Data processing addendum

This Data Processing Addendum (the “Addendum”) forms part of the Terms of Service between Lulo Solutions LLC, a Wyoming limited liability company (“Lulo Solutions”, the “Company” or the “Processor”), and each Agency that uses Leepr (the “Agency” or the “Controller”). It governs the Company’s processing of personal data on the Agency’s behalf when the Agency uses Leepr, and it applies in addition to the Terms of Service. Terms not defined here have the meaning given in the Terms of Service or, where applicable, in the General Data Protection Regulation (“GDPR”).

1. Roles of the Parties

(a) The Agency is the controller of the personal data it enters into, imports into, or receives through Leepr (“Agency Personal Data”). The Company processes Agency Personal Data as the Agency’s processor, only on the Agency’s documented instructions.

(b) The Agency’s documented instructions are these Terms, this Addendum, and the Agency’s configuration and use of Leepr, including the actions of its Authorized Users. The Company shall inform the Agency if, in its opinion, an instruction infringes applicable data protection law.

(c) Sponsors. When the Agency connects a Sponsor, such as a sponsor that uses Exlink, the Sponsor is responsible for the personal data in its own system as a controller independent of the Agency and of the Company. Leepr exchanges data with a Sponsor only through a connection the Agency has made and on the Agency’s instruction: it keeps a summary of the Agency’s students at that Sponsor, reads further detail when an Authorized User opens it, and sends the Agency’s applications when an Authorized User asks it to. Sponsors are not sub-processors of the Company.

(d) Branches and sub-agents. Each branch or sub-agent organisation in Leepr is a separate Agency and the controller of its own Agency Personal Data. An Agency that invites or creates a branch or sub-agent can see that organisation’s records, as the branch or sub-agent agrees when it joins; a branch or sub-agent cannot see its parent’s records or those of any other organisation.

2. Details of the Processing

Subject matter and purpose. Providing Leepr to the Agency: managing leads, students, applicants and their contacts; email conversations, templates and sequences; scheduling and booking links; forms and the Agency’s own application; connections to Sponsors and sending applications to them; tasks, reports, and the support the Agency asks for.

Duration. For as long as the Agency has an account, and afterwards until the Agency Personal Data is deleted under Section 9.

Nature of the processing. Collection, recording, organisation, storage, retrieval, consultation, use, transmission (including by email and to connected Sponsors and tools), restriction and erasure.

Categories of data subjects.

• Students and applicants recruited by the Agency, who are often minors
• Their parents, guardians and other family members and contacts
• People who enquire through the Agency’s forms or book meetings with it
• The Agency’s own staff and Authorized Users, and those of its branches and sub-agents
• Staff of Sponsors and other people named in the Agency’s communications

Categories of personal data.

• Identification and contact details: name, email address, telephone number, address, date of birth, gender, nationality
• Education and program information: schools attended, programs, application answers, statuses and placements at Sponsors, and what Sponsors are waiting for from the Agency
• Documents and images the Agency or its contacts upload, such as passports, transcripts and photos, and government-issued identification numbers (stored encrypted)
• Communications: emails and attachments exchanged through Leepr, notes, call and meeting records, tasks
• Scheduling: meetings, booking details and, for Authorized Users who connect a calendar, free/busy information
• Enquiry source: the form, campaign or referring page a lead came from
• Authorized Users’ account and usage data: sign-in activity and the changes they make

Special categories. Leepr is not designed to require special categories of personal data. Where the Agency chooses to collect them, such as health information in a medical form a Sponsor asks for, the Agency is responsible for having a lawful basis and any condition that applies under Article 9 GDPR, and the Company applies the special restrictions and additional safeguards that such data requires.

3. Processor Obligations

(a) Purpose Limitation. The Company shall process Agency Personal Data only for the purposes set out in Section 2 and shall not process it for any other purpose without the Agency’s prior written consent. The Company does not sell Agency Personal Data and does not use it for advertising.

(b) Confidentiality. All personnel authorized to process Agency Personal Data are bound to maintain its confidentiality.

(c) Security of Processing. The Company shall implement appropriate technical and organizational measures to ensure the security of Agency Personal Data, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purpose of processing, and the risks involved. The measures in place are described in the Security Policy, which forms part of this Addendum.

(d) Accuracy. The Company shall notify the Agency without undue delay of any inaccuracy in Agency Personal Data of which it becomes aware. The parties shall cooperate in good faith with respect to the erasure or rectification of inaccurate Agency Personal Data.

(e) Assistance. Taking into account the nature of the processing, the Company shall assist the Agency with data protection impact assessments and prior consultations with supervisory authorities, to the extent they concern Leepr.

4. Sub-Processors

(a) The Agency grants general authorization for the engagement of the sub-processors listed below. The Company shall provide at least seven (7) days advance notice of any changes to this list by updating this page and notifying the Agency by email or in Leepr. The Agency may object to a change on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Agency may close its account.

(b) All sub-processor contracts shall include data protection obligations equivalent to those set forth in this Addendum. The Company remains fully responsible for the performance of its sub-processors.

Sub-processor	Purpose	Location
Amazon Web Services (AWS)	Sending and receiving email for the Agency’s conversations and Leepr’s notifications (Amazon SES), storage of incoming email, and the notifications that deliver it	European Union
Stripe	Payments, invoices and the Agency’s billing details	United States and European Union
Google	Sign-in with Google, and calendars that Authorized Users choose to connect	United States
Microsoft	Sign-in with Microsoft, and calendars that Authorized Users choose to connect	United States
Anthropic	The optional assistant: configuration and members’ descriptions with names, email addresses and phone numbers removed; never the records of leads, students or contacts	United States
Sentry	Error monitoring, configured not to include personal data	European Union
Cloudflare	Network delivery and protection, DNS, and Turnstile on public forms, the application and booking pages	Global network

5. Data Subject Rights

The Company shall promptly notify the Agency of any request received directly from a data subject concerning Agency Personal Data and shall not respond to such request independently unless authorized by the Agency. Leepr lets the Agency find, export, correct and delete the records of its leads, students and contacts, and the Company shall assist the Agency, by appropriate technical and organizational measures, in fulfilling its obligations to respond to data subject rights requests under the GDPR.

6. Personal Data Breach

Upon discovery of any unauthorized access to Agency Personal Data, the Company shall take reasonable measures immediately to investigate and contain the incident, and shall notify the Agency’s designated security contact without undue delay and in any case within twenty-four (24) hours of confirming such unauthorized access. Such notice shall include: the extent of exposure, a description of the incident, the timeline of events, the scope of affected data, and the response measures taken or planned.

7. Onward Transfers and International Transfers

(a) Agency Personal Data shall only be disclosed to third parties in accordance with the Agency’s documented instructions and only to third parties that are bound by contractual obligations equivalent to this Addendum.

(b) Leepr’s servers, database, stored files and email are located in the European Union. Where Agency Personal Data is accessed from or transferred to a country outside the European Economic Area, the United Kingdom or Switzerland that does not ensure an adequate level of protection, including by the Company itself and the sub-processors located in the United States, the parties rely on the European Commission’s standard contractual clauses or another safeguard recognised by the GDPR.

(c) Local Laws and Practices. The Company warrants that it has no reason to believe that the laws and practices applicable to its processing of Agency Personal Data prevent it from fulfilling its obligations under this Addendum, and shall promptly notify the Agency if it becomes subject to laws or practices that would prevent it from doing so.

8. Public Authority Access

(a) Notification. The Company shall promptly notify the Agency of any legally binding request for disclosure of Agency Personal Data received from a public authority, including the identity of the requesting authority, the legal basis for the request, and the response provided. If the Company is prohibited from notifying the Agency, it shall use best efforts to obtain a waiver of such prohibition.

(b) Legality Review. The Company shall review the legality of each disclosure request and shall challenge any request that it reasonably believes to be unlawful, and shall not disclose the requested Agency Personal Data until procedurally required to do so.

(c) Minimization. The Company shall provide the minimum amount of information permissible in responding to a disclosure request, based on a reasonable interpretation of the request, and shall document its legal assessment.

9. Return and Deletion

The Agency can export its leads and reports from Leepr at any time. When the Agency closes its account, it may ask for an export of its Agency Personal Data for thirty (30) days; the Company then deletes the Agency Personal Data from Leepr, and it is deleted from backups as they expire, within a further thirty (30) days, and the Company shall certify the deletion on request. If the law requires the Company to keep any of it, the Company shall continue to comply with this Addendum with respect to that data.

While the account is open, the following technical records are deleted on a shorter schedule: raw copies of incoming email and notifications received from Sponsors after thirty (30) days, the log of webhook deliveries after thirty (30) days, unapplied assistant drafts after thirty (30) days, and backups after thirty (30) days.

10. Documentation and Audits

The Company shall maintain documentation of the processing activities carried out on behalf of the Agency and shall make available to the Agency all information necessary to demonstrate compliance with this Addendum. The Company shall allow and contribute to audits conducted by the Agency or an auditor mandated by the Agency at reasonable intervals or upon indication of non-compliance, with reasonable prior notice and subject to confidentiality. Relevant certifications and independent assessments held by the Company may be considered in assessing compliance.

11. Minors

Students and applicants recruited by Agencies are often minors. The Agency shall obtain any consent required by the law of the student’s own country from the student’s parent or legal guardian, including any parental consent required under Article 8 of the GDPR where the applicable digital-consent age applies, and shall provide the information required by Articles 13 and 14 of the GDPR to the students and families whose data it keeps in Leepr.

12. Supervision and Liability

(a) The supervisory authority of the EU Member State in which the Agency is established shall oversee compliance with this Addendum. The Company shall cooperate with the supervisory authority in all compliance procedures and shall respond to inquiries from such authority.

(b) Each party is liable for its breaches of this Addendum in accordance with the GDPR. The limitations of liability in the Terms of Service apply to this Addendum to the extent permitted by applicable law.

13. Precedence

In the event of a conflict between this Addendum and any other provision of the Terms of Service with respect to the processing of Agency Personal Data, this Addendum prevails.

All questions regarding data processing practices should be directed to privacy@exlink.org; security matters to security@exlink.org.