Data Processing Agreement

1. What this is, and when it applies

This agreement forms part of the Terms of Service and applies whenever Lokom processes personal data on your behalf.

You are the controller. Lokom is the processor. You decide why your sales representatives' data exists and what happens to it; we act only on your instructions.

This agreement does not cover data for which Lokom is itself the controller — your account, your billing, our security logs. That is in the Privacy Notice.

If there is a conflict between this agreement and the Terms of Service on a data protection question, this agreement wins.

2. What we process, and for how long

Subject matter and purpose. Calculating and administering sales commission on your instructions, as described in the Terms of Service.

Duration. For as long as your account is open, plus the 14-day deletion grace period in section 9.

Categories of data subject. Your employees and contractors: sales representatives, managers, and administrators. Also individuals named as owners on deals in your CRM.

Types of personal data.

No special categories. Lokom is not designed to process data revealing health, race, religion, political opinions, trade union membership, sex life or biometrics, and you must not load such data into it. Compensation data is not a special category under GDPR, but it is sensitive in practice and we treat it as such.

3. Your obligations

You warrant that you have a lawful basis for the personal data you load into Lokom, and that you have told the people concerned what is happening to it — in particular that their commission is calculated in a third-party tool. This is usually an employment-context notice; it is yours to give, not ours.

Your instructions to us are: the configuration you set in the product, and any written instruction you send to [email protected].

4. Our obligations

We will:

1. Process only on your documented instructions, including for transfers,

unless EU or member state law requires otherwise — in which case we will tell you first, unless that law forbids it.

1. Ensure our people are bound by confidentiality.
2. Apply the security measures in section 7 (GDPR Art. 32).
3. Respect the sub-processor conditions in section 6.
4. Help you respond to data subject requests — access, correction, erasure,

portability, objection — using the product's own export and deletion functions, and by hand where those do not reach.

1. Help you with your obligations under Articles 32 to 36: security, breach

notification, impact assessments and prior consultation, given the information available to us.

1. Delete or return the data at the end of the service, as you choose — see

section 9.

1. Make available the information you need to show we comply, and allow and

contribute to audits — see section 8.

5. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and in any case within 48 hours — which leaves you the remaining 24 hours of your own 72-hour Art. 33 deadline.

The notification will describe what happened, the categories and approximate numbers affected, the likely consequences, and what we are doing about it — as far as we know it at the time. We will not wait until we know everything.

6. Sub-processors

You give general authorisation for us to use sub-processors. The current list is in section 6 of the Privacy Notice and is the authoritative version.

We will give you 30 days' notice before adding or replacing one. If you reasonably object on data protection grounds, tell us within that period and we will work with you to find an alternative; if we cannot, you may terminate the affected part of the service without penalty for the remainder of the paid period.

Every sub-processor is bound by obligations no weaker than those in this agreement, and we remain fully liable to you for their performance.

7. Security measures

These are implemented, not aspirational.

Tenant isolation, enforced twice. Every query is filtered by organisation in the application layer, and PostgreSQL row-level security enforces the same boundary in the database, under a role that cannot bypass it. A missed application filter returns zero rows rather than another customer's. An automated test asserts that every organisation-scoped table carries a policy, so a new table cannot silently arrive uncovered.

Credentials. Third-party tokens (Pipedrive OAuth, Stripe keys) are held in a secrets vault, never in plain-text columns. Other sensitive values are encrypted at rest with AES-256-GCM.

Access control. Authentication is via signed JWTs; identity is taken only from the verified token and never from a request body.

Data minimisation in logs. Commission amounts, payout values, deal values and personal identifiers must not be written to logs. An automated check runs against the commission and billing code on every commit.

Audit trail. Changes that can affect someone's pay are recorded with the actor, the organisation, the action and a sanitised before/after.

Encryption in transit for all traffic. Hosting as set out in the Privacy Notice: EU regions for storage, with the one US transit path disclosed there.

8. Audits

We will give you the information you reasonably need to verify our compliance.

For on-site audits: once per year, on 30 days' notice, at your cost, under confidentiality, and only once a documentation review has not already answered the question.

9. Deletion and return

At any time while your account is open, you can export commission data as CSV and payout statements as PDF.

When the service ends, or when you delete your organisation, we erase the personal data. There is a 14-day grace period first, during which you can cancel and after which erasure runs automatically across every table belonging to your organisation, followed by a verification pass that confirms nothing remains.

Two exceptions, both narrow: a permanent record that the deletion occurred — which organisation, when, on whose instruction, and nothing about the individuals — and anything we must keep by law, such as invoices.

Backups are retained for 7 days, under our current Supabase plan. Erasure reaches the live database immediately; it ages out of any backup taken before the deletion within that 7-day window.

10. Transfers outside the EU

Storage is in the EU. One transit path runs through the United States, described in section 7 of the Privacy Notice, and relies on the Standard Contractual Clauses, which are incorporated into this agreement by reference and prevail over it in case of conflict.

11. Contact

[email protected]