Data Processing Agreement

This Data Processing Agreement (“DPA”) governs the processing of personal data by Lookio on behalf of the customer (“you”, “Customer”) under the Terms and Conditions (“Terms”). It supplements the Terms and forms part of the agreement between you and Lookio when you use the Services to process personal data.

1. Scope and roles

Lookio is run by Guillaume Duvernay, a sole trader registered in Germany as Guillaume Duvernay – Unternehmensberatung für digitale Transformation, Richard-Sorge-Straße, 10249 Berlin, Germany (“we”, “Lookio”). Contact: hi@lookio.app.

When you use Lookio and upload or submit documents, web pages, queries, or assistant instructions containing personal data of third parties, you decide what is processed and why. In that context, you are the controller (or processor acting on behalf of a controller) and Lookio is the processor under Article 28 of the General Data Protection Regulation (GDPR).

This DPA applies solely to personal data processed by Lookio on your behalf as part of your content (“Customer Personal Data”). It does not apply to personal data where Lookio acts as an independent controller, such as your account information, billing records, or direct support communications, which are governed by our Privacy Policy.

2. Processing instructions

We process Customer Personal Data only on your documented instructions, including regarding transfers of personal data outside the European Economic Area (EEA), unless required to do so by European Union or Member State law to which we are subject.

Your instructions are given through your configuration and use of the Services: uploading files, connecting websites, configuring assistants, issuing queries via our dashboard, API, CLI, chat widgets, or Model Context Protocol (MCP) server, and choosing when to delete resources.

If we believe that an instruction infringes the GDPR or other applicable data protection rules, we will inform you promptly.

3. Confidentiality and security

We treat all Customer Personal Data as strictly confidential. Access is limited to authorized personnel who need it to operate and support the Services and who are bound by confidentiality obligations.

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption in transit: all data transmitted to and from Lookio across public networks uses TLS (HTTPS).
• Encryption at rest: files, embeddings, and databases are stored with encryption at rest by our hosting providers.
• Access control: access to production systems is restricted to the administrator of Lookio and protected by multi-factor authentication.
• System maintenance: software dependencies and server environments are regularly updated to protect against vulnerabilities.

We do not use your content or personal data to train AI models.

4. Sub-processors

You grant us general written authorization to engage sub-processors to assist in delivering the Services.

Our current sub-processors, their roles, and their processing locations are listed in Section 4 of our Privacy Policy. They include hosting and storage providers (such as Cloudflare and Qdrant Cloud), model inference providers (such as OpenRouter, OpenAI, and Mistral AI for OCR), and communication services.

We impose data protection obligations on each sub-processor that are at least as protective as those in this DPA. We remain responsible to you for the performance of our sub-processors.

When we plan to add or replace a sub-processor that handles Customer Personal Data, we update the list in our Privacy Policy and notify you in advance via our website, changelog, or email. If you have reasonable data protection concerns regarding a new sub-processor, you may object by discontinuing use of the Services and closing your workspace before the change takes effect.

5. International transfers

If Customer Personal Data is transferred to a country outside the European Economic Area that is not recognized by the European Commission as providing an adequate level of protection, we ensure appropriate safeguards are in place. We rely on the European Commission Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework where certified.

6. Data subject rights and assistance

You are responsible for handling inquiries and requests from individuals whose personal data is included in your content (such as requests for access, rectification, or erasure under Chapter III of the GDPR).

Lookio provides self-service features in the dashboard, API, and CLI that enable you to export, correct, or delete your content and conversations directly at any time. You agree to use these tools to fulfill data subject requests.

If you cannot fulfill a valid request through the available self-service features, we will provide reasonable assistance upon written request, taking into account the nature of the processing, insofar as this is possible and permitted by law. We may charge a reasonable fee for assistance that involves non-standard technical effort.

7. Security incidents

If we become aware of a confirmed personal data breach affecting Customer Personal Data within our systems, we will notify you without undue delay (and at the latest within 72 hours of becoming aware).

Our notification will describe the nature of the incident, the categories of data affected, and the remedial steps taken or recommended, to the extent known.

Notification of a security incident does not constitute an admission of fault or liability on our part.

8. Audits and compliance

To demonstrate compliance with our obligations under Article 28 of the GDPR, we will make available to you, upon written request, reasonable information confirming that we comply with this DPA.

Such verification takes the form of written responses to a reasonable security questionnaire or documentation of our technical and organizational measures. You may request this information at most once per calendar year, on at least 30 days prior written notice, and at your own expense.

Because our infrastructure is hosted in shared cloud facilities with other tenants and operated remotely, on-site physical inspections of our premises or data centers are excluded, except where strictly required by a competent data protection authority.

9. Deletion of data

When you delete a resource, an assistant, a conversation, or your workspace, the corresponding Customer Personal Data is deleted from our active databases immediately.

As described in our Privacy Policy, database backups rotate and are overwritten within 30 days, after which the data is permanently erased from all backup media.

10. Liability

This DPA is subject to the limitations and exclusions of liability set forth in Section 10 of our Terms and Conditions.

Any liability arising out of or related to this DPA, whether in contract, tort (including negligence), or under statutory indemnity, is capped under and subject to the aggregate liability limit specified in the Terms. Neither party will be liable for any indirect, incidental, or consequential damages.

11. General

If any provision of this DPA is held invalid, the remaining provisions remain in full force. In the event of a conflict between this DPA and our Terms and Conditions, this DPA takes precedence on matters relating to the processing of personal data.

This DPA is governed by the law specified in the Terms and Conditions (German law), and disputes are subject to the jurisdiction clause of the Terms.