Data Processing Addendum
1. Roles and scope
For account, billing, security and Lankom's own business administration, Lankom Petroleum Ltd may act as an independent controller. Where a business customer uploads or submits personal data for Deal Intelligence to host, organise, analyse or otherwise process on the customer's documented instructions, the customer is controller (or processor acting for another controller) and Lankom Petroleum Ltd is processor.
2. Processing details
| Subject matter | Provision of Deal Intelligence, document storage, project/deal workflows, due diligence and support. |
|---|---|
| Duration | For the subscription and any lawful retention/deletion period. |
| Nature/purpose | Hosting, structuring, retrieving, displaying, securing, backing up and, where selected, analysing customer data and documents. |
| Data types | Business contact details, account data, company/CIS/KYC information, identification/supporting evidence, transaction data, correspondence and other data submitted by the customer. |
| Data subjects | Customer users, counterparties, directors/officers/owners, contacts, representatives and other persons whose data is lawfully submitted. |
3. Processor obligations
Lankom will process customer personal data only on documented instructions (including these terms and use of the service), unless law requires otherwise; ensure persons authorised to process the data are subject to confidentiality; implement appropriate technical and organisational security; and notify the customer if an instruction appears to infringe applicable data protection law.
4. Sub-processors
The customer authorises the use of sub-processors reasonably required to provide the service. Current providers may include Supabase (database/authentication/storage), Vercel (hosting/content delivery), Stripe (billing/payment services), Resend (transactional email) and OpenAI (AI-assisted functionality where used). Lankom will require appropriate data-protection obligations from sub-processors and remains responsible for its processor obligations as required by law.
5. International transfers
Lankom will use an appropriate lawful transfer mechanism where customer personal data is transferred outside the UK and UK law requires safeguards.
6. Assistance
Taking account of the nature of processing and information available, Lankom will provide reasonable assistance with data-subject requests, security obligations, personal data breach response, DPIAs and regulator consultation where required. Additional work outside normal service may be chargeable where legally permitted and agreed.
7. Personal data breaches
Lankom will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data where notification is required and will provide available information reasonably needed for the customer's compliance obligations.
8. Return and deletion
At the end of services, Lankom will delete or return customer personal data as reasonably available and instructed, unless law requires retention. Residual copies may remain temporarily in protected backups until overwritten in normal backup cycles.
9. Audit information
Lankom will make available information reasonably necessary to demonstrate compliance with applicable processor obligations. Any audit must protect security and other customers' confidentiality, avoid unreasonable disruption, and normally use existing certifications, reports or remote evidence before on-site inspection.
10. Customer obligations
The customer is responsible for its lawful basis, privacy information, data accuracy, minimisation, retention instructions and ensuring it has the right to submit personal data to the service. The customer must not instruct Lankom to process data unlawfully.
11. Priority
If this DPA conflicts with the Subscription Terms on the processing of customer personal data, this DPA prevails to that extent. Mandatory data protection law prevails over both.