Data Processing Addendum

Version 1.0 · Effective 26 April 2026

This Data Processing Addendum ("DPA") forms part of the agreement between you ("Customer", the data controller) and Augmt Pty Ltd ("Lantern", "we", "us", the data processor) for use of the Lantern service (the "Service"). It applies whenever Lantern processes Personal Data on Customer's behalf.

By using the Service, Customer accepts this DPA. Where applicable law requires a counter-signed addendum, the Customer may request one at [email protected].

1. Definitions

Applicable Data Protection Laws

The EU General Data Protection Regulation (Regulation 2016/679, "GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act ("CCPA"), the Australian Privacy Act 1988, and any other privacy laws applicable to Customer's use of the Service.

Personal Data

Has the meaning given in the Applicable Data Protection Laws — any information relating to an identified or identifiable natural person.

Data Subject

An individual whose Personal Data is processed by Lantern on Customer's behalf — typically Customer's team members, end-users who report bugs through Customer's site, or visitors whose errors are captured passively.

Sub-processor

Any third party engaged by Lantern that processes Personal Data on Customer's behalf. The current list is at lantern.augmt.xyz/sub-processors.html.

Standard Contractual Clauses ("SCCs")

The standard data protection clauses adopted by the European Commission (Decision 2021/914) for transfers of personal data to third countries.

2. Scope and Roles

For Personal Data processed in connection with the Service:

• Customer is the data Controller — Customer determines the purposes and means of processing (e.g. who has access, what bug reports look like, retention beyond defaults).
• Lantern is the data Processor — Lantern processes Personal Data only on documented instructions from Customer (the instruction is Customer's use of the Service in accordance with the Lantern Terms of Service and configuration).

This DPA does not apply to Personal Data Lantern processes as an independent Controller — for example, Customer's billing contact details, login records of the Customer's own administrators, or aggregated/anonymised analytics. Those are governed by our Privacy Policy.

3. Subject Matter, Duration, Nature, Purpose

4. Lantern's Obligations

Lantern will:

1. Process only on documented instructions from Customer — including transfers outside the EEA, unless required by law (in which case Lantern will inform Customer beforehand unless prohibited).
2. Ensure confidentiality — personnel authorised to access Personal Data are bound by confidentiality obligations.
3. Implement appropriate security measures as set out in Annex 2 below, satisfying GDPR Article 32.
4. Manage Sub-processors per Section 5 below.
5. Assist Customer with Data Subject requests per Section 6.
6. Assist with breach notification per Section 7.
7. Delete or return Personal Data on termination per Section 8.
8. Make available all information necessary to demonstrate compliance with this DPA, and allow audits per Section 9.

5. Sub-processors

Customer authorises Lantern to engage the Sub-processors listed at lantern.augmt.xyz/sub-processors.html ("Sub-processor List") to process Personal Data.

Lantern will:

• Maintain a current list of Sub-processors at the URL above.
• Notify Customer at least 30 days in advance of any new Sub-processor (subscribe at the same URL for change notifications).
• Impose data-protection obligations on each Sub-processor at least as protective as those in this DPA.
• Remain liable to Customer for the Sub-processor's performance.

Customer may object to a new Sub-processor in writing within the 30-day window with reasonable grounds. If we cannot agree on a resolution, Customer may terminate the affected portion of the Service for cause.

6. Data Subject Requests

Lantern will provide reasonable assistance to Customer in responding to Data Subjects exercising their rights under Applicable Data Protection Laws (access, rectification, erasure, restriction, portability, objection). Most requests can be self-served by Customer through the dashboard. For complex requests, Customer may contact [email protected] and Lantern will respond within 10 business days.

If a Data Subject contacts Lantern directly with a request relating to Customer's data, Lantern will forward the request to Customer without acting on it (unless Customer has instructed otherwise).

7. Personal Data Breach

Lantern will notify Customer of a Personal Data breach without undue delay and in any case within 72 hours of becoming aware. Notice will include, to the extent then known: the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, and the measures taken or proposed to address the breach.

Lantern will provide reasonable cooperation and assistance to Customer in investigating, mitigating, and notifying authorities or Data Subjects of the breach as required.

8. Deletion or Return on Termination

On termination of the Service or on Customer's written request:

• Customer may export all Customer Data through the dashboard (or via API where supported) within 30 days of termination.
• After 30 days, Lantern will delete all Customer Personal Data from production systems within a further 30 days (60 days total).
• Backups containing Personal Data are deleted on a rolling 35-day cycle.
• Personal Data Lantern is required to retain by law (e.g. tax or audit records) is excluded from deletion and remains subject to this DPA's confidentiality and security obligations.

9. Audits

Lantern will make available, at Customer's reasonable request and no more than once per 12-month period, the documentation necessary to demonstrate compliance with this DPA — including the most recent SOC 2 / ISO 27001 reports (when available), penetration test summaries, and policies referenced in Annex 2.

Where SOC 2 or equivalent third-party audits do not satisfy Customer's audit requirements, Lantern will, on reasonable notice (at least 30 days), permit Customer (or a mutually-agreed independent auditor bound by confidentiality) to conduct an audit of Lantern's data-protection practices, at Customer's cost, during business hours and in a manner that does not unreasonably interfere with Lantern's operations.

10. International Data Transfers

Where Lantern transfers Personal Data originating in the EEA, UK, or Switzerland to a country not deemed adequate by the European Commission, Lantern relies on the EU Standard Contractual Clauses (Module 2: Controller-to-Processor) and the UK International Data Transfer Addendum, which are incorporated by reference into this DPA.

The current Sub-processor data flows are described at /sub-processors.html.

11. Liability and Term

Each party's liability under this DPA is subject to the limitations set out in the main Lantern Terms of Service. This DPA terminates automatically when the agreement for the Service terminates, except for clauses that by their nature survive (Sections 7, 8, and any indemnities).

12. Conflict

Where there is a conflict between this DPA and the main Terms of Service, this DPA prevails on data-protection matters. Where the SCCs apply and conflict with this DPA, the SCCs prevail.

Annex 1 — Processing Details

See Section 3 above.

Annex 2 — Technical and Organisational Measures (TOMs)

Annex 3 — Sub-processor List

Maintained as a living document at /sub-processors.html. Subscribe at that page for advance notice of changes.

Contact

Questions about this DPA, or to request a counter-signed copy: [email protected].