Preamble
This Data Processing Agreement (“DPA”) forms part of the agreement between the Controller and Lumitech FZCO (“Processor”), operator of the Tolmete platform, governing the use of the Tolmete services (“Services Agreement”). This DPA sets out the terms on which the Processor will process Personal Data on behalf of the Controller in connection with the Tolmete platform.
This DPA applies to the extent that the processing of Personal Data is subject to the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, or any equivalent applicable data protection law in force in the Controller's jurisdiction.
1. Definitions
For the purposes of this DPA, the following definitions apply:
| Term | Definition |
|---|---|
| "GDPR" | Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. |
| "Personal Data" | Any information relating to an identified or identifiable natural person (Data Subject), as defined in Article 4(1) GDPR. |
| "Processing" | Any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion, as defined in Article 4(2) GDPR. |
| "Controller" | The entity that determines the purposes and means of processing Personal Data (the client company accepting this DPA). |
| "Processor" | Lumitech FZCO, which processes Personal Data on behalf of the Controller in providing the Tolmete platform. |
| "Data Subject" | The individual to whom Personal Data relates. |
| "Sub-processor" | Any third party engaged by the Processor to carry out processing activities on behalf of the Controller. |
| "Personal Data Breach" | A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data. |
| "Services" | The Tolmete platform and related features provided by the Processor, including time tracking, AI-generated summaries, Signals, invoicing, and the Client Portal. |
| "SCC" | Standard Contractual Clauses adopted by the European Commission for international transfers of Personal Data. |
2. Subject Matter, Nature, and Purpose of Processing
2.1 The Processor shall process Personal Data on behalf of the Controller solely for the purpose of providing the Services, which include:
Time tracking: recording time logs, projects, and activities contributed by the Controller's personnel.
AI-powered summaries: generating project, activity, and contributor summaries using AI on the basis of time log data.
Signals: analysing data from connected third-party sources (code repositories, project management tools, communication platforms) to generate productivity insights and mitigation plans.
Client Portal: sharing time logs, project summaries, and contributor data with the Controller's clients via a shared access link.
Invoice generation: creating invoices using time log data in conjunction with connected invoicing systems (Zoho, QuickBooks).
2.2 The full description of processing activities, categories of Personal Data processed, categories of Data Subjects, and applicable retention periods is set out in Annex A to this DPA.
2.3 The duration of processing corresponds to the term of the Services Agreement and any post-termination obligations set out in Section 11 of this DPA.
3. Obligations of the Controller
3.1 The Controller shall:
- ensure that it has a lawful basis for all Personal Data it makes available to the Processor for processing under this DPA;
- provide documented instructions to the Processor regarding the processing of Personal Data, and ensure that those instructions comply with applicable data protection law;
- ensure that Data Subjects have been informed about the processing of their Personal Data by the Tolmete platform, including the use of AI and connected third-party integrations, as required by Articles 13 and 14 GDPR;
- be responsible for the configuration and authorisation of third-party integrations (GitHub, Bitbucket, Jira, Asana, Slack, Microsoft Teams, Zoho, QuickBooks) within the Tolmete platform and for ensuring that any data obtained from those integrations may be lawfully processed under this DPA;
- notify the Processor without undue delay of any changes to instructions that affect the processing activities described in Annex A.
4. Obligations of the Processor
In accordance with Article 28 GDPR, the Processor shall:
4.1 Processing on Instructions
Process Personal Data only on the documented instructions of the Controller, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by applicable law; in such case, the Processor shall, to the extent permitted by law, inform the Controller of that legal requirement before processing.
4.2 Confidentiality
Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access to Personal Data is limited to those who require it for the performance of the Services.
4.3 Security (Article 32 GDPR)
Implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Section 5 and Annex B of this DPA.
4.4 Sub-processors (Article 28(2) GDPR)
Not engage a Sub-processor without the prior general written authorisation of the Controller. The Controller hereby grants general authorisation to the Sub-processors listed in Annex C. The Processor shall notify the Controller of any intended addition or replacement of Sub-processors with at least 30 days' prior notice, providing the Controller with an opportunity to object. Where the Controller objects on reasonable grounds relating to data protection, the parties shall discuss in good faith to resolve the objection.
4.5 Data Subject Rights
Take appropriate technical and organisational measures to assist the Controller in fulfilling its obligation to respond to requests from Data Subjects exercising their rights under Chapter III GDPR, including the rights of access, rectification, erasure, restriction, portability, and objection, taking into account the nature of the processing and the specific limitations described in Section 7.
4.6 Breach Notification (Articles 33–34 GDPR)
Notify the Controller of a Personal Data Breach in accordance with Section 8 of this DPA.
4.7 Deletion and Return of Data
Delete or return all Personal Data to the Controller at the Controller's choice, upon termination of the Services, and delete existing copies, in accordance with Section 11, unless applicable law requires storage of the Personal Data.
4.8 Audit Assistance
Make available to the Controller all information necessary to demonstrate compliance with the obligations set out in Article 28 GDPR, and allow for and contribute to audits conducted by the Controller or an auditor mandated by the Controller, subject to Section 12.
4.9 Notification of Unlawful Instructions
Immediately inform the Controller if, in the Processor's opinion, an instruction infringes the GDPR or other applicable data protection provisions, without prejudice to the Processor's obligation to process in accordance with the Controller's instructions pending any resolution.
5. Technical and Organisational Security Measures
The Processor maintains the following technical and organisational measures in accordance with Article 32 GDPR. A detailed description is provided in Annex B.
| Measure | Description |
|---|---|
| Encryption in transit | All data transmitted between client applications and Tolmete servers is encrypted using TLS 1.2 or higher. |
| Encryption at rest | All data stored on Google Cloud Platform infrastructure is encrypted at rest using AES-256 by default. |
| Access control | Role-based access control (RBAC) is applied within the Tolmete platform. Access to production infrastructure, OpenAI account, Stripe, and other key sub-processors is restricted to authorised personnel only. |
| Authentication | Strong password policies and multi-factor authentication (MFA) are required for administrative access to production systems. |
| Network security | Servers are hosted within Google Cloud VPC with firewall rules restricting inbound traffic. Regular security patching applied. |
| Data minimisation | Only data necessary for the specified processing purpose is collected and transmitted to AI sub-processors. Channel messages from Slack/Teams are limited to public channels; private messages and direct messages are excluded. |
| AI data handling | A Data Processing Addendum with OpenAI is in place. API data is not used for OpenAI model training. Zero-data-retention configuration is applied where available. |
| Monitoring & logging | Application performance monitoring and error tracking is performed via Datadog. Logs are retained in accordance with operational requirements and reviewed for security incidents. |
| Incident response | A data breach response procedure is in place. The Processor will notify the Controller within 48 hours of becoming aware of a confirmed or suspected Personal Data breach (see Section 8). |
| Personnel | Access to Personal Data is limited to personnel who require it to perform their role. Personnel with access to Personal Data are bound by confidentiality obligations. |
| Sub-processor oversight | Sub-processors are selected based on their ability to provide sufficient guarantees regarding security and GDPR compliance. DPAs or equivalent agreements are in place with all sub-processors handling Personal Data. |
* "Limited" indicates that the Sub-processor may receive technical metadata or usage data incidentally in the course of providing their service (e.g., error logs, API call data) but is not engaged to process the content of Personal Data as its primary function. Appropriate DPAs or terms are in place with all such Sub-processors.
6. Sub-processors
6.1
The Controller grants general authorisation to the Processor to engage the Sub-processors listed in Annex C. The Processor shall impose data protection obligations on Sub-processors equivalent to those set out in this DPA.
6.2
The Processor shall remain fully liable to the Controller for the performance of Sub-processors' obligations.
6.3
The Processor shall notify the Controller via email (to the address provided at registration) at least 30 days before adding or replacing a Sub-processor. The notification shall include the Sub-processor's name, location, and purpose of processing.
6.4
The Controller may object to the proposed change within 14 days of notification. If the Controller objects on reasonable data protection grounds, the parties shall negotiate in good faith. If no resolution is reached, the Controller may terminate the relevant part of the Services.
7. Data Subject Rights
7.1
The Processor shall assist the Controller in responding to Data Subject requests under Chapter III GDPR within the applicable statutory time limits.
7.2 Deletion Requests
Data Subjects may request deletion of their personal account by submitting a request to support@tolmete.com from the email address registered on their Tolmete account. The request must include:
- The Data Subject's full name;
- The approximate date of last login to Tolmete.
The Processor shall confirm receipt and process the request within 30 days. Upon confirmation:
- The Data Subject's full name will be replaced with "Deleted User" immediately upon confirmation;
- All remaining personal identifiers (email address, avatar, location, job title, timezone) will be permanently deleted within 30 calendar days;
- Time logs created by the Data Subject will be retained but attributed to "Deleted User", as they form part of the Organisation's records.
7.3 Limitation — Time Logs
Important limitation
7.4 Organisation Deletion
A Super Admin of the Organisation may initiate deletion of the entire Organisation account via the settings panel in Tolmete. A 30-day recovery window applies before permanent deletion. After expiry of the recovery window, all data associated with the Organisation — including time logs, projects, signals, and summaries — will be permanently deleted within a further 30 days.
7.5 Data Portability and Access
Requests for data export or access from Data Subjects or the Controller shall be submitted to support@tolmete.com. The Processor shall respond within 30 calendar days. Data will be provided in a commonly used, machine-readable format where technically feasible.
8. Personal Data Breach Notification
8.1
The Processor shall notify the Controller without undue delay, and no later than 48 hours after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA.
8.2
The notification shall, to the extent known at the time of notification, include:
- a description of the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects and Personal Data records affected;
- the name and contact details of the Processor's data protection contact (Denis Salatin, denis@tolmete.com);
- a description of the likely consequences of the Personal Data Breach;
- a description of the measures taken or proposed to be taken by the Processor to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.
8.3
Where the information listed above cannot all be provided at once, it may be provided in phases without undue further delay.
8.4
The Processor shall cooperate with the Controller and take reasonable steps to assist in the Controller's compliance with its notification obligations under Articles 33 and 34 GDPR, noting that the Controller has 72 hours from becoming aware of the breach to notify the relevant supervisory authority.
Note: A Personal Data Breach notification does not constitute an admission of fault or liability by the Processor.
9. Automated Processing and AI-Generated Outputs
9.1
The Tolmete platform incorporates automated processing of Personal Data to generate the following outputs:
AI Summaries: project-level, activity-level, and contributor-level summaries generated by OpenAI based on time log data;
Signals: insights including context, hypothesis, anomalies, and AI-generated mitigation plans based on data from connected integrations and time logs. Mitigation plans may include references to named contributors (e.g., indicating recommended actions for specific team members);
Activity mapping: automated suggestion of invoice activities mapped from Zoho/QuickBooks to Tolmete activities, subject to human review and approval by the Controller's users.
9.2
The Processor does not use automated processing to make legally binding decisions about Data Subjects. AI-generated outputs are informational and are presented to the Controller's authorised users for review, confirmation, or rejection.
9.3
The Controller is responsible for ensuring appropriate human oversight of AI-generated outputs before using them as the basis for decisions affecting Data Subjects, including employment-related decisions.
9.4
Time log data and connected integration data transmitted to OpenAI for processing is covered by a Data Processing Agreement with OpenAI LLC.
OpenAI does not use API-submitted data for model training.
10. International Data Transfers
10.1
The Processor's primary infrastructure is hosted on Google Cloud Platform servers located in the European Union. All data at rest is stored within the EU.
10.2
Notwithstanding Section 10.1, some processing activities involve Sub-processors located outside the European Economic Area (EEA), including the United States. In such cases, transfers are governed by the European Commission's Standard Contractual Clauses (Module 2: Controller-to-Processor) incorporated into each relevant Sub-processor agreement, or by an equivalent transfer mechanism.
10.3
Lumitech FZCO is incorporated in the United Arab Emirates, which has not received an EU adequacy decision. For transfers of Personal Data from Controllers established in the EEA to Lumitech FZCO, the parties agree to execute the Standard Contractual Clauses (EU Commission Decision 2021/914, Module 2) as a standalone addendum or as incorporated herein by reference on execution of this DPA.
10.4
The Controller warrants that any transfer of Personal Data to the Processor for processing under this DPA is authorised under applicable data protection law in the Controller's jurisdiction.
11. Data Retention and Post-Termination Deletion
11.1
Data retention periods applicable during the term of the Services are set out in Annex A.
11.2
Upon termination or expiry of the Services Agreement, the Processor shall, at the Controller's election:
- delete all Personal Data processed on behalf of the Controller and certify such deletion in writing; or
- return all Personal Data to the Controller in a commonly used electronic format, following which the Processor shall delete its copies.
11.3
The Controller must submit its election within 30 days of termination. In the absence of an election, the Processor shall delete all Personal Data within 60 days of termination, subject to any applicable legal retention requirements.
11.4
Organisation data (including all time logs, projects, signals, and summaries) is subject to a 30-day recovery window from the date of deletion initiation, after which permanent deletion occurs within a further 30 days.
11.5
The Processor may retain Personal Data to the extent required by applicable law or regulation, and shall notify the Controller of any such retention obligation.
12. Audit Rights
12.1
The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with the obligations set out in this DPA and Article 28 GDPR.
12.2
The Controller may, upon at least 30 days' written notice, conduct or commission a third-party audit of the Processor's data processing activities covered by this DPA, no more than once per calendar year, at the Controller's cost, and subject to reasonable confidentiality obligations.
12.3
The Processor may satisfy its audit obligations by providing the Controller with up-to-date certifications, audit reports, or third-party assessments (e.g., SOC 2, ISO 27001) where available.
13. Liability
13.1
Each party's liability under this DPA is subject to the limitations and exclusions set out in the Services Agreement.
13.2
Where both parties are responsible for damage caused by a breach of this DPA or GDPR, each party shall be liable for the damage it has caused. The Processor shall not be liable for damage caused solely by the Controller's instructions or by the Controller's failure to fulfil its obligations as a Controller.
14. Term and Termination
14.1
This DPA is effective from the date of acceptance of the Services Agreement and shall remain in force for the duration of the Services Agreement.
14.2
This DPA shall automatically terminate upon termination or expiry of the Services Agreement, subject to the post-termination obligations in Section 11.
14.3
Either party may terminate this DPA immediately upon written notice if the other party is in material breach of this DPA and fails to cure such breach within 30 days of receiving written notice.
15. Governing Law and Dispute Resolution
15.1
This DPA and any disputes arising out of or in connection with it shall be governed by and construed in accordance with the laws of the United Arab Emirates, without prejudice to the mandatory data protection provisions applicable in the Controller's jurisdiction (including, where applicable, the GDPR and the laws of the Controller's member state).
15.2
For Controllers established in the European Union, the parties acknowledge that this DPA is subject to the requirements of the GDPR, which shall prevail over any conflicting provision of UAE law in relation to data protection matters.
15.3
Any disputes arising out of or relating to this DPA shall first be subject to good-faith negotiation. If unresolved within 30 days, disputes shall be referred to arbitration or the competent courts as agreed in the Services Agreement.
16. General Provisions
16.1
In the event of any conflict between this DPA and the Services Agreement in relation to data protection matters, this DPA shall prevail.
16.2
This DPA may be amended by the Processor with 30 days' prior written notice to the Controller. Continued use of the Services after the notice period constitutes acceptance of the amended DPA.
16.3
If any provision of this DPA is found to be unenforceable, the remaining provisions shall continue in full force and effect.
16.4
This DPA, together with its Annexes and the Services Agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements on the same subject matter.
Annex A: Description of Processing Activities
This Annex forms an integral part of the DPA and describes the personal data processed, the categories of Data Subjects, the purposes of processing, and the applicable retention periods.
| Purpose of Processing | Categories of Personal Data | Categories of Data Subjects | Retention Period |
|---|---|---|---|
| Time Tracking | Full name (contributor)Email addressTime log: description, duration, activity type, projectLocation (country, city) | Employees / contractors of the Controller | Time logs: retained for the life of the Organisation account.User identifiers: anonymised within 30 days of user deletion request. |
| Client Portal | Contributor full nameTime log entriesAI-generated project / activity / contributor summaries | Employees / contractors of the Controller;End-clients of the Controller (read-only access via shared link) | Same as Time Tracking above. |
| Signals & Mitigation Plans | Commit history, PR data, code change volume (GitHub / Bitbucket)Task data: names, descriptions, estimates, interaction history (Jira / Asana)Channel messages (Slack / Teams — public channels only; DMs excluded)User account identifiers from connected sources | Employees / contractors of the Controller;End-clients of the Controller (read-only access via shared link) | Plan-dependent: Starter/Premium — up to 1 month; Signature — up to 6 months.Deleted on plan downgrade or account termination. |
| AI Summary Generation | Time log descriptionsActivity typesContributor names (for attribution in summaries) | Employees / contractors of the Controller | AI-generated summaries retained for the life of the Organisation account. |
| Invoice Generation | Activity names and rates (from Zoho / QuickBooks)Client names and emailsTime log data used for billing | Employees / contractors of the Controller;Clients of the Controller | Retained for the life of the Organisation account or as required by applicable financial regulations. |
| Account Management & Authentication | Full nameEmail addressPassword (hashed)Location (country, city)Avatar (optional)Job title (optional)Timezone (optional) | Individual users of the Tolmete platform | Retained until deletion request.Full name replaced with 'Deleted User' immediately upon confirmed deletion; remaining personal identifiers permanently deleted within 30 days. |
| Organisation Profile | Company nameCompany email (optional)Number of employees (optional)Industry (optional) | Organisations (legal entities) — not individuals | Retained until Organisation deletion.Permanently deleted 30 days after confirmed deletion request (30-day recovery window applies). |
Note on time logs: Individual time log entries cannot be deleted on a standalone basis. They are attributed to "Deleted User" upon deletion of the associated user account and are permanently deleted only upon full Organisation account deletion.
Note on Signals data: Channel messages collected from Slack and Microsoft Teams are limited to public channels and group channels. Private messages and direct messages are excluded from Signals processing.
Annex B: Technical and Organisational Security Measures
This Annex describes the technical and organisational security measures implemented by the Processor in accordance with Article 32 GDPR.
| Measure | Description |
|---|---|
| Encryption in transit | All data transmitted between client applications and Tolmete servers is encrypted using TLS 1.2 or higher. |
| Encryption at rest | All data stored on Google Cloud Platform infrastructure is encrypted at rest using AES-256 by default. |
| Access control | Role-based access control (RBAC) is applied within the Tolmete platform. Access to production infrastructure, OpenAI account, Stripe, and other key sub-processors is restricted to authorised personnel only. |
| Authentication | Strong password policies and multi-factor authentication (MFA) are required for administrative access to production systems. |
| Network security | Servers are hosted within Google Cloud VPC with firewall rules restricting inbound traffic. Regular security patching applied. |
| Data minimisation | Only data necessary for the specified processing purpose is collected and transmitted to AI sub-processors. Channel messages from Slack/Teams are limited to public channels; private messages and direct messages are excluded. |
| AI data handling | A Data Processing Addendum with OpenAI is in place. API data is not used for OpenAI model training. Zero-data-retention configuration is applied where available. |
| Monitoring & logging | Application performance monitoring and error tracking is performed via Datadog. Logs are retained in accordance with operational requirements and reviewed for security incidents. |
| Incident response | A data breach response procedure is in place. The Processor will notify the Controller within 48 hours of becoming aware of a confirmed or suspected Personal Data breach (see Section 8). |
| Personnel | Access to Personal Data is limited to personnel who require it to perform their role. Personnel with access to Personal Data are bound by confidentiality obligations. |
| Sub-processor oversight | Sub-processors are selected based on their ability to provide sufficient guarantees regarding security and GDPR compliance. DPAs or equivalent agreements are in place with all sub-processors handling Personal Data. |
Annex C: Authorised Sub-processors
The following Sub-processors are authorised by the Controller pursuant to Section 6 of this DPA. The Processor shall provide at least 30 days' prior notice of any addition or replacement.
| Sub-Processor | Location | Processing Purpose | Personal Data |
|---|---|---|---|
| Google Cloud Platform | EU (Europe-West) | Cloud infrastructure, servers/databases | Yes |
| OpenAI LLC | USA (SCCs in place) | AI processing — Summary, Signals, activity mapping | Yes |
| Stripe, Inc. | USA (SCCs in place) | Payment processing and subscription management | No |
| Datadog, Inc. | USA (SCCs in place) | Application monitoring, crash analytics, uptime | Limited* |
| Google Calendar API | USA (SCCs in place) | Calendar event creation from mitigation plans | Limited* |
| Microsoft Outlook / Graph API | USA (SCCs in place) | Calendar event creation from mitigation plans | Limited* |
| Atlassian (Jira / Asana) | USA (SCCs in place) | Task and sprint data for Signals | Limited* |
| GitHub / Atlassian Bitbucket | USA (SCCs in place) | Commit, PR, review data for Signals | Limited* |
| Slack Technologies | USA (SCCs in place) | Channel message data for Signals | Limited* |
| Zoho / QuickBooks | USA (SCCs in place) | Invoicing: activities, clients, rates | Limited* |
| LangChain / LangSmith | USA (SCCs in place) | AI orchestration layer, request tracing | Limited* |
| Intercom, Inc. | USA (SCCs in place) | Customer support, release notes | Limited* |
* "Limited" indicates that the Sub-processor may receive technical metadata or usage data incidentally in the course of providing their service (e.g., error logs, API call data) but is not engaged to process the content of Personal Data as its primary function. Appropriate DPAs or terms are in place with all such Sub-processors.
How to Sign and Return the DPA
How to complete, sign, and submit the Tolmete Data Processing Agreement (DPA). The process takes less than 10 minutes. Once we receive your signed copy, we will countersign and return it to you within 3 business days.
The applicable SCCs are available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914
For the purposes of the SCCs:
Data exporter: the Controller (as identified on the cover page of this DPA);
Data importer: Lumitech FZCO, DDP, Building A1, Nadd Hessa, Dubai Silicon Oasis, Dubai, UAE;
Processing activities, categories of data, data subjects, and retention periods: as set out in Annex A;
Competent supervisory authority: the supervisory authority of the Controller's EU member state of establishment;
Governing law for the SCCs: the law of the EU member state in which the Controller is established.
By executing this DPA, both parties agree to be bound by the SCCs in respect of any transfer of EEA Personal Data to Lumitech FZCO as described above.
How to Sign and Return the DPA
Fill in your company details
Open the DPA document (Tolmete_DPA_v1.docx) and replace the following placeholders:
| Field | Value |
|---|---|
| [Client Legal Entity Name] | Full registered legal name of your company |
| [Registered Address] | Official registered address of your company |
| [Country] | Country of registration |
| [DATE] on cover page | Today's date or the date of signing |
| Signature block — Authorised Signatory | Wet or electronic signature of the person signing on behalf of the company |
| Signature block — Name and Title | Full name and job title of the signatory |
| Signature block — Date | Date of signing |
The rest of the document is pre-filled and does not require changes. Do not modify any other clauses — if you have questions or require amendments, contact us first at legal@tolmete.com.
Export the document as PDF
Save the completed document as a PDF before signing.
- Microsoft Word → Save As → choose PDF format
- Google Docs → Download → PDF Document (.pdf)
- LibreOffice → File → Export As → Export as PDF
Sign the PDF
You can sign the PDF using any of the following methods:
E-signature tools
DocuSign, Adobe Acrobat Sign, or Dropbox Sign — upload the PDF and sign digitally.
PDF annotation
Open in Adobe Acrobat Reader or Preview (Mac), use the signature tool to draw or insert your signature.
Print and scan
Print, sign by hand, scan back to PDF and attach to the email.
Send to Tolmete
Email the signed PDF to:
Subject line: "DPA — [Your Company Name]"
Receive your countersigned copy
Within 3 business days, Tolmete will:
- Sign the DPA on our side (Denis Salatin, CEO);
- Send you the fully executed PDF by email;
- File the original for our records.
We recommend storing your copy in a safe location
(e.g., your legal document folder or contract management system).
Important notes
- The DPA must be signed by a person authorised to sign contracts on behalf of your company (e.g., CEO, Legal Counsel, DPO).
- Do not modify the content of the DPA. If you require amendments, contact us at legal@tolmete.com before signing.
- For EU-based companies: the DPA includes Standard Contractual Clauses (Annex D) covering the transfer of personal data to Lumitech FZCO in the UAE.
- Questions? Contact us at legal@tolmete.com before signing.