Data Processing Agreement (DPA)

1.1 Key Definitions

1.2 Data Protection Laws

Means all applicable laws relating to data protection and privacy:

• EU General Data Protection Regulation (GDPR)
• Turkey Law on the Protection of Personal Data (KVKK)
• California Consumer Privacy Act (CCPA)
• Other applicable data protection regulations

2.1 Relationship of the Parties

• The Customer acts as the Data Controller for the Personal Data
• LUNAAR acts as the Data Processor for the Personal Data processed under this DPA
• This DPA applies to all Processing activities carried out by LUNAAR on behalf of the Customer

2.2 Customer Instructions

• The Processor shall process Personal Data only on the documented instructions of the Data Controller
• The Agreement and this DPA constitute the complete instructions of the Data Controller
• Additional instructions require a written agreement and may incur additional fees

3.1 Categories of Data Subjects

• The Customer's employees and personnel
• The Customer's customers
• The Customer's suppliers and partners
• The Customer's service users
• Other persons provided by the Customer

3.2 Types of Personal Data

• Identity data (name, identification numbers)
• Contact information (email, phone, address)
• Account credentials and authentication data
• Payment and billing information
• Usage data and analytics
• Images and visual content
• AI-generated content and outputs
• Other data uploaded or processed by the Customer

3.3 Processing Activities

• Data storage and hosting
• AI model processing and generation
• Data backup and recovery
• Technical support services
• Analytics and reporting
• Security monitoring
• Service improvement

4.1 Compliance

The Processor shall:

• Process Personal Data in accordance with Data Protection Laws
• Maintain records of processing activities
• Cooperate with supervisory authorities
• Implement privacy by design principles

4.2 Data Security

Security Measures

The Processor shall implement and maintain appropriate technical and organizational measures:

• Encryption for data at rest (AES-256) and in transit (TLS 1.3)
• Access controls and authentication mechanisms
• Regular security assessments and penetration testing
• Incident response and disaster recovery procedures
• Physical security of data centers

4.3 Data Subject Rights

The Processor shall:

• Assist the Data Controller in responding to data subject requests
• Implement technical measures to support data subject rights
• Promptly notify the Data Controller of direct requests from data subjects
• Not respond directly to data subjects unless authorized

5.1 Current Sub-processors

5.2 Sub-processor Requirements

The Processor shall:

• Impose the same data protection obligations on Sub-processors
• Remain fully liable for the performance of Sub-processors
• Provide appropriate safeguards for international transfers

6.1 Transfer Mechanisms

For transfers outside the EEA/adequate countries, the Processor shall ensure:

• Standard Contractual Clauses are in place
• Supplementary measures where necessary
• Compliance with Schrems II requirements

6.2 Transfer Safeguards

• Data localization options available upon request
• Encryption of all international transfers
• Access restrictions based on geographic location
• Regular assessment of third-country laws

7.1 Incident Response

After becoming aware of a Security Incident, the Processor shall:

• Notify the Data Controller without undue delay (within 72 hours)
• Investigate and document the incident
• Implement measures to mitigate the effects
• Cooperate with the Data Controller's investigation

7.2 Notification Content

Incident notifications shall include:

• The nature and scope of the incident
• Categories and number of affected data subjects
• Categories and volume of relevant Personal Data
• Likely consequences and risks
• Measures taken or recommended
• Contact point for further information

8.1 Retention Period

• Personal Data is retained only for as long as necessary
• Retention periods are defined by Data Controller instructions
• Legal retention requirements override deletion requests

8.2 Data Return and Deletion

Upon termination or Data Controller request:

• Return all Personal Data in the agreed format
• Delete all copies unless legally required to retain them
• Provide a deletion certificate
• Complete deletion within 30 days

9.1 Lawful Instructions

The Data Controller shall:

• Ensure that instructions comply with Data Protection Laws
• Have a legal basis for Processing
• Obtain the necessary consents
• Comply with data minimization principles

9.2 Rights and Authorizations

The Data Controller warrants that it has the right to:

• All necessary rights to provide the Personal Data
• Obtaining the required consents
• Making the necessary notifications to data subjects
• Authority to enter into this DPA

10.1 Allocation of Liability

• Each party is liable for its own non-compliance
• The Processor is liable for Processing outside the Data Controller's instructions
• The Data Controller is liable for unlawful instructions

10.2 Limitation of Liability

• Subject to the mandatory provisions of Data Protection Laws
• Total liability is limited as set out in the main Agreement
• Excludes regulatory fines and penalties

11.1 European Union (GDPR)

• The Processor acts pursuant to GDPR Article 28
• Standard Contractual Clauses are incorporated by reference
• Data Protection Officer: spark@lunaarvision.com

11.2 Turkey (KVKK)

• Compliance with KVKK requirements
• Maintenance of VERBİS registration
• Local data residency options available

11.3 California (CCPA/CPRA)

• Service Provider under CCPA
• No sale of Personal Information
• Specific Purpose Limitation applies