Data processing agreement

1.1 This data processing agreement is concluded between Sales-Surge B.V., Professor W.H. Keesomlaan 12, 1183 DJ Amstelveen, the Netherlands, Chamber of Commerce (KvK) 99261758 ("Sales Surge", the processor), and the customer that has entered into an agreement about Lumo ("the customer", the controller).

1.2 The customer determines the purpose and means of processing personal data in its workspace. Sales Surge processes that data only on the customer's behalf.

1.3 Where Sales Surge itself determines purpose and means, such as for users' account data, invoicing and the security of Lumo, Sales Surge is the controller. That processing is described in the privacy statement and is not covered by this agreement.

1.4 This agreement supplements Article 9 of the General Terms and Conditions of Sales-Surge B.V. In case of conflict, the order of precedence in Article 2.3 of the General Terms applies. Terms from the GDPR have the meaning the GDPR gives them.

2.1 The subject matter of the processing is providing Lumo, a CRM for B2B teams, to the customer as SaaS.

2.2 This agreement applies for as long as the agreement about Lumo runs, and after that for as long as Sales Surge still processes the customer's personal data. That is until the data has been deleted, including from backups.

3.1 Sales Surge processes personal data to provide, secure and support Lumo. This includes:

• storing, organising and displaying data in the workspace
• sending mail and messages the customer writes or sets up in Lumo
• synchronising with services the customer or a user connects, such as Gmail, Google Calendar, Outlook and the Microsoft 365 calendar, Pipedrive or Facebook and Instagram lead forms
• running AI features, when the customer switches them on
• making backups and restoring data
• support at the customer's request

3.2 Sales Surge does not use this data for its own purposes and does not sell it.

4.1 The customer decides which data it puts in Lumo. Typically this is:

• contact details, such as name, email address, phone number, job title and organisation
• data about deals, quotes, activities, notes and files
• mail and calendar events from connected accounts
• tickets, chat messages and messages in the customer portal
• web form submissions
• consents and unsubscribes, and campaign interactions such as opens and clicks
• data about the customer's users and their actions in the audit log

4.2 The data subjects are typically the customer's contacts (prospects, clients, suppliers and their contact persons), visitors to the customer's website who use the chat widget or a form, campaign recipients, customer portal users and the customer's employees who use Lumo.

4.3 Lumo is not intended for special categories of personal data. If the customer puts such data in Lumo anyway, it is responsible for that itself.

5.1 Sales Surge processes the personal data only on documented instructions from the customer, including with regard to transfers to a third country. This does not apply where a legal obligation requires Sales Surge to process. Sales Surge then informs the customer in advance, unless the law prohibits that notice.

5.2 The agreement about Lumo, this data processing agreement and the settings the customer chooses in Lumo together form the customer's instructions.

5.3 If Sales Surge believes an instruction infringes the GDPR, it informs the customer straight away.

6.1 Sales Surge ensures that everyone who has access to the personal data on its behalf is bound to confidentiality, by agreement or by law.

6.2 Access is granted only to people who need it for their work on Lumo.

7.1 Sales Surge takes appropriate technical and organisational measures, as Article 32 GDPR requires. It takes into account the current state of technology, the costs and the risks of the processing.

7.2 The main measures at the date of this agreement are:

• encryption of connections (in transit)
• separation per workspace in the database, with row-level security
• two-step verification, which the customer can make mandatory for admins
• role-based access: Owner, Admin, Member and Viewer
• an audit log of changes and events that can only be added to
• a daily backup of the database

7.3 A fuller description is on the security and privacy page. Sales Surge may change measures as long as the level of security does not drop.

8.1 The customer gives Sales Surge general authorisation to engage sub-processors, as Article 9.3 of the General Terms describes. The current list, with purpose, location and safeguard, is on the sub-processors page.

8.2 Sales Surge informs the customer of any intended addition or replacement of a sub-processor. The customer can object within 14 days on reasonable, documented grounds.

8.3 Sales Surge imposes the same obligations as in this data processing agreement on every sub-processor by contract, as Article 28(4) GDPR requires.

8.4 Some sub-processors only receive data when a feature is on, such as the AI features. The list states this per provider. For the AI features Lumo only allows Anthropic's Claude API and Google's paid Gemini API. Under their terms those providers do not use the input to train models.

8.5 When the customer or a user connects its own account at another service, such as Gmail, Google Calendar, Outlook and the Microsoft 365 calendar, Pipedrive, Meta lead forms, Apollo or ProspectPro, Sales Surge exchanges data with that service on the customer's instruction. That service is then not a sub-processor of Sales Surge. The customer or user has its own agreement with that service.

9.1 Lumo has tools to export, anonymise and erase data about a person. With these, the customer can handle data subject requests itself.

9.2 If a data subject contacts Sales Surge with a request about data in the customer's workspace, Sales Surge forwards the request to the customer. Sales Surge does not respond to its substance without the customer's instructions.

9.3 Where the customer needs further help, Sales Surge assists, taking into account the nature of the processing.

10.1 Sales Surge notifies the customer of a personal data breach without undue delay, and in any event within 48 hours of becoming aware of it. This lets the customer meet its own 72-hour deadline under Article 33 GDPR. This is in line with Article 9.6 of the General Terms.

10.2 The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. If not everything is known yet, Sales Surge adds to the notice as soon as it can.

10.3 The customer decides whether to notify the supervisory authority and data subjects.

10.4 Sales Surge assists the customer with a data protection impact assessment (DPIA) and prior consultation under Articles 35 and 36 GDPR, with the information available to it.

11.1 During the term, the customer can export its data with the export functions in Lumo. That way it has its own copy when the agreement ends.

11.2 After the agreement ends, Sales Surge deletes the customer's personal data at the customer's request, unless the law requires storage.

11.3 Data in backups is retained according to the database provider's schedule and disappears once those backups rotate out. Until then, this agreement continues to apply to that data.

11.4 During the term, Lumo applies retention periods to personal data that has a retention setting: form answers, closed conversations, mail not linked to a contact and unlinked files. The default period is 2 years (730 days). The customer can change it per type. The audit log is append-only and is kept, so the customer can show who did what.

12.1 Sales Surge provides the customer with the information needed to demonstrate compliance with the obligations in Article 28 GDPR.

12.2 At the customer's request, Sales Surge cooperates with an audit by the customer or by an independent auditor bound to confidentiality. The customer gives reasonable notice of an audit. The audit is carried out in a way that does not unreasonably disrupt Sales Surge's business.

13.1 Lumo's database and file storage are in London, United Kingdom. The United Kingdom has an adequacy decision from the European Commission of June 2021.

13.2 Some sub-processors process data outside the EU and the United Kingdom, mainly in the United States, among others for the AI features. For the Gemini API, Google chooses the location. Those transfers take place under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914). The safeguard per provider is on the sub-processors page.

14.1 Liability under this agreement is governed by Article 10 of the General Terms. That limitation does not apply to liability that cannot be limited under mandatory law, such as liability towards data subjects under Article 82 GDPR.

14.2 Provisions that by their nature are meant to survive the end, such as confidentiality and deletion, remain in force.

14.3 This agreement is governed by Dutch law.

14.4 Contact about this agreement: info@sales-surge.nl, +31 6 5350 9843. See also the terms of use.