Data Processing Addendum

Effective Date: November 3, 2026

This Data Processing Addendum (“DPA”) forms part of the Loomis Terms of Service between O2mation LLC (“Processor”, “we”) and the Customer who holds a Loomis account (“Controller”, “you”). It applies when we process personal data of your End-Users on your behalf, and is designed to meet Article 28 of the EU and UK GDPR and similar laws (such as the California Consumer Privacy Act). If this DPA conflicts with the Terms, this DPA wins for personal data.

1. Roles and Scope

  • Controller: you decide why and how your End-Users’ personal data is processed through your bots.
  • Processor: O2mation LLC processes that data only to provide Loomis to you.
  • Subject matter and duration: providing the Services, for as long as your account is open plus the deletion period in Section 8.
  • Nature and purpose: receiving, storing, analyzing and replying to messages and comments with AI, extracting leads, handing conversations to your staff, and showing analytics.
  • Data subjects: people who message, chat with or comment to your bots and pages.
  • Types of data: platform identifiers, names provided by Meta, message and comment content, voice messages (processed but not stored), contact details shared in chats, and timestamps. You must not use Loomis to collect special categories of data (such as health data) unless you have a lawful basis and appropriate safeguards.

2. Your Instructions

We process personal data only on your documented instructions, which are the Terms, this DPA and the settings you choose in Loomis, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it). We will tell you if we believe an instruction breaks data protection law.

3. Your Responsibilities

You are responsible for having a lawful basis to process your End-Users’ data, for giving them a privacy notice that covers Loomis, for telling them they are talking to an AI, and for the content of your knowledge base and bot instructions.

4. Confidentiality

Anyone we authorize to process personal data is bound by confidentiality.

5. Security

We maintain appropriate technical and organizational measures, including encryption in transit (HTTPS), encryption of channel access tokens at rest, database rules that isolate each Customer’s data, access limited to people who need it, and logging and rate limiting to detect errors and abuse.

6. Sub-processors

You authorize us to use the sub-processors listed in our Privacy Policy (currently Google LLC for AI models, Supabase Inc. for database and authentication, Stripe Inc. for payments, and our server hosting provider). Messaging platforms you choose to connect, such as Meta (Facebook, Instagram) and Telegram, act under their own terms and are not our sub-processors. We bind each sub-processor to data protection terms that are no less protective than this DPA, and we remain responsible for them. We will update the list before adding or replacing a sub-processor (for example, a different AI model provider). If you object on reasonable data protection grounds within 15 days, we will work with you to find a solution; if we cannot, you may close your account and receive a refund of prepaid fees for the remaining period.

7. Helping You

  • End-User requests: we will help you respond to requests to access, correct, delete or export personal data. If an End-User contacts us directly, we will forward the request to you or, where you cannot be reached or for Meta data deletion requests, handle it as described on our Data Deletion page.
  • Breaches: we will notify you without undue delay, and where possible within 72 hours, after we become aware of a personal data breach affecting your data, with the information you need to meet your own duties.
  • Assessments: we will give reasonable help with data protection impact assessments and consultations with authorities, where they concern our processing.

8. Deletion or Return of Data

When your account closes, you can ask us to export your data first. We then delete your End-Users’ personal data within 30 days, unless the law requires us to keep it.

9. Audits

We will make available the information reasonably needed to show that we meet this DPA, such as written answers to security questionnaires. If that is not enough, or a regulator requires it, you may carry out an audit at your own cost, with at least 30 days’ notice, once per year, during business hours, and under confidentiality.

10. International Transfers

We are a United States company. Our database is stored in the European Union (Frankfurt, Germany); some sub-processors, such as Google and Stripe, may process data in the United States or other countries. For transfers of personal data from the EU or EEA, the parties agree to the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 (Module 2, controller to processor), which are incorporated by reference. For the UK, the UK International Data Transfer Addendum applies, and for Switzerland, the Clauses apply with the necessary changes. Where a sub-processor is certified under the EU-US Data Privacy Framework, we may rely on that certification instead.

11. California

For personal information covered by the California Consumer Privacy Act, we act as your service provider. We will not sell or share it, or use it for any purpose other than providing the Services, and we will not combine it with personal information from other sources except as the law allows.

12. Liability and Governing Law

The limitation of liability in the Terms applies to this DPA, except where the law or the Standard Contractual Clauses do not allow it. This DPA is governed by the laws of the State of Wyoming, USA, except where the Standard Contractual Clauses require another law.

13. Contact

O2mation LLC (Loomis): legal@loomis.bot.