DPA

LW DPA 20261108 DRAFT 04

Prepared 8 November 2026 · Version LW DPA 20261108 DRAFT 04 · Effective date not set

This Data Processing Agreement, or DPA, governs processing by 주식회사 스카이폴 on a customer’s instructions when providing Luxwarp. It covers the actual entrusted scope across iOS, Android, macOS, Windows, Linux and related server functions.

Contract review draft. Before execution by authorised parties, the annexes must identify the parties, processing, subprocessors, transfers, retention and deletion deadlines, and safeguards, and the required measures must be deliverable. Installation or a checkbox shown to every user does not execute this incomplete draft.

Section 1 Parties and scope

The Company is 주식회사 스카이폴, represented by 이상화 (Sang-hwa Lee), business registration number 480-86-02585. Its address is Suite 1422, 14F, DMC Star Palace, 34 Kkotmaeul-ro, Deogyang-gu, Goyang-si, Gyeonggi-do, Republic of Korea. Contact inquiry@luxwarp.com or +82-70-8095-1561. The customer’s legal name, address and authorised contact are entered in Annex 1. The Company’s Privacy Officer is 이상화 (Sang-hwa Lee), Representative; privacy and contract enquiries go to inquiry@luxwarp.com, +82-70-8095-1561.

Where the customer determines processing purposes and the Company processes on its behalf, the customer is the controller or entrusting party and the Company is the processor. Where the customer is a processor for another controller, the Company may act as a subprocessor only with the necessary authority and upstream authorisation. Role descriptions are interpreted under applicable law.

The actual relationship determines whether personal or household activity, organisational use or a particular law is involved. Selecting Personal or Team neither includes nor excludes all data automatically. Independent Company purposes, such as its own account operation, security and direct enquiry handling, are governed by the Privacy Policy and distinguished from entrusted data.

Section 2 Main agreement and processing

This DPA supplements the Luxwarp EULA and applicable order or service agreement. It prevails for conflicting protection terms within entrusted processing. Applicable law and separately validly executed mandatory transfer clauses prevail where they require stronger protection.

Subject matter, purpose, nature, duration, individuals, data and selected features are limited to Annex 1. The Company must not use or disclose entrusted data outside that purpose, or use it for advertising, sale or unrelated AI training. It acquires no ownership or general exploitation right in customer materials or personal data.

The scope does not assume that Company servers collect or record direct-session screen or audio content. The annex must distinguish actual routes, including endpoint processing, signalling, customer administration and separately enabled encrypted relay.

Section 3 Documented instructions

The Company processes only on documented instructions in the executed agreement and annexes, verifiable requests from authorised customer contacts, and customer-selected service settings. Instructions include transfers, but an instruction alone does not satisfy legal transfer requirements.

If law requires processing outside those instructions, the Company informs the customer before processing unless legally prohibited. If an instruction appears to infringe data-protection law, the Company informs the customer without delay and seeks clarification or correction. It suspends only the affected processing to the extent needed to resolve the issue and does not arbitrarily stop unrelated services. Instructions, authority and changes are recorded to the extent necessary for evidence.

Section 4 Customer responsibilities

The customer determines purposes and lawful grounds, supplies required notices and consents, and obtains authority to permit remote access and supply materials. If acting for another controller, it obtains authority to instruct the Company and engage a subprocessor.

The customer limits data and permissions to what is necessary and manages accuracy. Before processing sensitive data or material needing special protection, it agrees the scope and additional safeguards in the annexes. This section does not transfer the Company’s independent legal duties or responsibility for its own fault to the customer.

Section 5 Confidentiality and access

The Company restricts access to personnel who need it for their work and grants and revokes appropriate permissions. They must be subject to contractual or statutory confidentiality obligations and receive necessary privacy training and instructions.

Unauthorised viewing, copying and disclosure for other purposes are prohibited. Remote support access remains within the customer’s authorisation. The Company protects other customers’ information in shared environments. Confidentiality continues after personnel duties or the agreement end for as long as the information requires protection.

Section 6 Security measures

The Company implements and maintains technical and organisational measures appropriate to risk, the data, the state of technology and implementation circumstances. These include suitable access control, transport and storage protection, authentication and permissions, records and incident response, availability and recovery, and retention and deletion controls. Annex 2 specifies scope and responsibilities.

Annex 2 requirements are not a statement that every measure is already implemented and verified. Before execution, required measures must be implemented and verified, with agreed scope limitations or alternatives for incomplete items. The Company must not unilaterally make changes that materially reduce protection and must notify the customer and obtain agreement where required for significant changes.

Section 7 Subprocessing

The Company uses only subprocessors and processing scopes authorised by the customer in writing in advance. Annex 3 identifies the actual entity, role, data, countries, safeguards and approval method. Where general written authorisation is used, additions or replacements are notified in advance with a reasonable opportunity to assess and object, and any approval required by applicable law must be obtained. Incomplete inventory rows are not blanket approval of unspecified or future providers.

On an objection, the parties consider alternatives or adjustment or termination of the affected feature and related contractual settlement. The disputed subprocessing does not begin without authorisation. The Company imposes equivalent relevant protection obligations on subprocessors in writing, supervises them and remains responsible for performance of its own obligations.

Section 8 Locations and international transfers

The Company uses the locations and lawful routes completed in Annex 3. Countries, recipient entities, access routes, data, purposes, duration and safeguards must be identified, with required notice and approval of changes. Headquarters and labels such as APAC do not substitute for all actual storage and support-access countries.

Each party meets the transfer requirements applicable to its role under Korean law, Japanese law, the GDPR or other applicable law. Where needed, separate consent and notices, adequacy arrangements, appropriate standard contractual clauses or supplementary safeguards must be arranged. This DPA is not itself the EU Standard Contractual Clauses or a UK transfer addendum. A transfer relying on a particular mechanism must not begin before its applicability and validity are established.

Section 9 Individual requests and regulatory assistance

The Company notifies and forwards to the customer, without delay, requests concerning entrusted data. Unless instructed or legally required, it does not decide the substantive acceptance or refusal on the customer’s behalf. Considering the processing and information available, it assists with locating data, access, correction, deletion, restriction and other applicable rights.

The Company reasonably assists with risk assessments, impact assessments, supervisory consultation and investigations, customer supervision and supporting evidence where required. Reasonable costs of additional work may be agreed in advance, but cost discussions must not delay statutory duties or urgent protection of rights. The Company directly handles requests for processing for which it is an independent controller.

Section 10 Personal data incidents

After becoming aware of loss, disclosure, unauthorised access or another personal data incident affecting entrusted data, the Company notifies the customer’s designated contact without undue delay and meets applicable legal notification and response deadlines. Initial notice must not wait for every detail to be confirmed.

As available, the notice describes the nature and timing, affected categories and approximate scale of data and individuals, likely effects, measures taken or planned, and a contact. Further information is supplied in stages. The Company cooperates in investigation, containment, evidence preservation and remediation. Notification does not itself admit liability or imply that investigation is complete.

The customer assesses notices to regulators and individuals under its role, without removing the Company’s independent legal duties. Incident contacts and escalation arrangements are specified in Annexes 1 and 2. This draft does not invent a 24-hour or 72-hour processor notification guarantee.

Section 11 Evidence and audits

The Company makes available information necessary to demonstrate compliance with this DPA and applicable law, and cooperates with reasonable checks and audits by the customer or an independent auditor bound to confidentiality. Documentary review may be used first, but necessary inspections and statutory investigation powers are not categorically excluded.

For routine audits, scope, timing and method are agreed in advance to protect security and others’ confidentiality and reduce disruption. Incidents, serious suspected breaches and regulatory requirements receive necessary urgent cooperation. The Company does not claim certifications or verified reports it does not hold, or use reasonable security restrictions to refuse compliance evidence altogether.

Section 12 Return and deletion

At the end of entrusted processing, the Company returns data in a reasonably usable format or deletes it, at the customer’s choice, and deletes copies unless law requires retention. Before execution, Annex 1 must specify return method and period, operational deletion deadlines, maximum residual backup periods and confirmation methods.

The Company explains the ground and period of required legal retention and restricts access and use. Residual backups are deleted by the agreed deadline, and approved deletions are reapplied on restoration before use in the service. Expiring a token, revoking a device or logging out is not confirmation of complete erasure.

Confirmation distinguishes actual coverage, completion, exceptions and residual data. Incomplete tooling or storage cleanup cannot support a complete-erasure guarantee or indefinite retention. Independent controller records retained on a separate lawful ground are distinguished from entrusted data and governed by the Privacy Policy and applicable law. For the Company’s own account data, the draft retention principle is to keep necessary data while the account is maintained and erase without undue delay on closure or fulfilment of the processing purpose, except data subject to statutory retention. This does not replace the customer’s return or deletion instructions for entrusted data or the deadlines to be specified in Annex 1.

Section 13 Duration and liability

This DPA applies from execution by authorised parties with completed annexes, or an agreed effective date, until entrusted processing and required return and deletion are completed. Obligations that need to survive, including confidentiality, continue.

Liability and remedies follow the main agreement and applicable law. This DPA does not introduce unlawful exclusions, exclude liability for intentional wrongdoing or gross negligence, restrict statutory compensation or individual rights, or displace regulators’ powers. It introduces neither an arbitrary new damages cap nor unlimited customer indemnity without separate agreement.

Section 14 Changes and contract records

Material changes to entrusted purposes, data, subprocessors, transfers and safeguards require notice and written agreement as applicable before the actual change. Updating a webpage alone does not reduce protection in an executed DPA or add a new purpose.

Korean, English and Japanese versions maintain the same scope of provisions and annexes. The parties record the executed language, version, date and authorised acceptance. Translation differences are resolved consistently with the contract’s purpose and applicable law without reducing statutory rights. Governing law and jurisdiction follow the main agreement subject to mandatory law and individuals’ rights to remedies.

Annex 1 Processing particulars and execution

The following fields must be completed with actual information before execution.

Authorised representatives accept the same completed agreement including Annexes 2 and 3 in writing or through verifiable electronic acceptance. An installer is not presumed to have authority to bind an entire organisation.

Annex 2 Security schedule

This table distinguishes contractual requirements from the current verification scope. Implementation status, owners and evidence must be completed before execution. A source-code control alone does not establish deployment throughout production.

Read-only checks on 8 November 2026 confirmed a recent successful support cleanup, zero recorded failures and zero pending expired candidates. Support rules include a 5-minute cleanup cycle and expiry of presence after 90 seconds, default negotiation messages after 10 minutes, connection summaries after 7 days and paid relay audit records after 30 days. Exceptions for valid active permissions and backups are separate. The retention principle for the Company’s own account data is adopted for this draft under Section 12 and the Privacy Policy, but implementation and verification of complete account, email and backup erasure procedures and completion deadlines remain outstanding. This check also does not establish maximum retention for ordinary email or other separate records. The Company contact for incident and rights coordination is 이상화 (Sang-hwa Lee), Representative, through the existing enquiry channel; any dedicated emergency escalation is agreed for the contract.

This schedule does not assert ISO or SOC certification, encryption of all data, or an already achieved recovery-time target. Processing must not begin for a scope whose required protection cannot be met.

Annex 3 Subprocessors and transfers

This is an inventory for completing the scope, not authorisation of every provider with incomplete fields.

Google’s own login is not automatically subprocessing. Optional support products and providers not yet active require assessment and approval before use. Providers for the Company’s own controller enquiries and accounts are not assumed to be identical to subprocessors for entrusted data.

Appendix First launch design and references

On first launch across all five platforms, display one privacy item, “I have read the Privacy Policy,” with collection, use and transfer information together under View. This is not blanket collection or transfer consent; obtain any actually required separate consents at the relevant feature or registration step. EULA acceptance and optional marketing remain distinct. An authorised representative executes a completed DPA for actual entrusted processing; every installer does not automatically accept it. App code and installers are unchanged.

Official reference points are the TeamViewer DPA role structure, Article 26 of Korean privacy law, GDPR Articles 28, 32 and 33, and Japanese PPC foreign transfer guidance. TeamViewer’s providers, certifications, governing law and retention exceptions are not copied as Luxwarp facts or terms.