 5 (Cross-Border Data Transfers), to the extent that Personal Data continues to be Processed or retained following termination;
(d) Section 7 (Liability and Indemnification); and
(e) this Section 8.2.
8.3 Termination. This DPA may not be terminated independently of the Principal Agreement, except as expressly provided in Section 4.5(d) of this DPA (Controller's right to terminate in the event of an unresolved objection to a proposed Sub-Processor). Any termination of the Principal Agreement shall automatically result in the termination of this DPA, subject to the survival provisions set forth in Section 8.2.
SECTION 9 — GOVERNING LAW AND DISPUTE RESOLUTION
9.1 Governing Law
This DPA (excluding the SCCs and the UK Addendum) shall be governed by and construed in accordance with the laws of the State of California, United States of America, without regard to its conflict of laws principles, consistent with the governing law provision of the Principal Agreement. Notwithstanding the foregoing, to the extent that Applicable Data Protection Law mandates the application of the law of an EU/EEA Member State or the United Kingdom with respect to data protection matters (including the rights of Data Subjects, the obligations of Controllers and Processors, and the enforcement powers of supervisory authorities), such mandatory provisions shall apply.
The Standard Contractual Clauses incorporated into this DPA pursuant to Section 5.2 shall be governed by the law of the Federal Republic of Germany, as specified in Clause 17 (Option 1) of the SCCs. The UK Addendum shall be governed by the laws of England and Wales.
9.2 Dispute Resolution
(a) General Disputes. Disputes arising under or in connection with this DPA (other than disputes arising under the SCCs or the UK Addendum) shall be resolved in accordance with the dispute resolution provisions set forth in the Principal Agreement. As provided therein, such disputes shall be submitted to binding arbitration administered by JAMS in Los Angeles, California, in accordance with JAMS's Comprehensive Arbitration Rules and Procedures, subject to the carve-out for injunctive or other equitable relief, which may be sought in state or federal courts of competent jurisdiction located in Santa Clara County, California.
(b) SCC Disputes. Disputes arising under or in connection with the Standard Contractual Clauses incorporated in this DPA shall be resolved by the courts of München, Germany, in accordance with Clause 18 of the SCCs.
(c) UK Addendum Disputes. Disputes arising under or in connection with the UK Addendum shall be resolved in accordance with the dispute resolution provisions of the UK Addendum and the governing law of England and Wales.
SECTION 10 — MISCELLANEOUS
10.1 Amendments. This DPA (including its Annexes) may only be amended, modified, or supplemented by a written instrument duly executed by authorized representatives of both parties. No oral agreement, course of dealing, or trade usage shall be deemed to amend or modify any provision of this DPA. Notwithstanding the foregoing, the parties acknowledge that updates to the SCCs or the UK Addendum mandated by a competent regulatory authority shall be deemed incorporated into this DPA automatically upon their effective date, without the need for a separate written amendment.
10.2 Severability. If any provision of this DPA (or any portion thereof) is found by a court or tribunal of competent jurisdiction to be invalid, illegal, or unenforceable in any jurisdiction, such invalidity, illegality, or unenforceability shall not affect the validity or enforceability of the remaining provisions of this DPA, which shall continue in full force and effect. The parties shall negotiate in good faith to replace the invalid, illegal, or unenforceable provision with a valid, legal, and enforceable provision that, to the greatest extent possible, achieves the intended economic, legal, and commercial objectives of the original provision.
10.3 Entire Agreement
This DPA, together with its Annexes (Annex I — Description of the Processing; Annex II — Technical and Organizational Measures; Annex III — List of Pre-Approved Sub-Processors; and Annex IV — UK Addendum) and the Standard Contractual Clauses incorporated by reference herein, constitutes the entire agreement between the parties with respect to the Processing of Personal Data in connection with the Principal Agreement and supersedes all prior or contemporaneous oral or written agreements, representations, warranties, and understandings between the parties relating to such subject matter. In the event of any inconsistency between this DPA and any other exhibit or schedule to the Principal Agreement with respect to data protection matters, this DPA shall control.