Data Processing Addendum
Last updated 23 October 2026
In short: when you connect data sources or add personal data to Luciqo, you are the controller of that data and we process it only on your instructions. This addendum sets out how we protect it, which sub-processors we use, and how we help you meet your obligations under UK GDPR. It forms part of our Terms and Conditions and applies automatically when you use the Service.
1. Parties and scope
1.1 This Data Processing Addendum ("DPA") is between Virtuance Digital Marketing Ltd, which operates Luciqo ("Luciqo", "we", "us"), and the customer that has accepted our Terms and Conditions ("you", "Customer").
1.2 This DPA applies where we process Customer Personal Data on your behalf in providing the Service. It does not apply to account data (such as your users' names, email addresses, company details, billing details and usage logs), for which we are the controller under our Privacy Policy.
1.3 If this DPA and the Terms conflict on data protection matters, this DPA applies.
2. Definitions
2.1 In this DPA:
- Data Protection Law means the UK GDPR, the Data Protection Act 2018 and, where it applies to you, the EU GDPR.
- Customer Personal Data means personal data that we process on your behalf, including personal data in data from Connected Sources and in content you add to the Service.
- Connected Source means a service you choose to connect, such as Google Analytics 4, Matomo or HubSpot.
- Sub-processor means a third party we engage to process Customer Personal Data.
- Controller, processor, data subject, personal data, personal data breach and processing have the meanings given in Data Protection Law.
3. Roles
3.1 You are the controller, and we are the processor, of Customer Personal Data.
3.2 Where you are an agency acting for your own clients, you may be a processor for your client. In that case you confirm that you have your client's authority to instruct us, and we act as your sub-processor.
3.3 You are responsible for having a lawful basis for the processing, for giving any required notices to data subjects and for obtaining any consents needed, including for connecting your Connected Sources to the Service.
4. Details of the processing
4.1 The details of the processing are:
| Item | Details |
|---|---|
| Subject matter | Providing the Luciqo platform under the Terms |
| Duration | For the term of your subscription, and until deletion under section 12 |
| Nature and purpose | Retrieving, storing, analysing and reporting on data from Connected Sources to show channels, customer journeys and revenue; answering "Ask your data" questions; producing reports and share links |
| Types of personal data | Pseudonymised identifiers (such as analytics client IDs or CRM record IDs), aggregated journey and session data, traffic source, pages visited, conversions, deal and revenue values, and any personal data you add to brand profiles or buyer questions |
| Data subjects | Visitors to your websites, and your leads and customers recorded in your Connected Sources |
| Special category data | Not intended. You must not send special category or criminal offence data to the Service |
4.2 We store only pseudonymised and aggregated journey and analytics data from Connected Sources. We never store contact names or email addresses from your CRM or analytics.
5. Our obligations
5.1 We will:
- process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and your use and configuration of the Service, unless the law requires otherwise, in which case we will tell you first unless the law prevents it;
- tell you promptly if we believe an instruction breaks Data Protection Law;
- make sure everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality;
- put in place the security measures in section 6;
- engage sub-processors only in line with section 7;
- help you, taking into account the nature of the processing, to respond to data subject requests and to meet your obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO; and
- make available the information reasonably needed to show that we comply with this DPA, as set out in section 11.
6. Security
6.1 We use appropriate technical and organisational measures to protect Customer Personal Data, including:
- encryption of data in transit;
- encryption of OAuth tokens and API tokens for Connected Sources at rest;
- storing only pseudonymised and aggregated data from Connected Sources;
- read-only access to Google Analytics 4;
- access controls so that each workspace can access only its own data, and staff access only where needed;
- hashed passwords and secure authentication;
- hosting with established cloud providers that maintain recognised security certifications; and
- regular review of our measures as the Service changes.
6.2 You are responsible for the security of your own accounts, API keys and share links, and for choosing which Connected Sources to link.
7. Sub-processors
7.1 You give us general authorisation to engage sub-processors. Our current sub-processors are listed below.
7.2 We will put in place a written contract with each sub-processor that gives Customer Personal Data protection at least equal to this DPA. We remain responsible to you for our sub-processors' performance.
7.3 We will tell you about any new or replacement sub-processor by updating this page and, where it materially affects you, by email, before the change takes effect. If you object on reasonable data protection grounds, please tell us within 14 days. We will work with you in good faith to address the concern. If we cannot, you may cancel the affected part of the Service.
7.4 Current sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Website and app hosting | USA, with EU edge network |
| Supabase Inc. | Database and authentication, hosted on Amazon Web Services | Region chosen by Luciqo; EU/UK or USA |
| Inngest Inc. | Background job scheduling | USA |
| Stripe Payments Europe Ltd / Stripe Inc. | Payments and billing | EU / USA |
| OpenAI | AI answers (ChatGPT) | USA |
| Anthropic PBC | AI answers (Claude) | USA |
| Google LLC | Gemini AI answers; Google Analytics connection; Google sign-in where used | USA |
| Perplexity AI Inc. | AI answers | USA |
| Resend Inc. | Transactional email | USA |
| HubSpot Inc. | Connection to your HubSpot account, only when you connect HubSpot | USA |
7.5 Buyer questions and brand profile content are sent to AI providers through their APIs to produce answers and content. Under their API terms, these providers do not use API data to train their models by default.
8. International transfers
8.1 Some sub-processors process data outside the UK. Where Customer Personal Data is transferred outside the UK, we make sure it is protected by one of the following:
- the UK International Data Transfer Agreement (IDTA);
- the UK Addendum to the EU Standard Contractual Clauses; or
- the UK–US Data Bridge, where the recipient is certified under it.
8.2 Where EU GDPR applies to you, the EU Standard Contractual Clauses apply to relevant transfers outside the European Economic Area.
9. Personal data breaches
9.1 We will tell you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.
9.2 We will give you the information you reasonably need to meet your own reporting obligations, including what happened, the likely consequences and the steps taken, as it becomes available.
9.3 We will take reasonable steps to contain the breach and reduce its effects.
10. Data subject requests
10.1 If we receive a request from a data subject about Customer Personal Data, we will pass it to you and will not respond directly unless you ask us to or the law requires it.
10.2 You can delete a data pull and disconnect any Connected Source at any time from the Service. Disconnecting stops further syncing. We will give you other reasonable help where needed.
11. Audits and information
11.1 On request, we will give you information reasonably needed to show our compliance with Article 28 of UK GDPR, such as written answers to security questionnaires and summaries of our sub-processors' certifications.
11.2 If that information is not enough, or a regulator requires it, you may carry out an audit, at your cost, on reasonable notice, no more than once a year, during normal business hours and subject to confidentiality.
12. Deletion and return
12.1 When your subscription ends, we will delete Customer Personal Data within a reasonable period, unless the law requires us to keep it. Data in backups will be overwritten in the normal course.
12.2 Before your subscription ends, you can export your reports and delete data pulls from within the Service.
13. Liability and general
13.1 Each party's liability under this DPA is subject to the limitations and exclusions in the Terms.
13.2 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
13.3 We may update this DPA to reflect changes in the law, our sub-processors or the Service. We will not reduce the overall level of protection for Customer Personal Data.
13.4 Questions about this DPA should be sent to contact@luciqo.ai.