1. Object, nature, and control
This Data Processing Agreement establishes mandatory general guidelines for operators processing data on behalf of Lumus Assessoria Publicitaria Ltda, CNPJ 43.873.616/0001-80 ('LUMUS' or 'controller'), whether in the development, maintenance, hosting, or support of this website and the services associated with it. It does not replace specific agreements that detail the operation.
2. Position and parties
LUMUS acts as a controller when deciding on the processing of data from visitors, clients, leads, and employees. Suppliers, developers (including Replit), cloud providers (AWS), and agencies processing data under LUMUS's instruction will act as processors.
Bme - Administracao, Incorporacao e Assessoria de Propriedades LTDA, CNPJ 59.240.559/0001-31, may act as an affiliated recipient, controller for its own corporate purposes, or processor under documented instructions, depending on the actual flow.
3. Instructions, purpose, and duration
The processor will process data only according to documented instructions from the controller, for the provision of the site, security, relationship, infrastructure, authorized analysis, and execution of the contracted services. The processing will last as long as there is a contractual relationship or legal need for retention.
4. Data categories and data subjects
- Data subjects: visitors, leads, clients, representatives, employees, and commercial contacts.
- Data: identification and contact, professional data, submitted content, contract data, navigation logs, IP, device, cookies, events, clicks, and security information.
- Sensitive data must not be sent, except for express need, adequate legal basis, and specific instructions.
5. Processor obligations
- Process data only for authorized purposes and maintain confidentiality.
- Adopt technical and administrative controls appropriate to the risk, including applicable encryption, access control, logging, and vulnerability management.
- Support the controller in assisting data subjects, impact assessments, reasonable audits, and obligations before the ANPD.
- Report security incidents without undue delay, providing available information for evaluation and compliance with legal deadlines.
- Delete or return data upon termination, subject to legal retention obligations.
6. Sub-processors
Sub-processors necessary for the provision of services may be used, including AWS, Google, Meta, Replit, and Wix. The processor must impose compatible protection obligations and be responsible for the selection and management of these suppliers within its sphere of operation.
Relevant changes to the list of sub-processors will be informed by updating this document or through a contractual channel. Clients may submit a justified objection regarding data protection, to be evaluated in good faith.
7. International transfer
International transfers will observe the mechanisms provided for in the LGPD and the ANPD regulations. The parties will adopt contractual, organizational, and technical safeguards compatible with the risk and the destination country.
8. Commercial sharing
Data processed on behalf of clients will not be sold. Data directly controlled by LUMUS may only be shared with partners for commercial purposes, including for remuneration, when there is specific, prominent, and revocable consent, or another clearly informed valid legal basis. The mere acceptance of the Privacy Policy does not constitute authorization.
9. Audit and responsibility
Upon reasonable request and a duty of confidentiality, the processor will provide sufficient information to demonstrate compliance. Each party will be responsible for its own decisions, instructions, and violations, as per the LGPD and the applicable contract.
10. Contacts and prevalence of specific contract
Data protection matters: dpo@lumus.company. Legal matters: juridicolumus@biomebr.com. This public DPA does not replace the data processing annex of a specific contract, which must indicate the object, duration, nature, purpose, categories of data, data subjects, and particular instructions.