Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the SaaS Master Terms (“Agreement”) between:

ILUMINA AI OÜ, an Estonian private limited company (OÜ), registration number 17272671, registered office at Ahtri tn 12
, Kesklinna linnaosa, Tallinn, Estonia (“Processor”)

and

The legal entity subscribing to the ILUMINA Platform, as identified in the applicable Order Form (“Customer” or “Controller”).

This DPA is entered into pursuant to Article 28 of Regulation (EU) 2016/679 (“GDPR”).

1. Subject Matter and Duration

Processor shall process personal data on behalf of Controller in connection with the provision of the ILUMINA Platform.

Processing shall continue for the duration of the Agreement unless otherwise agreed in writing.

2. Nature and Purpose of Processing

Processor provides the ILUMINA Platform enabling structured intake, evaluation, and AI-assisted scoring of startup submissions.

Processing includes:

Collection of startup submission data
Storage of pitch decks and structured application information
Automated analysis, summarization, and scoring
Dashboard access for evaluation purposes
De-identified platform improvement and benchmarking

The purpose of processing is to enable Controller to evaluate startups for:

Potential investment or funding decisions (Investor Function)
Participation in programs, accelerators, events, or innovation initiatives (Program Partner Function)

3. Categories of Data Subjects

Processing may involve personal data relating to:

Startup founders
Startup team members
Advisors or representatives listed in submissions
Customer personnel accessing the Platform

4. Categories of Personal Data

Personal data may include:

Names
Business email addresses
Professional titles and roles
Background or biographical information
Personal data contained in pitch decks or attachments
Login credentials
Communication metadata
Technical usage data (IP address, device logs)

Startup Submissions may also include business and commercially sensitive information, including:

Financial performance data (revenue, burn rate, runway, projections)
Fundraising history
Marketing and growth metrics
Customer and pipeline information
Strategic plans, market positioning, and competitive insights

To the extent such information relates to an identifiable individual, it shall be treated as personal data under GDPR.

Processor does not intentionally collect special categories of data under Article 9 GDPR.

5. Controller Obligations

Controller warrants that:

It has a lawful basis for processing personal data
It has provided required privacy notices to data subjects
It will comply with GDPR and applicable data protection laws
It will not instruct Processor to process unlawful or excessive data

6. Processor Obligations

Processor shall:

Process personal data only on documented instructions from Controller
Ensure authorized personnel are bound by confidentiality
Implement appropriate technical and organizational security measures
Assist Controller with data subject rights requests
Assist Controller in complying with breach and impact assessment obligations
Delete or return personal data upon termination unless legally required to retain it

7. Subprocessors

Controller authorizes Processor to engage subprocessors including:

OpenAI (AI processing support)
Hosting infrastructure providers (located in Germany)
Email and operational service providers

Processor shall ensure subprocessors are bound by equivalent data protection obligations.

Processor will provide notice of material changes to subprocessors. Controller may object on reasonable data protection grounds.

8. International Transfers

Where personal data is transferred outside the European Economic Area (EEA), Processor shall implement appropriate safeguards, including Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.

9. Security Measures

Processor implements appropriate technical and organizational measures, including:

Role-based access controls
Multi-factor authentication for administrative access
Encryption in transit (TLS/HTTPS)
Secure hosting infrastructure in Germany
Monitoring and logging of system access
Backup and disaster recovery procedures
Documented incident response plan

10. Personal Data Breach Notification

Processor shall notify Controller without undue delay after becoming aware of a personal data breach affecting Controller personal data and cooperate with Controller in regulatory reporting obligations.

11. Audit and Compliance Information

Controller may request reasonable information demonstrating Processor’s compliance with this DPA. Any audit shall be reasonable, proportionate, and subject to confidentiality obligations.

12. Deletion or Return of Data

Upon termination of the Agreement, Processor shall delete or return personal data within ninety (90) days unless legal obligations require retention.

13. Business Confidentiality

Customer acknowledges that Startup Submissions may contain highly confidential commercial, financial, marketing, customer, and strategic information. Customer agrees to treat such information as confidential and to use it solely for evaluation purposes.

14. Governing Law

This DPA is governed by the laws of Estonia.

Any disputes shall be subject to the exclusive jurisdiction of the courts of Estonia.