Data Processing Agreement
Last Updated: October 4, 20261. Parties, Roles, and Scope
This Data Processing Agreement ("DPA") supplements the Terms of Service between Lantanios Solutions Inc., a Pennsylvania corporation ("Lantanios"), and the person or business that creates a site on the Lantanios platform (the "Customer"). It applies whenever Lantanios processes personal data on the Customer's behalf.
For personal data about the Customer's own visitors, members, and buyers ("Customer Data"), the Customer is the controller and Lantanios is the processor. The Customer decides what to collect and why; Lantanios stores and processes it to run the Customer's site.
For personal data about the Customer themselves as a platform account holder — login details, billing, support history — Lantanios is an independent controller, and the Privacy Policy governs. This DPA does not cover that data.
Where this DPA and the Terms of Service conflict about the processing of Customer Data, this DPA prevails.
2. Details of the Processing
Subject matter. Hosting and operating the Customer's site, storefront, and customer accounts on the Lantanios platform.
Duration. For as long as the Customer has an account, and then for the period in clause 9.
Nature and purpose. Storing, retrieving, transmitting, and displaying Customer Data so that the Customer's site works: account registration and login for the Customer's members, checkout and order records, digital-product delivery, customer support, and the analytics the Customer sees about their own site.
Categories of data subjects. Visitors to the Customer's site; members who register there; buyers who make purchases there.
Categories of personal data. Names, email addresses, and phone numbers provided at registration or checkout; order history and delivery entitlements; messages sent to the Customer through the site; IP addresses and browser identifiers in security and access logs; and any other personal data the Customer chooses to collect through their site. Payment card details are collected and held by Stripe.
Special categories. The platform is not designed for special-category data — health, biometric, political, religious, or similar — and the Customer agrees not to collect it through their site. See also the Health Data Disclaimer in the Terms of Service.
3. Processing on Documented Instructions
Lantanios processes Customer Data only on the Customer's documented instructions. The Customer's instructions are: this DPA, the Terms of Service, and the configuration choices the Customer makes in their site — what to collect, which features to enable, and what to publish.
If the law requires Lantanios to process Customer Data otherwise, Lantanios will tell the Customer before doing so, unless that law prohibits the notice. If Lantanios believes an instruction breaks data protection law, it will say so.
Lantanios does not use Customer Data for its own purposes. In particular, Lantanios does not use the Customer's visitor or buyer data to train AI models, to market to those people, or to build profiles of them for anyone other than the Customer.
4. Confidentiality
Lantanios ensures that every person it authorises to process Customer Data is bound by a duty of confidentiality, whether by contract or by law.
5. Security of Processing
Lantanios implements the technical and organisational measures described in Annex II, and maintains them at a level appropriate to the risk of the processing. Annex II describes what is in place; it is not a promise of what might be added.
6. Sub-Processors
The Customer gives Lantanios general authorisation to engage sub-processors. The current list, with what each does, is published at /sub-processors and forms Annex III of this DPA.
The list may change at any time. The page is updated when it changes, and the Customer is responsible for checking it. A Customer that objects to a sub-processor may stop using the affected service; that is the Customer's only remedy.
Each sub-processor processes data under its own terms. Where the law makes Lantanios responsible for a sub-processor's processing of Customer Data, that responsibility is as the law provides and no wider.
7. Assistance with Data Subject Requests
If a data subject contacts Lantanios directly about Customer Data, Lantanios will refer them to the Customer and will not respond on the Customer's behalf except as instructed.
Lantanios will assist the Customer in responding to requests to access, correct, delete, restrict, or port Customer Data, taking into account the nature of the processing. Specifically:
- Deletion. On the Customer's instruction, sent to [email protected] and identifying the member or buyer account concerned, Lantanios will erase that person's account and associated personal data without undue delay. Erasure removes profile, credential, conversation, and content records, and replaces identifying details in security and acceptance records with a neutral marker. Lantanios records a receipt of each erasure — which collections were touched and when — that contains no personal data.
- Records retained after erasure. Records of orders, charges, subscriptions, and ledger entries are retained as accounting evidence for the period required by tax and accounting law. Once the account record is erased they carry only an internal identifier that no longer resolves to a person. This retention is permitted by GDPR Article 17(3)(b) and the Customer acknowledges it.
- Access and portability. The Customer can see and export their members' and buyers' records through the platform. Where a request needs data the Customer cannot reach themselves, Lantanios will assist on written request.
- Correction and restriction. The Customer can correct most Customer Data through the platform. Where they cannot, Lantanios will assist on written instruction.
8. Personal Data Breaches and Impact Assessments
Lantanios will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information then available to it.
Lantanios will provide reasonable assistance, at the Customer's request, with the Customer's own breach notifications, data protection impact assessments, and any prior consultation with a supervisory authority, to the extent the information is in Lantanios's possession.
9. Deletion or Return at the End of the Service
When the Customer deletes a site, the platform deletes that site's member and buyer accounts and their associated personal data. Before deleting a site the Customer can export their product catalogue and download their records through the platform.
When the Customer closes their Lantanios account, all sites must be deleted first; the account cannot be erased while it still owns sites, because doing so would destroy live storefronts and their buyers' records. Once the sites are gone, the Customer's own account is erased under the Privacy Policy.
Records retained as accounting evidence are kept as described in clause 7.
10. Information and Audit
Lantanios will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA. This DPA, the Privacy Policy, the Sub-Processors page, and Annex II are the first of that information.
Where that is not sufficient, the Customer may audit Lantanios's compliance once in any twelve-month period, on at least 30 days' written notice, during business hours, by a mutually agreed auditor bound by confidentiality, at the Customer's cost, and without disrupting the service or exposing other customers' data. Lantanios will allow for and contribute to the audit.
11. International Transfers
Lantanios is established in the United States and processes Customer Data there. Where Customer Data about people in the European Economic Area, the United Kingdom, or Switzerland is transferred to a country without an adequacy decision, the transfer is governed by the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 (Module Two, controller to processor), which are incorporated into this DPA by reference, together with the UK International Data Transfer Addendum where UK data is concerned.
For the purpose of those clauses: the Customer is the data exporter; Lantanios is the data importer; Annex I of this DPA is Annex I of the clauses; Annex II of this DPA is Annex II of the clauses; the optional docking clause does not apply; the governing law and forum are those of Ireland unless the Customer is established in another EU member state, in which case that state's.
12. Liability and Term
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except to the extent those cannot be limited under applicable data protection law. This DPA lasts as long as Lantanios processes Customer Data and ends when clause 9 has been performed.
Lantanios may update this DPA at any time. Changes take effect on publication. A Customer that does not accept a change may stop using the Platform.
Annex I — Description of the Processing
Data exporter. The Customer, in their capacity as controller of Customer Data.
Data importer. Lantanios Solutions Inc., 4543 Old Oak Rd, Doylestown, PA 18902, United States. Contact: [email protected].
Processing. As described in clause 2. Frequency: continuous, for the life of the Customer's site. Retention: for the life of the site, then as described in clauses 7 and 9.
Competent supervisory authority. The authority of the EU member state in which the Customer is established, or, if the Customer is not established in the EU, the Irish Data Protection Commission.
Annex II — Technical and Organisational Measures
These are the measures in place at the date of this annex. They may change, and this annex is updated when they change materially.
- Tenant isolation. Stored records that belong to a site carry that site's identifier, and reads and writes are scoped by it.
- Authentication. Passwords are stored as PBKDF2 hashes. Multi-factor authentication is available by authenticator app, passkey, email, and SMS, and the Customer can require it for their site's members. Repeated failed logins trigger progressive lockout.
- Authorisation. Access is checked on the server by role — platform administrator, site builder, site member — and by site scope.
- Transport and browser security. The platform is served over TLS. Responses carry security headers and a Content Security Policy, and state-changing requests carry cross-site request forgery protection.
- Secrets. Credentials and keys are held in a managed secret store.
- Payment data. Card details are entered into and held by Stripe. Lantanios stores Stripe identifiers.
- File storage. Uploaded files are held in object storage. Uploads land in a private staging area and are promoted to their public or private location after verification. Private files are served through access-controlled delivery.
- Audit logging. Authentication and security events are logged with event type, severity, account, site, source address, and time, and retained for security investigation.
- Erasure. A registry declares, for every collection that names a person, whether erasure deletes it, anonymises it, or retains it as accounting evidence. A test checks that every such collection has a declared disposition. Each erasure is recorded in a receipt that contains no personal data.
- Legal acceptance evidence. Acceptance of the platform's terms is recorded with the revision accepted and the time, so the terms in force for any account can be established.
- Vulnerability disclosure. A published disclosure policy and an RFC 9116 security.txt give researchers a route to report problems.
What is not claimed. Lantanios does not currently hold a SOC 2 report or ISO 27001 certification, has not commissioned an independent penetration test, and does not offer a customer- selectable data residency region. Customers whose obligations require any of those should not rely on this DPA to satisfy them.
Annex III — Sub-Processors
The current list of sub-processors and what each does is at /sub-processors and is incorporated here by reference. This annex does not repeat it so that the two cannot disagree.