Data Processing Agreement (Article 28)

0. Scope note — read this first

This Agreement covers only the narrow set of processing where the API Client is the controller and SkillSwap Ltd, trading as Lemma, HE 475899, registered office Dodekanisou 18, Office 201, 7060 Larnaca, Cyprus (the "Company", "Processor") acts as its processor:

• Employer-initiated Assessment Invites — the Client supplies a candidate's contact details, asks the Company to invite that person to take an assessment, and receives the result;
• Client-configured assessment content — skills, question sets, thresholds and instructions the Client defines;
• Client administrator account data processed on the Client's instructions for the above.

It does not cover the disclosure of a Verification or an SCI to the Client. That is an independent controller-to-controller disclosure governed by the Data Sharing Agreement (Schedule 1), where the Company acts as controller on the Candidate's explicit consent, not on the Client's instructions, and Art. 28 does not apply. The two Schedules are separate instruments and must not be conflated.

To take an invited assessment, the candidate signs in to a Lemma account. The candidate's own use of the Platform through that account is processing for which the Company is controller under its Privacy Policy, and this Agreement does not apply to it.

---

1. Definitions and roles

1.1 "Controller", "Processor", "Data Subject", "Personal Data", "Processing", "Personal Data Breach" and "Supervisory Authority" have their GDPR meanings. "Data Protection Law" means the GDPR and Cyprus Law 125(I)/2018.

1.2 For the processing in clause 0, the API Client is the Controller and the Company is the Processor. This Agreement prevails over the Verification Services Agreement and the Developer API Terms on any data protection question within its scope.

---

2. Documented instructions

2.1 The Company processes Personal Data only on the Controller's documented instructions, including as to international transfers, unless Union or Member State law requires otherwise — in which case it informs the Controller of that requirement before processing, unless the law prohibits this on important grounds of public interest (Art. 28(3)(a)).

2.2 The documented instructions are this Agreement, Annex I, the Verification Services Agreement and its Order Form, and any further written instruction the parties agree.

2.3 The Company will immediately inform the Controller if, in its opinion, an instruction infringes Data Protection Law (Art. 28(3), final paragraph), and may pause the affected processing until the instruction is withdrawn or corrected. It does not give legal advice.

2.4 The Company does not use Personal Data processed under this Agreement for its own purposes, and in particular does not use Assessment Invite data or Client-configured content to train, fine-tune or evaluate any model.

---

3. Confidentiality of personnel

3.1 Every person authorised to process the Personal Data is under an appropriate contractual or statutory duty of confidentiality (Art. 28(3)(b)), which survives the end of their engagement.

3.2 Access is limited to personnel who need it, granted on a least-privilege basis, withdrawn promptly when no longer needed, and supported by data protection and security training appropriate to the role.

---

4. Security

4.1 The Company implements the measures in Annex II, which are appropriate to the risk, taking account of the state of the art, cost, and the nature, scope, context and purposes of the processing (Arts. 28(3)(c) and 32). It keeps Annex II under review and may update the measures, provided the level of protection is not reduced.

---

5. Sub-processors

5.1 The Controller gives the Company general written authorisation to engage sub-processors (Art. 28(2)). The current sub-processors are listed in the Sub-processor List, cross-referenced in Annex III.

5.2 The Company gives at least 30 days' prior written notice before adding or replacing a sub-processor, by email to the Controller's notified data protection contact and by updating the Sub-processor List.

5.3 The Controller may object on reasonable data protection grounds within 15 days of that notice. The parties will discuss in good faith; failing resolution, the Controller may terminate the affected services on written notice without penalty and receive a pro-rata refund of prepaid fees. This is its sole remedy for an objection.

5.4 The Company imposes on each sub-processor, by written contract, data protection obligations at least as protective as those here (Art. 28(4)), and remains fully liable to the Controller for the sub-processor's performance.

---

6. Assistance with data subject rights

6.1 Taking into account the nature of the processing, the Company assists the Controller by appropriate technical and organisational measures, insofar as possible, in responding to Data Subject rights requests under GDPR Chapter III (Art. 28(3)(e)).

6.2 If a Data Subject contacts the Company directly about processing under this Agreement, it will not respond substantively: it will direct them to the Controller and notify the Controller within five working days.

6.3 Assistance is free for a reasonable volume of requests. Where a request requires disproportionate effort the parties agree reasonable costs in advance.

---

7. Assistance with Articles 32 to 36

7.1 The Company assists the Controller in ensuring compliance with Arts. 32–36, taking into account the nature of processing and the information available to it (Art. 28(3)(f)).

7.2 Personal Data Breach. The Company notifies the Controller without undue delay and in any event within 48 hours of becoming aware of a Personal Data Breach affecting data processed under this Agreement, describing so far as known the nature of the breach, the categories and approximate number of Data Subjects and records affected, likely consequences, measures taken or proposed, and a contact point. It supplies further information as it emerges and does not delay the initial notification to finish investigating. The Controller notifies its Supervisory Authority and Data Subjects (Arts. 33 and 34).

7.3 Impact assessments. The Company provides the information reasonably needed for the Controller's impact assessment (Art. 35) and any prior consultation (Art. 36).

---

8. Deletion or return

8.1 At the Controller's choice, on termination of the services the Company deletes or returns all Personal Data processed under this Agreement and deletes existing copies (Art. 28(3)(g)). The Controller must state its choice within 30 days of termination; if it does not, the Company deletes.

8.2 Deletion completes within 90 days of instruction, including from routine backups on the ordinary rotation cycle. Backup data is isolated from active processing until overwritten.

8.3 The exception is where Union or Member State law requires storage. The Company then retains only what the law requires, for the required period and purpose, keeps it protected under this Agreement, deletes it when the obligation ends, and on request identifies the legal basis.

---

9. Information and audit

9.1 The Company makes available all information necessary to demonstrate compliance with Art. 28, and allows for and contributes to audits, including inspections, by the Controller or an auditor it mandates (Art. 28(3)(h)).

9.2 In the first instance the Company may answer an audit request with written answers and supporting documents, and with third-party audit reports, penetration test summaries or security certifications once it holds them (it holds none today), where these address the Controller's questions.

9.3 Where those are insufficient the Controller may inspect: on 30 days' written notice, during business hours, once in any twelve-month period (unless a Personal Data Breach or a Supervisory Authority requires more), without unreasonable disruption, subject to confidentiality undertakings and the Company's security rules. An auditor who competes with the Company may be refused, and an alternative named.

9.4 Each party bears its own audit costs, unless the audit reveals a material breach by the Company, which then bears the Controller's reasonable costs.

---

10. International transfers

10.1 The Company transfers Personal Data outside the EEA only in accordance with the Controller's instructions and GDPR Chapter V.

10.2 The Company is established in Cyprus, so a Controller established in the EEA transfers nothing outside the EEA by instructing it. Where the Controller is established outside the EEA and does not benefit from an adequacy decision, the 2021 Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module Four (processor to controller), are incorporated by reference for the return of results to the Controller. Onward transfers by the Company to sub-processors outside the EEA are covered by the Company's own agreements with those sub-processors (Module Three, or the EU–US Data Privacy Framework where the sub-processor is certified), as required by Art. 28(4) and Chapter V.

10.3 For the incorporated Clauses: the docking clause applies; Clause 9(a) Option 2 (general authorisation) applies with the notice period in clause 5.2; Clause 11 omits the optional dispute resolution body; Clauses 17 and 18(b) select the law and courts of the Republic of Cyprus; and Annexes I, II and III to the Clauses are populated by Annexes I, II and III to this Agreement.

10.4 Where a recipient certifies under the EU–US Data Privacy Framework the Company may rely on the adequacy decision, but keeps the 2021 SCCs as a contractual fallback and maintains a transfer impact assessment. The DPF was upheld in T-553/23 Latombe (3 September 2025), but that judgment is under appeal to the Court of Justice (lodged 31 October 2025, pending).

---

11. Liability and term

11.1 Clause 11 of the Verification Services Agreement governs liability under this Agreement, subject to clause 11.2.

11.2 Nothing here limits a Data Subject's rights, a Supervisory Authority's powers, or either party's liability under GDPR Art. 82. Where the incorporated Standard Contractual Clauses conflict with clause 11.1, those Clauses prevail between the parties.

11.3 This Agreement takes effect with the Verification Services Agreement and continues while the Company processes Personal Data on the Controller's behalf. Clauses 3, 8, 9, 10 and 11 survive for as long as the Company holds any of the Personal Data. It is governed by the laws of the Republic of Cyprus.

---

Annex I — Details of Processing

A. Parties. Exporter / Controller: the API Client named in the Order Form. Importer / Processor: SkillSwap Ltd, trading as Lemma, HE 475899, Dodekanisou 18, Office 201, 7060 Larnaca, Cyprus; data protection contact: privacy lead, privacy@getlemma.io.

B. Description of transfer

---

Annex II — Technical and Organisational Measures

These are specific commitments, not aspirations.

1. Access control and identity User authentication uses Firebase Authentication (Google), with optional two-factor authentication for Users. Access to infrastructure consoles (Vercel, Railway, Neon, Cloudflare, Stripe) is limited to individually attributed accounts of authorised personnel; there are no shared accounts. The internal administration console uses individual accounts with hashed session tokens and permission-based roles; multi-factor authentication for it is planned. Production access is least-privilege and revoked within one working day of a person leaving.

2. Encryption Data in transit uses TLS 1.2 or above, with HSTS on public endpoints. Data at rest is encrypted in the managed Postgres database (Neon), object storage (Cloudflare R2) and backups, using provider-managed AES-256 or equivalent. API keys are stored only as SHA-256 hashes; calendar access tokens are encrypted with AES-256-GCM; webhooks are signed with HMAC-SHA256; secrets live in the platform secrets manager, never in source control.

3. Network and application security API traffic passes through Cloudflare, and the API applies per-IP and per-key rate limits. Dependencies are reviewed and security patches applied on a risk-prioritised schedule; every change passes automated type checks, tests and a source scan for unsafe query construction, code evaluation and hard-coded secrets before deployment. Input validation and parameterised queries guard against injection. User sessions use HTTP-only, secure session cookies that expire after 14 days.

4. Segregation Production and development use separate databases and credentials. Sandbox API keys are a separate key type with lower rate limits and return only synthetic data: they never read a real person's records. Live keys are issued only by the Company to members of a Client organisation. Client data is logically segregated by the API key and account that created it, with authorisation checks at the query layer.

5. Logging and monitoring Administrative actions are recorded in an append-only audit log with timestamps and actor identifiers. API calls are logged per key, and every Verification disclosure is logged and shown to the Candidate. API usage logs are kept for 12 months. Error monitoring (Sentry) covers application errors, and the production service is health-checked continuously.

6. Backup and resilience The primary database (Neon) keeps a continuous change history that allows point-in-time recovery for the preceding 6 hours; object storage is replicated by the provider. A documented restore procedure exists, and we will test it at least annually.

7. Personnel Anyone with access to personal data is bound by written confidentiality obligations and uses devices with full-disk encryption and screen lock. Today the only person with production access is the Company's director.

8. Sub-processor management Each sub-processor is assessed before engagement, engaged under an Art. 28-compliant written contract, and listed publicly in the Sub-processor List. Hosting regions are pinned to the EU wherever the vendor offers it.

9. Incident response Incidents are handled through detection, triage, containment, notification and post-incident review, with the 48-hour notification in clause 7.2. Security reports go to security@getlemma.io.

10. Deletion An automated daily job deletes personal data from the primary database and object storage on the schedule in the Privacy Policy; deleted data leaves the database's recovery history within 6 hours.

---

Annex III — Sub-processors

The current authorised sub-processors — with the service each provides, the categories of data processed, the location of processing and the transfer mechanism — are published in the Sub-processor List at https://getlemma.io, which is incorporated here by reference. It covers the Company's hosting, database, storage, payment, communications, authentication and AI providers. Additions and replacements follow clause 5.

The Controller confirms it has reviewed the Sub-processor List as at the effective date and authorises the sub-processors named in it.