Data Processing Agreement

Effective date: 6 July 2026 · Last updated: 6 July 2026

This is a standing (template) Data Processing Agreement (“DPA”). It applies where Open Labs, LLC (“Open Labs”) processes personal data on behalf of a business or enterprise customer (“Customer”) — for example, the end-user, HR, CRM, contact, or campaign-audience data a Customer uploads or manages through the platform. “Platform” means every property Open Labs operates, as listed in the Properties Covered by These Terms section of our Terms of Service — including OpenLuxe, OpenVerce, OpenFlix, HoodGuess, and StickerVerce. It is incorporated into and forms part of the Terms of Service. By using the platform to process such data, the Customer agrees to this DPA. Enterprises requiring a negotiated or counter-signed copy may request one at support@openluxe.co.

1. Roles of the parties

For personal data that the Customer determines the purposes and means of processing, the Customer is the “controller” (or “business”) and OpenLuxe is the “processor” (or “service provider”/“contractor”), as those terms are used in the EU/UK GDPR and U.S. state privacy laws including the CCPA/CPRA. For personal information OpenLuxe collects for its own purposes (such as account administration and platform operation), OpenLuxe acts as a controller/business under its Privacy Policy.

2. Definitions

“Personal data,” “processing,” “controller,” “processor,” “data subject,” and “sub-processor” have the meanings given in applicable data-protection law. “Customer Personal Data” means personal data processed by OpenLuxe on the Customer's behalf under the Terms of Service.

3. Processing details

  • Subject matter: OpenLuxe's provision of the platform and related services.
  • Duration: the term of the Terms of Service, plus any period required to return or delete data.
  • Nature and purpose: hosting, storing, transmitting, and otherwise processing Customer Personal Data to provide the features the Customer uses.
  • Categories of data subjects and personal data: as determined and provided by the Customer (e.g., the Customer's contacts, leads, employees, and end users).

4. OpenLuxe's obligations

  • Process Customer Personal Data only on the Customer's documented instructions (including as necessary to provide the platform), unless required by law, in which case OpenLuxe will inform the Customer where permitted;
  • Ensure personnel authorized to process the data are bound by confidentiality;
  • Implement appropriate technical and organizational security measures, consistent with the security practices described in our Privacy Policy (including TLS in transit, AES-256 at rest for sensitive stores, role-based access control, and multi-factor authentication for administrative access);
  • Taking into account the nature of processing, assist the Customer with responding to data-subject requests, and with security, breach-notification, and impact-assessment obligations;
  • Notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data;
  • At the Customer's choice, delete or return Customer Personal Data at the end of the services, except where retention is required by law.

5. Sub-processors

The Customer authorizes OpenLuxe to engage the sub-processors listed at openluxe.co/subprocessors. OpenLuxe imposes data-protection obligations on its sub-processors that are substantially similar to those in this DPA and remains responsible for their performance. OpenLuxe will make the current list available and will provide a mechanism to be notified of changes on request.

6. International transfers

OpenLuxe processes Customer Personal Data primarily in the United States. Where the Customer transfers personal data subject to the EU or UK GDPR to OpenLuxe, the parties agree that the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum are incorporated by reference and apply to such restricted transfers.

7. CCPA / CPRA service-provider terms

With respect to personal information governed by the CCPA/CPRA, OpenLuxe acts as a service provider/contractor and certifies that it will not: (a) sell or share the personal information; (b) retain, use, or disclose it for any purpose other than performing the services specified in the Terms of Service, or as otherwise permitted by the CPRA; or (c) combine it with personal information from other sources except as permitted by the CPRA. OpenLuxe certifies that it understands and will comply with these restrictions.

8. Audits

Upon reasonable written request, and subject to confidentiality, OpenLuxe will make available information reasonably necessary to demonstrate compliance with this DPA, which may include summaries of security measures, certifications, or third-party assessment reports where available.

9. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service.

10. How to execute

Use of the platform to process Customer Personal Data constitutes acceptance of this DPA. If your organization requires a signed copy or negotiated terms, contact support@openluxe.co and we will arrange execution.

Other Legal Documents

Terms of ServicePrivacy PolicyCookie PolicyData PolicyAcceptable UseFair HousingSMS TermsAPI & CLI TermsFilm Fund Backer AgreementFilm Fund Creator AgreementSubprocessorsGLBA Service Provider AddendumAccessibility