Data Processing Addendum

Last updated: 2026-10-18

These terms describe processing of customer-controlled personal information by Lokos AI LLC to provide agreed business services. They apply where incorporated into the customer agreement, subject to any separately executed DPA and its order of precedence. Existing signed obligations remain effective. Contact us to agree a project-specific processing schedule before submitting data requiring additional safeguards.

1. Scope and roles

The customer determines the purposes and lawful instructions for its project data; Lokos AI processes it on the customer's behalf to perform the agreed services. Account administration, billing, fraud prevention and Lokos AI's own legal records are separately described in the Privacy Policy and are not automatically customer-instructed processing.

Processing may include receiving, storing, organizing, extracting, generating drafts from, transmitting and deleting specifications, clarifications, code, attachments, messages and project documents. Depending on the project, data subjects may include staff, contractors, customers, signatories and other people described in supplied materials. Data categories include contact/professional information, project content and relevant contract information. Voice/transcript processing applies only where ordered. Duration follows the service agreement, retention instructions and lawful exceptions.

2. Instructions and restrictions

The customer must have authority and a lawful basis to supply data and provide required notices. Lokos AI processes it only on documented lawful instructions, including the agreed service and support, or as required by law; we will inform the customer of legally required processing unless prohibited. We will flag instructions we believe violate applicable data-protection law.

We will not sell or share customer-controlled personal information for cross-context behavioral advertising, retain/use/disclose it outside the specified business purposes or direct business relationship, or combine it with unrelated data except as permitted by applicable law. Where applicable California service-provider/contractor rules apply, we will provide the same level of privacy protection required by those rules, notify the customer if we can no longer comply, and allow reasonable steps to verify, stop and remediate unauthorized use. Project content is not a general-purpose model-training grant.

3. People, security and providers

Access must be limited to authorized people subject to confidentiality obligations. Safeguards include scoped access, authentication, private storage, protected transport and operational monitoring, appropriate to the agreed processing. Additional regulated-data requirements must be agreed before submission; this public document is not a certification or promise of every possible security control.

The customer authorizes providers needed for the agreed service, with written obligations appropriate to their processing. Relevant services can include hosting/storage, identity, model inference, document processing, email and payment. Ask for the current project-specific provider list, locations and change-notice/objection arrangements; separately executed terms govern those arrangements. Lokos AI remains responsible for its subprocessor obligations under the applicable agreement and law.

4. Assistance and incidents

We will reasonably assist with applicable individual-rights requests, security obligations and assessments, taking account of the processing and information available. Requests about customer-controlled data are directed to the customer unless law requires otherwise. We will notify the customer without undue delay after becoming aware of a personal-data breach affecting data processed on its behalf, provide available information about the incident, likely consequences and mitigation, and supplement it as the investigation develops. This does not replace statutory notification deadlines.

5. Return, deletion, review and transfers

At termination or on lawful instruction, we will arrange return or deletion of customer-controlled data according to the agreement, subject to legal retention, holds and backup constraints; retained data remains protected and limited to permitted purposes. The portal's deletion-request workflow is not immediate erasure. Project-specific schedules must distinguish customer content from signed contracts, invoices and audit evidence retained for independent obligations.

We will make information reasonably necessary to demonstrate compliance available and cooperate with appropriate reviews under agreed confidentiality, scope and security arrangements. These arrangements cannot remove audit or regulatory rights required by applicable law.

We do not represent that a public DPA automatically supplies Standard Contractual Clauses, EU representation or a valid international-transfer mechanism. Where such arrangements are legally required, they must be put in place for the actual processing before it begins. Liability follows the main agreement except where mandatory law provides otherwise.

Lokos AI LLC · 200 Broadway, New York, NY 10038, USA · maria@lokos.ai