Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between:

Controller: The customer using the Helium Rooms Service ("Customer")

Processor: Lighthouse Intelligence, a sole proprietorship (eenmanszaak) registered in the Netherlands, operating the Helium Rooms platform ("Processor")

1. Subject Matter

This DPA applies to the processing of personal data by the Processor on behalf of the Customer in connection with the Helium Rooms SaaS platform.

2. Nature and Purpose of Processing

The Processor processes personal data solely to provide and maintain the Service, including:

• Hosting customer rooms
• Authentication and access control
• Integrations with third-party services
• Customer support

3. Categories of Data and Data Subjects

Data Subjects:

• Customer employees
• Customer clients
• Authorized users

Personal Data:

• Names and email addresses
• Authentication data
• Uploaded files and content
• Metadata related to Service usage

4. Obligations of the Processor

The Processor shall:

• Process personal data only on documented instructions of the Customer
• Implement appropriate technical and organizational security measures
• Ensure confidentiality of personnel
• Assist the Customer with GDPR compliance where reasonably possible
• Notify the Customer without undue delay after becoming aware of a personal data breach

5. Sub-processors

The Customer authorizes the use of sub-processors, including but not limited to:

• Vercel (hosting)
• Supabase (authentication and database)
• Stripe (payment processing)
• Analytics providers (if enabled)

The Processor shall remain responsible for sub-processors.

6. International Transfers

Where personal data is transferred outside the EEA, appropriate safeguards such as Standard Contractual Clauses are applied.

7. Data Retention and Deletion

Upon termination of the Service, personal data will be deleted or anonymized within a reasonable period, unless retention is required by law.

8. Audit and Information

The Processor shall make available information reasonably necessary to demonstrate compliance with this DPA.

9. Liability

Liability under this DPA is subject to the limitations set forth in the Terms and Conditions.

10. Governing Law

This DPA is governed by Dutch law.