Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms and Conditions of Luminary Platforms, Inc. (“Luminary”) (the “Agreement”) between Luminary and the Advisor identified in the applicable Order Form (“Advisor”). This DPA is incorporated into the Agreement by reference in, or attachment to, the applicable Order Form, and is effective as of the Effective Date of that Order Form. Capitalized terms used but not defined in this DPA will have the meanings set forth in the Agreement.

‍

1. Subject Matter, Roles and Precedence

1.1  Subject Matter. This DPA reflects the parties’ commitment to abide by Data Protection Laws concerning the Processing of Advisor Personal Data in connection with Luminary’s performance of the Services. The subject matter, nature, and purpose of the Processing of Advisor Personal Data, the types of Advisor Personal Data, the categories of data subjects and the duration of the Processing are set out in Schedule 1, which is an integral part of this DPA.

1.2  Roles. Advisor is a “Controller” or “Business” (as such terms are defined under applicable Data Protection Laws) and appoints Luminary as a “Processor” or “Service Provider” (as such terms are defined under applicable Data Protection Laws) on behalf of Advisor. Advisor is responsible for compliance with the requirements of Data Protection Laws applicable to Controllers and Businesses.

1.3  Account Data and Usage Data. The parties acknowledge and agree that with respect to Account Data and Usage Data, Luminary is an independent controller, not a joint controller with Advisor. Luminary will Process Account Data and Usage Data as a controller (i) to manage the relationship with Advisor; (ii) to carry out Luminary’s core business operations, such as accounting, audits, tax preparation and filing and compliance purposes; (iii) to monitor, investigate, prevent and detect fraud, security incidents and other misuse of the Services, and to prevent harm to Advisor; (iv) to provide, optimize and maintain the Services; (v) to comply with legal or regulatory obligations applicable to the Processing and retention of Personal Data to which Luminary is subject; and (vi) as otherwise permitted under Data Protection Laws and in accordance with this DPA and the Agreement. Any Processing by Luminary as a controller shall be in accordance with Luminary’s privacy policy available at https://www.withluminary.com/privacy.

1.4  Order of Precedence; Liability. In the event of any conflict or inconsistency among the following documents, the order of precedence will be: (1) this DPA, solely with respect to the Processing of Advisor Personal Data; (2) the applicable Order Form; and (3) the Agreement. Any claims brought in connection with this DPA will be subject to the terms and conditions of the Agreement, including, but not limited to, the exclusions and limitations set forth in Section 6 (Limitation of Liability) of the Agreement.

1.5  Duration and Survival. This DPA is effective as of the Effective Date of the applicable Order Form and remains in effect for so long as Luminary Processes Advisor Personal Data under the Agreement, including during the period described in Section 8 (Return and Deletion).

‍

2. Definitions

For the purposes of this DPA, the following terms and those defined within the body of this DPA apply.

2.1  “Account Data” means Personal Data that relates to Luminary’s relationship with Advisor, including the names or contact information of individuals authorized by Advisor to access Advisor’s account and billing information of individuals that Advisor has associated with its account. Account Data also includes any data Luminary may need to collect for the purpose of managing its relationship with Advisor, identity verification, or as otherwise required by applicable laws and regulations.

2.2  “Advisor Personal Data” means Personal Data contained in Advisor Information, or otherwise provided to Luminary by or on behalf of Advisor in connection with the Services, that is Processed by Luminary on behalf of Advisor. Advisor Personal Data does not include Account Data, Usage Data or Aggregate Data.

2.3  “CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and the regulations promulgated thereunder.

2.4  “Data Protection Laws” means applicable data privacy, data protection, and cybersecurity laws, rules, and regulations governing the Processing of Advisor Personal Data in connection with the Agreement, including, as applicable, U.S. State Privacy Laws, the Gramm Leach Bliley Act, 15 U.S.C. § 6801 et seq., and its implementing regulations (including 16 C.F.R. Part 314 and 17 C.F.R. Part 248), the EU General Data Protection Regulation (GDPR), the United Kingdom General Data Protection Regulation (UK GDPR), the Swiss Federal Act on Data Protection, and any other jurisdictional laws to which Advisor is subject while Luminary Processes Advisor Personal Data under the Agreement, in each case as amended or replaced from time to time.

2.5  “Personal Data” has the meaning assigned to the term “personal data” or “personal information” under applicable Data Protection Laws.

2.6  “Process” or “Processing” means any operation or set of operations which is performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

2.7  “Security Incident” means the breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Advisor Personal Data in Luminary’s or its Subprocessors’ possession or control. Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Advisor Personal Data, such as unsuccessful login attempts, pings, port scans, denial of service attacks or other network attacks on firewalls or networked systems.

2.8  “Subprocessor” means Luminary’s authorized vendors and third party service providers that Process Advisor Personal Data.

2.9  “Usage Data” means Service usage data collected and processed by Luminary in connection with the provision of the Services, including without limitation data used to identify the source and destination of a communication, activity logs, and data used to optimize and maintain performance of the Services, and to investigate and prevent system abuse.

2.10  “U.S. State Privacy Laws” means the CCPA and the other comprehensive consumer privacy laws of U.S. states that are applicable to the Processing of Advisor Personal Data, in each case as amended or replaced from time to time.

‍

3. Processing of Advisor Personal Data

3.1  Documented Instructions. Luminary shall Process Advisor Personal Data on behalf of and only in accordance with Advisor’s documented instructions for the following purposes: (a) Processing in accordance with this DPA, the Agreement, or the Order Form; (b) Processing initiated by Advisor and its Authorized Users in their use of the Services; and (c) Processing to comply with other reasonable documented instructions provided by Advisor (e.g., via email) where such instructions are consistent with the terms of this DPA or the Agreement. Luminary will, unless legally prohibited from doing so, inform Advisor in writing if it reasonably believes that there is a conflict between Advisor’s instructions and applicable law or otherwise seeks to Process Advisor Personal Data in a manner that is inconsistent with Advisor’s instructions. Processing of Advisor Information by Third Party Services that Advisor elects to connect to the Services is governed by Section 2.5 of the Agreement and is not Processing by Luminary under this DPA.

3.2  Restrictions on Processing. Except as permitted by applicable Data Protection Laws, the Agreement, the Order Form, or this DPA, Luminary will not (a) retain, use, or disclose Advisor Personal Data for any purpose other than for the specific purposes of performing the Services or in accordance with Advisor’s documented instructions (including as set forth in the Agreement), (b) retain, use, or disclose Advisor Personal Data outside of the direct business relationship between the parties, (c) combine Advisor Personal Data with Personal Data obtained from, or on behalf of, sources other than Advisor, or (d) “Sell” or “Share” (as such terms are defined under the CCPA) Advisor Personal Data. Where permitted by Data Protection Laws, Luminary may Process Advisor Personal Data to detect Security Incidents and to protect against fraudulent or illegal activity, and may use Advisor Information as permitted by Section 4.1 of the Agreement.

3.3  California Specific Terms. To the extent that Luminary’s Processing of Advisor Personal Data is subject to the CCPA, this Section 3.3 shall also apply. Advisor discloses or otherwise makes available Advisor Personal Data to Luminary for the limited and specific purpose of Luminary providing the Services to Advisor in accordance with the Agreement and this DPA. Luminary shall: (i) comply with its applicable obligations under the CCPA; (ii) provide the same level of privacy protection as required under the CCPA; (iii) notify Advisor if it makes a determination that it can no longer meet its obligations under the CCPA; (iv) not “sell” or “share” (as such terms are defined by the CCPA) Advisor Personal Data; (v) not retain, use, or disclose Advisor Personal Data for any purpose (including any commercial purpose) other than to provide the Services under the Agreement or as otherwise permitted under the CCPA; (vi) not retain, use, or disclose Advisor Personal Data outside of the direct business relationship between Advisor and Luminary; and (vii) unless otherwise permitted by the CCPA, not combine Advisor Personal Data with Personal Data that Luminary (a) receives from, or on behalf of, another person, or (b) collects from its own, independent consumer interaction. Advisor may: (1) take reasonable and appropriate steps agreed upon by the parties to help ensure that Luminary Processes Advisor Personal Data in a manner consistent with Advisor’s CCPA obligations; and (2) upon notice, take reasonable and appropriate steps agreed upon by the parties to stop and remediate unauthorized Processing of Advisor Personal Data by Luminary.

3.4  Other U.S. State Privacy Laws. To the extent that Luminary’s Processing of Advisor Personal Data is subject to U.S. State Privacy Laws other than the CCPA, Luminary shall: (i) adhere to Advisor’s instructions with respect to the Processing of Advisor Personal Data as set forth in this DPA; (ii) require that each person Processing Advisor Personal Data be subject to a duty of confidentiality with respect to such Processing; (iii) upon Advisor’s written request, delete or return all Advisor Personal Data in accordance with Section 8, unless retention of such Advisor Personal Data is required or authorized by law or this DPA; (iv) upon Advisor’s written request at reasonable intervals, make available to Advisor all information in its possession that is reasonably necessary to demonstrate Luminary’s compliance with its obligations under U.S. State Privacy Laws, and allow and cooperate with reasonable assessments in accordance with Section 7; (v) engage Subprocessors only in accordance with Section 4, including by entering into a written contract with each Subprocessor requiring it to observe the applicable requirements of a processor under U.S. State Privacy Laws; and (vi) provide information sufficient to enable Advisor to conduct and document data protection assessments to the extent required by U.S. State Privacy Laws.

3.5  Confidentiality. Any person authorized to Process Advisor Personal Data must be subject to a duty of confidentiality, contractually agree to maintain the confidentiality of such information, or be under an appropriate statutory obligation of confidentiality.

3.6  Personal Data Inquiries and Requests. Advisor is responsible for responding to and complying with requests from individuals exercising their rights in Advisor Personal Data granted to them under Data Protection Laws. The Services include controls that Advisor may use to assist it to respond to such requests. If Advisor is unable to respond to a request using such controls, Luminary agrees to provide reasonable assistance and comply with reasonable instructions from Advisor related to any such requests, taking into account the nature of the Processing and the information available to Luminary. If Luminary receives such a request directly, Luminary will, to the extent permitted by law, advise the individual to submit the request to Advisor. To the extent legally permitted, Advisor shall be responsible for any costs and expenses arising from Luminary’s provision of such assistance.

3.7  Data Protection Assessments and Prior Consultation. Where required by Data Protection Laws, Luminary agrees to provide reasonable assistance and information to Advisor where, in Advisor’s judgement, the type of Processing performed by Luminary requires a data protection assessment, data protection impact assessment, and/or prior consultation with the relevant data protection authorities. Advisor shall reimburse Luminary for all reasonable costs Luminary incurs in performing its obligations under this Section 3.7.

3.8  Demonstrable Compliance. Luminary agrees to provide information reasonably necessary to demonstrate compliance with this DPA upon Advisor’s reasonable request.

3.9  Aggregate Data. Luminary may compile and use Aggregate Data as permitted by Section 4.1 of the Agreement, provided that such information cannot reasonably be used to identify Advisor or any data subject to whom Advisor Personal Data relates. Luminary will not attempt to reidentify any individual from Aggregate Data.

‍

4. Subprocessors

4.1  Authorization to Use Subprocessors. To the extent necessary to fulfill Luminary’s contractual obligations under the Agreement, Advisor hereby authorizes Luminary to engage Subprocessors. Advisor acknowledges that Subprocessors may further engage vendors. A list of Luminary’s current Subprocessors is available at trust.withluminary.com.

4.2  Luminary and Subprocessor Compliance. Luminary shall (i) enter into a written agreement with Subprocessors regarding such Subprocessors’ Processing of Advisor Personal Data that imposes on such Subprocessors data protection requirements for Advisor Personal Data that are consistent with this DPA; and (ii) remain responsible to Advisor for Luminary’s Subprocessors’ failure to perform their obligations with respect to the Processing of Advisor Personal Data.

4.3  Subprocessor Changes. Luminary will notify Advisor prior to any intended change to Subprocessors. Advisor may object to Luminary’s use of a new Subprocessor within thirty (30) days of receipt of Luminary’s notice of the intended change of Subprocessor based on reasonable grounds that the appointment of such Subprocessor will result in a material violation of Data Protection Laws by providing written notice to Luminary detailing the grounds of such objection. Luminary will use reasonable efforts to make available to Advisor a change in the Services or recommend a commercially reasonable change to Advisor’s configuration or use of the Services to avoid the Processing of Advisor Personal Data by the objected to new Subprocessor without unreasonably burdening Advisor. If Luminary is unable to make available such change within a reasonable period of time, which shall not exceed sixty (60) days, Advisor may terminate the relevant parts of the Services which cannot be provided by Luminary without the use of the objected to new Subprocessor by providing written notice to Luminary and Luminary will refund Advisor any prepaid Fees covering the remainder of the Term following the effective date of termination with respect to such terminated Services.

‍

5. Security

5.1  Security Measures. Luminary will implement appropriate technical and organizational measures designed to ensure a level of security appropriate to the risks presented by the Processing of Advisor Personal Data and the Services (“Security Measures”), including the measures set forth in Schedule 2. The Security Measures are subject to technical progress and development, and Luminary may update the Security Measures, provided that any updates shall not materially diminish the overall security of Advisor Personal Data or the Services.

‍

6. Security Incidents

6.1  Notice. Upon becoming aware of a Security Incident, Luminary agrees to provide written notice without undue delay and in any event within seventy two (72) hours to the email address of Advisor’s account administrator or such other address as Advisor designates in writing. Such notice will include the information then reasonably available to Luminary that Advisor requires to comply with its own notification obligations under Data Protection Laws, and Luminary will supplement such notice as additional information becomes available. If Luminary’s notification of a Security Incident is delayed, it will be accompanied by reasons for the delay.

6.2  Response and Cooperation. Following notice, Luminary will take such steps as Luminary deems necessary and reasonable to investigate, contain and remediate the Security Incident (to the extent that remediation is within Luminary’s reasonable control) and will, taking into account the nature of the Processing and the information available to Luminary, provide Advisor with reasonable cooperation and assistance necessary for Advisor to comply with its obligations under Data Protection Laws with respect to notifying regulators and affected individuals. Luminary’s obligation to report or respond to a Security Incident under this Section 6 will not be construed as an acknowledgement by Luminary of any fault or liability with respect to the Security Incident, and the obligations in this Section 6 shall not apply in the event that a Security Incident results from the actions or omissions of Advisor or its Authorized Users.

‍

7. Audits and Assessments

7.1  Reports First. Upon Advisor’s written request at reasonable intervals, and subject to reasonable confidentiality controls, Luminary shall make available for Advisor’s review copies of certifications or reports demonstrating Luminary’s compliance with prevailing data security standards applicable to the Processing of Advisor Personal Data, including its then current SOC 2 Type II report (the “Audit Report”), and shall respond to Advisor’s reasonable written security questionnaires.

7.2  Audits. If the Audit Report reveals any breach of this DPA or violation of Data Protection Laws by Luminary, Advisor may request and conduct, at Advisor’s sole expense, a reasonable audit of Luminary’s applicable controls and compliance with this DPA (an “Audit”), provided (a) such Audit is conducted by Advisor or a third party auditor designated by Advisor and reasonably acceptable to Luminary that has executed an appropriate confidentiality agreement with Luminary, (b) such Audit is conducted during reasonable times and of reasonable scope and duration in accordance with mutually agreed upon terms between Advisor and Luminary, (c) a similar Audit has not already been conducted less than twelve (12) months prior, unless it is required by a supervisory authority or other regulatory authority responsible for the enforcement of Data Protection Laws, and (d) such Audit does not involve any of Luminary’s production systems or environments. Advisor may use the results of an Audit only for the purposes of meeting Advisor’s regulatory audit requirements or confirming compliance with the requirements of this DPA.

‍

8. Return and Deletion

8.1  Retrieval Period. For twenty (20) days after the end of the Term, Luminary will make Advisor Information available to Advisor through the Luminary Solution on a limited basis solely for purposes of Advisor retrieving Advisor Information, unless Luminary is instructed by Advisor to delete such data before that period expires, in accordance with Section 10.4 (Data Access) of the Agreement.

8.2  Deletion. Following that period, Luminary will delete all Advisor Personal Data (excluding any backup or archival copies which shall be deleted in accordance with Luminary’s data retention schedule and which remain subject to the protections of this DPA until deleted), except where Luminary is required to retain copies under applicable laws, in which case Luminary will isolate and protect that Advisor Personal Data from any further Processing except to the extent required by applicable laws.

8.3  Deletion on Request. Upon Advisor’s written request during the Term, Luminary will delete or return Advisor Personal Data within thirty (30) days, provided that Luminary may retain Advisor Personal Data if required by law or in standard backups that remain subject to this DPA’s protections.

8.4  Certification. Upon Advisor’s written request, Luminary will certify in writing that it has deleted Advisor Personal Data in accordance with this Section 8.

‍

9. Advisor’s Obligations

9.1  Advisor Representations and Warranties. Advisor represents and warrants that: (i) it has complied and will comply with Data Protection Laws; (ii) it has provided data subjects whose Advisor Personal Data will be Processed in connection with the Agreement with a privacy notice or similar document that clearly and accurately describes Advisor’s practices with respect to the Processing of Advisor Personal Data; (iii) it has obtained and will obtain and continue to have, during the Term, all necessary rights, lawful bases, authorizations, consents, and licenses for the Processing of Advisor Personal Data as contemplated by the Agreement; and (iv) Luminary’s Processing of Advisor Personal Data in accordance with the Agreement will not violate Data Protection Laws or cause a breach of any agreement or obligations between Advisor and any third party.

9.2  Instructions and Appropriate Use. Advisor shall, in its use of the Services, at all times Process Advisor Personal Data, and provide instructions for the Processing of Advisor Personal Data, in compliance with Data Protection Laws. Advisor shall ensure that the Processing of Advisor Personal Data in accordance with Advisor’s instructions will not cause Luminary to be in breach of Data Protection Laws. Advisor shall not provide or make available to Luminary any Personal Data in violation of the Agreement or otherwise inappropriate for the nature of the Services.

‍

10. International Data.

Luminary is located in, and provides the Services from, the United States, and the Services are designed for United States estate planning. Advisor is responsible for determining whether any Personal Data it submits to the Services is subject to the data protection laws of a jurisdiction outside the United States and for complying with those laws. If Advisor’s submission of Advisor Personal Data requires a legal mechanism for international data transfers, Advisor shall notify Luminary before submitting such data and the parties will agree in writing on the appropriate mechanism.

‍

11. General

11.1  Updates to this DPA. Luminary may update this DPA from time to time, and will provide reasonable notice of any such updates, including by posting the updated DPA at withluminary.com/data-processing-agreement. No update will materially diminish the protection of Advisor Personal Data under this DPA during the then current term of Advisor’s Order Form without Advisor’s written agreement. The version of this DPA in effect on the Effective Date of an Order Form will govern Advisor’s Processing under that Order Form unless and until updated in accordance with this Section 11.1.

11.2  Contact Information. Notices under this DPA may be sent to the contact details set forth in the applicable Order Form. Privacy inquiries may be directed to privacy@withluminary.com.

11.3  Legal Effect. This DPA is legally binding on Advisor and Luminary from the Effective Date of the applicable Order Form, whether the Order Form references this DPA by URL or attaches it.

‍

SCHEDULE 1: PROCESSING DETAILS

A. The Parties

Advisor:

Address and contact person: as set forth in the applicable Order Form.
Activities: Advisor receives the Services as described in the Agreement and provides Advisor Information, including Advisor Personal Data, to Luminary in that context.
Role: Controller.

Luminary:

Address: Luminary Platforms, Inc., 1450 Broadway, Fl 12, New York, NY 10018. Contact: privacy@withluminary.com.
Activities: Luminary provides the Luminary Solution and Professional Services to Advisor as described in the Agreement and Processes Advisor Personal Data on behalf of Advisor in that context.
Role: Processor.

B. Description of the Processing

Categories of data subjects: Advisor’s Authorized Users; Clients; and other individuals whose Personal Data is included in Advisor Information submitted to the Services by or on behalf of Advisor, including Clients’ family members, beneficiaries, fiduciaries and representatives.

Categories of Personal Data: determined and controlled by Advisor in its sole discretion, and may include identification and contact details, dates of birth, family relationships, financial and asset information, and the contents of estate planning documents and related materials submitted to the Services.

Sensitive data: Advisor determines whether sensitive data is included in Advisor Information. Any such data is subject to the Security Measures in Schedule 2 and the restrictions in Section 3.

Frequency of the Processing: on a continuous basis.

Nature and purpose of the Processing: the provision of the Services to Advisor as described in the Agreement and the applicable Order Form.

Duration of the Processing: for the Term of the Agreement and thereafter in accordance with Section 8.

Transfers to Subprocessors: as set out in Schedule 3, for the subject matter, nature and duration described above.

‍

SCHEDULE 2: SECURITY MEASURES

Luminary will implement security safeguards designed to protect the security and confidentiality of Advisor Personal Data in accordance with SOC 2 Type II or a substantially similar standard, and as further described at https://www.withluminary.com/security. Such safeguards include measures for the encryption of Advisor Personal Data in transit and at rest, access controls limiting access to Advisor Personal Data to personnel and Authorized Users who require it, the ability to restore the availability of and access to Advisor Personal Data following a physical or technical incident, and regular testing and evaluation of the effectiveness of such safeguards. Luminary may update such safeguards from time to time in accordance with Section 5.

‍

‍SCHEDULE 3: SUBPROCESSORS

Luminary’s current Subprocessors are listed at trust.withluminary.com. Advisor will be notified of changes in accordance with Section 4.3.