This agreement applies when OXS Bilişim [TBC: full legal name] ("OXS", the processor) handles personal data for a customer (the controller) in the course of Lumate's support. It forms part of the Terms of service. [TBC: the lawyer to align this with KVKK, the GDPR (article 28) and the UAE PDPL.]
1. When OXS processes customer data
Lumate runs on the customer's own machines, so OXS does not process the personal data the customer keeps in Agent X in the normal course: it never receives it. The licence's check-ins carry counts and codes only.
OXS processes customer personal data only when the customer chooses to give OXS access to it, for example:
- a support case in which the customer sends a log, a screenshot or a file that holds personal data;
- a backup or an export the customer sends to OXS to resolve a problem.
The support bundle Lumate makes for OXS (agentx support-bundle) holds versions, settings without secrets and log
lines, never the customer's data.
This agreement covers that processing. Personal data OXS holds about the customer's own users of the portal (their accounts) is OXS's own, as controller, and is described in the Privacy policy.
2. Details of the processing
- Subject and purpose: solving the support case the customer opened; nothing else.
- Duration: while the case is open, and at most [TBC: e.g. 30 days] after it is closed.
- Data subjects: the customer's staff, customers and contacts, as present in what the customer shares.
- Categories of data: whatever the customer shares: typically names, phone numbers, email addresses, messages, call transcripts and files. The customer should share as little as the case needs.
3. OXS's obligations
OXS:
- processes the data only on the customer's documented instructions (the support case), unless the law requires otherwise, in which case it tells the customer first where the law allows;
- makes sure the people handling it are bound to confidentiality;
- protects it with appropriate technical and organisational measures (section 6);
- does not use it for any other purpose, and never to train AI models;
- helps the customer answer requests from data subjects and meet its own obligations (security, breach notification, impact assessments), as far as the processing allows;
- tells the customer without undue delay, and at most within [TBC: 48–72] hours of becoming aware, of a personal data breach affecting the data;
- deletes or returns the data at the end of the processing, as the customer chooses, unless the law requires keeping it;
- makes available the information needed to show compliance, and allows audits as section 7 says.
4. Sub-processors
The customer allows OXS to use the sub-processors listed here [TBC: list, e.g. the email provider used for support, and the hosting provider]. OXS tells the customer of a new sub-processor at least 30 days before it is used, and the customer can object. OXS puts the same data protection obligations on each sub-processor and stays responsible for them.
5. Transfers
Where the processing involves a transfer outside the country the law protects the data in, OXS uses the safeguards the law requires [TBC: KVKK article 9 standard contracts; EU standard contractual clauses].
6. Security measures
- support material is kept only in OXS's support systems, with access limited to the people handling the case;
- encryption in transit, and at rest where the systems allow;
- two-step sign-in for staff, access logging;
- deletion when the case closes (section 2). [TBC: the full list of technical and organisational measures.]
7. Audits
The customer can ask for the information above at any time. Once a year, or after a breach, it can audit OXS's compliance with this agreement, with 30 days' notice, during working hours, at its own cost, through an independent auditor bound to confidentiality.
8. Liability and order of precedence
Liability follows the Terms of service. For the processing it covers, this agreement takes precedence over the Terms of service.