Data Processing Agreement (DPA) Status

Last reviewed: 2026-08-23

This page is not a Data Processing Agreement and cannot be signed or incorporated into a contract.

Current status

Lumail is an early-stage service operated by Codelynx, LLC. Lumail does not currently provide a customer DPA that satisfies GDPR Article 28.

At this time:

• There is no Lumail DPA available to download, accept, or countersign.
• Lumail's standard customer terms do not incorporate the European Commission's Standard Contractual Clauses (SCCs).
• Codelynx does not claim an active EU-U.S. Data Privacy Framework certification for Lumail.
• Lumail does not offer an EU-only data-residency commitment or a completed customer transfer impact assessment.
• DPAs or transfer safeguards offered by Lumail's infrastructure providers do not form a DPA between Codelynx and a Lumail customer.

If your organization acts as a controller or processor and requires an Article 28 DPA, SCCs, or another transfer mechanism, do not use Lumail to process the affected EEA, UK, or Swiss personal data until the necessary terms have been issued and executed.

Why there is no signable DPA yet

The product and its infrastructure are still evolving. Publishing a template that says "DPA" before the processing instructions, audit terms, deletion commitments, breach process, subprocessor notice procedure, transfer modules, and technical measures are ready would create a misleading contract. This status page states the present limitation instead.

The Privacy Policy and GDPR in Lumail describe current practices for transparency, but neither document substitutes for an executed DPA.

Planned package

Lumail intends to prepare:

• GDPR Article 28 controller-to-processor terms
• Appropriate SCC modules for transfers that require them
• A transfer and data-location annex
• A maintained subprocessor list and advance-change notice process
• Technical and organizational measures
• Retention, return, deletion, audit, and incident-notification terms

This is a roadmap, not a binding promise or release date. The final documents may change after legal and infrastructure review.

Requests from prospective EU customers

If your legal or procurement team needs a DPA now, the accurate answer is that Lumail cannot currently provide one. You can contact [email protected] to register interest and describe your requirements, but contacting us does not authorize EEA processing or create contractual safeguards.

When a signable DPA becomes available, this page will be replaced or updated with the download or acceptance process and the effective version date.