Data processing agreement.

This Data Processing Agreement ("DPA") supplements and is incorporated into LITA's Terms of Service. It governs LITA's processing of Personal Data in connection with Session Services and the Coaching Platform. Effective May 22, 2026. Data contact: staff@lostintheastral.com.

Recitals

This Data Processing Agreement ("DPA") supplements and is incorporated into LITA's Terms of Service. It governs LITA's processing of Personal Data (as defined below) in connection with the delivery of Session Services and the Coaching Platform described in the Terms of Service.

LITA operates in a dual capacity:

• As a Data Controller: LITA determines the purposes and means of processing Client personal data collected to operate and improve its services.
• As a Data Processor: Where a Business Path client retains LITA to analyze organizational data that contains employee or customer personal data, LITA processes that data on behalf of the client, who acts as the Data Controller with respect to that data.

This DPA addresses both capacities and applies to Clients in all jurisdictions. Clients located in the European Economic Area ("EEA"), the United Kingdom, or other jurisdictions with applicable data protection laws receive the additional protections set forth in the Annexes.

Article 1: Definitions

"Applicable Data Protection Law" means, as applicable to a particular Client engagement, the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, the California Consumer Privacy Act ("CCPA") as amended by the CPRA, the Nevada Privacy of Information Collected on the Internet from Consumers Act ("NPICICA"), and any successor or replacement legislation.

"Data Controller" means the entity that determines the purposes and means of the processing of Personal Data.

"Data Processor" means the entity that processes Personal Data on behalf of the Data Controller.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

"Personal Data" means any information relating to an identified or identifiable natural person.

"Processing" means any operation or set of operations performed on Personal Data, whether by automated means, including collection, storage, use, disclosure, or deletion.

"Sensitive Personal Data" means Personal Data revealing racial or ethnic origin; religious or philosophical beliefs; health data; sexual orientation; genetic or biometric data processed for identification; or data relating to criminal convictions or offenses.

"Sub-Processor" means any third party engaged by LITA to process Personal Data in connection with LITA's services.

"Aggregate Data" means data derived from Personal Data that has been anonymized and aggregated in a manner such that no individual Data Subject can reasonably be identified or re-identified from it, even in combination with other available information.

"Breach" means a confirmed accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed by LITA.

"SCCs" means the Standard Contractual Clauses for the transfer of personal data to third countries adopted by the European Commission under GDPR, as currently in effect or as replaced by updated versions.

"UK IDTA" means the International Data Transfer Agreement issued by the UK Information Commissioner's Office for transfers of personal data from the UK to third countries, as currently in effect or as replaced.

Article 2: Scope and purpose of processing

2.1 Categories of Personal Data Processed by LITA as Controller

In operating its services, LITA collects and processes the following categories of Personal Data:

2.2 Sensitive Personal Data Handling

Health and wellness data and spiritual and philosophical data collected by LITA constitute Sensitive Personal Data under GDPR Article 9 and equivalent provisions of Applicable Data Protection Law. LITA:

(a) Collects Sensitive Personal Data only with Client's explicit, freely given, specific, and informed consent in accordance with GDPR Article 9(2)(a).

(b) Processes Sensitive Personal Data solely to deliver the specific service for which it was provided.

(c) Does not share Sensitive Personal Data with Sub-Processors except to the extent strictly necessary for service delivery (e.g., secure database hosting).

(d) Retains Sensitive Personal Data in accordance with the retention schedule in Article 4, subject to applicable law.

(e) Applies enhanced access controls and encryption to Sensitive Personal Data beyond those applied to ordinary Personal Data.

2.3 Business-Path Client Data (LITA as Processor)

Where a Business Path client shares organizational data with LITA that contains employee or customer Personal Data, the client acts as Data Controller. LITA will:

(a) Process such data only on the client's documented instructions.

(b) Not process it for any purpose beyond the scope of the consulting engagement.

(c) Return or destroy it at the conclusion of the engagement (see Article 6C).

(d) Ensure that LITA personnel authorized to process such data are subject to confidentiality obligations (see Article 6E).

Article 3: Legal basis for processing

LITA processes Personal Data under one or more of the following legal bases:

(a) Contract. Processing necessary to perform LITA's contractual obligations to the Client under the Terms of Service (GDPR Article 6(1)(b)).

(b) Legitimate Interests. Processing necessary for LITA's legitimate interests in operating, securing, and improving its services, where such interests are not overridden by the Client's fundamental rights (GDPR Article 6(1)(f)). LITA's legitimate interests include: platform security and fraud prevention; service quality improvement using Aggregate Data; legal defense.

(c) Consent. Where required by Applicable Data Protection Law (e.g., newsletter subscription, non-essential cookies, processing of Sensitive Personal Data), LITA will obtain Client's explicit, freely given, specific, and informed consent before processing (GDPR Articles 6(1)(a) and 9(2)(a)). Consent may be withdrawn at any time without penalty, subject to the lawfulness of processing prior to withdrawal.

(d) Legal Obligation. Processing required by applicable law, including retention of financial records under tax law, compliance with lawful government orders, and health records retention under NRS Chapter 629 (GDPR Article 6(1)(c)).

Article 4: Data retention

LITA will delete or de-identify Personal Data upon expiration of the applicable retention period, subject to any legal hold requirement. LITA will maintain a deletion log for audit purposes for a period of two years following any deletion event.

Article 5: Data subject rights

Clients and Data Subjects have the following rights with respect to their Personal Data, exercisable by emailing staff@lostintheastral.com with subject line "Privacy Request":

LITA will verify the identity of requestors before acting on rights requests. LITA will not discriminate against Clients who exercise their privacy rights. LITA will communicate any extension of response timelines within the initial 30-day window.

Article 6: Security measures

LITA maintains the following technical and organizational measures ("TOMs") to protect Personal Data against unauthorized access, disclosure, alteration, or destruction:

(a) Encryption. Personal Data is encrypted at rest using AES-256 or equivalent and in transit using TLS 1.2 or higher. Sensitive Personal Data uses the same or stronger encryption with additional key management controls.

(b) Access Controls. Access to Personal Data is restricted to LITA personnel and contractors who require access to deliver services. Access is governed by role-based permissions and least-privilege principles and reviewed at least annually or upon role change.

(c) Database Security. Platform data is hosted in Supabase, which maintains SOC 2 Type II certification. Row-level security policies restrict data access at the database layer. Database credentials are rotated on a defined schedule.

(d) Vendor Security Assessment. LITA evaluates the security posture of Sub-Processors before engagement and requires data processing agreements or equivalent data protection commitments.

(e) Incident Response. Breach notification procedures are set forth in Article 6A below.

Article 6A: Breach notification

6A.1 Internal Detection and Assessment

Upon discovering a potential Breach, LITA will: (a) contain the Breach and preserve evidence; (b) assess the nature, scope, and likely consequences of the Breach; and (c) determine whether notification obligations under Applicable Data Protection Law are triggered.

6A.2 Regulatory Notification (GDPR Article 33)

Where LITA determines that a Breach is subject to GDPR Article 33 notification obligations, LITA will notify the relevant supervisory authority within 72 hours of becoming aware of the Breach, where feasible. Notifications will include, to the extent available at the time of notification:

(a) The nature of the Breach, including where possible the categories and approximate number of Data Subjects affected and the categories and approximate number of Personal Data records affected.

(b) The name and contact details of the data protection contact (staff@lostintheastral.com).

(c) The likely consequences of the Breach.

(d) The measures taken or proposed to address the Breach, including measures to mitigate its possible adverse effects.

Where full information is not available within 72 hours, LITA will provide information in phases, notifying the supervisory authority of the reason for the delay and providing supplementary information as it becomes available.

6A.3 Client Notification (GDPR Article 34)

Where a Breach is likely to result in a high risk to the rights and freedoms of affected Data Subjects, LITA will notify affected Clients without undue delay, in plain language, describing: (a) the nature of the Breach; (b) the categories of Personal Data affected; (c) likely consequences; (d) measures LITA has taken or proposes to take; and (e) the contact point for further information.

6A.4 Breach Register

LITA will maintain an internal breach register documenting all Breaches, including those that do not require supervisory authority notification, with sufficient detail to demonstrate compliance with GDPR Article 33(5). The register will be retained for a minimum of five years.

6A.5 Business-Path Processor Context

Where LITA is acting as a Data Processor for a Business-Path client, LITA will notify the client (as Data Controller) of any Breach affecting the client's data without undue delay and in sufficient time for the client to meet its own notification obligations.

Article 6B: Audit rights

6B.1 Client Audit Rights

Upon written request with thirty (30) days' prior notice, LITA will make available to requesting Clients (or their designated independent auditors under appropriate confidentiality obligations) information reasonably necessary to demonstrate LITA's compliance with this DPA and Applicable Data Protection Law, including: (a) written responses to security questionnaires; (b) copies of relevant third-party certifications or audit reports (e.g., Supabase SOC 2 report); and (c) records of data processing activities relevant to the Client's data.

6B.2 On-Site Audit

On-site audits of LITA's facilities and systems relating to Personal Data processing are available to Business-Path clients with Data Controller status and to EEA/UK Clients where required by GDPR Article 28(3)(h). Requests for on-site audits must be submitted in writing with sixty (60) days' notice. Audits must be conducted during normal business hours, must not unreasonably disrupt LITA's operations, and are limited to matters within the scope of this DPA. LITA may require the auditor to sign a confidentiality agreement before access is granted. Audit costs are borne by the requesting Client unless the audit reveals material non-compliance, in which case costs are borne by LITA.

6B.3 Regulatory Audit

LITA will cooperate with any audit or inspection conducted by a supervisory authority with jurisdiction over LITA's processing of Personal Data.

Article 6C: Deletion and return of data on termination

6C.1 Client-Initiated Termination

Upon termination of a Client's account or written request, LITA will, at Client's choice: (a) return to Client a copy of Client's Personal Data in a structured, commonly used, machine-readable format within thirty (30) days; or (b) permanently delete Client's Personal Data within thirty (30) days, subject to the retention obligations in Article 4.

6C.2 Scope of Deletion

Deletion under Section 6C.1 will apply to: (a) session notes and practice records; (b) journal entries; (c) Platform Generation outputs; and (d) other Client-specific User Data. Deletion does not apply to: (i) data retained under a legal hold; (ii) data required by applicable law (e.g., financial transaction records under NRS and federal tax law; health records under NRS Chapter 629); (iii) Aggregate Data from which the Client cannot be re-identified.

6C.3 Business-Path Data

Where LITA is acting as Data Processor for a Business-Path client, LITA will return or destroy all Personal Data provided by the client within thirty (30) days of the conclusion of the consulting engagement, and will certify in writing to the client that destruction is complete, unless applicable law requires retention.

6C.4 Sub-Processor Deletion

LITA will use commercially reasonable efforts to ensure that Sub-Processors delete data in accordance with their applicable data processing agreements upon receipt of a verified deletion request from LITA.

6C.5 Certification of Deletion

Upon written request, LITA will provide Client with written certification that deletion under Sections 6C.1 or 6C.3 has been completed, within the applicable period.

Article 6D: Liability allocation for data claims

6D.1 Controller-to-Controller

Where both a Client (as Business-Path Data Controller) and LITA are independently responsible for an aspect of data processing, each party is liable to Data Subjects for the damage caused by its own non-compliant processing. Each party may be held liable for the damage caused by the other party only if it could not be exempted from liability by demonstrating that it bears no responsibility for the event causing the damage.

6D.2 Controller-to-Processor (LITA as Processor)

Where LITA is acting as Data Processor for a Business-Path client, LITA's liability to Data Subjects is governed by GDPR Article 82. LITA will be exempt from liability to the extent LITA can prove it was not at fault for the event giving rise to the damage. As between LITA and the client, LITA's liability for data processing failures under this DPA shall not exceed the greater of: (a) the total fees paid by the client to LITA in the twelve months preceding the claim; or (b) five thousand U.S. dollars ($5,000).

6D.3 Exclusions

The limitation in Section 6D.2 does not apply to: (a) liability arising from LITA's gross negligence or willful misconduct; (b) LITA's liability to supervisory authorities under GDPR Article 83; or (c) liability that cannot be limited under applicable law.

Article 6E: Confidentiality obligations of LITA personnel

LITA ensures that all employees, contractors, practitioners, and agents authorized to process Personal Data on LITA's behalf are subject to binding confidentiality obligations, whether by employment contract, contractor agreement, or standalone confidentiality undertaking. These obligations survive the termination of the individual's engagement with LITA. LITA will provide relevant data protection training to personnel who handle Personal Data on a regular basis.

Article 6F: Aggregate and anonymized data

Nothing in this DPA restricts LITA's right to collect, create, use, retain, and disclose Aggregate Data, provided that: (a) such Aggregate Data is genuinely anonymized such that no individual Data Subject can be identified or re-identified; (b) it is not combined with other datasets in a manner that would enable re-identification; and (c) its creation and use is consistent with LITA's Privacy Policy. LITA may use Aggregate Data to improve the Platform, publish industry insights, and support LITA's legitimate business interests without restriction.

Article 7: Sub-processors

7.1 Current Sub-Processor List

LITA uses the following Sub-Processors to deliver its services. A full schedule including entity names, registered addresses, data categories handled, and transfer mechanisms is set forth in Annex B.

7.2 Sub-Processor Change Notice

LITA will provide active Platform subscribers with at least thirty (30) days' written notice before engaging a new Sub-Processor or materially changing the role of an existing Sub-Processor. Notice will be provided by email to the registered account address and/or by update to the Sub-Processor list maintained at lostintheastral.com/privacy or lostintheastral.com/dpa.

7.3 Sub-Processor Objections

Clients with specific Sub-Processor objections based on data protection grounds may notify LITA at staff@lostintheastral.com within fifteen (15) days of a Sub-Processor notice. LITA will attempt in good faith to accommodate the objection. If LITA cannot accommodate the objection without material disruption to services, either party may terminate the affected service with thirty (30) days' notice and a prorated refund of any prepaid subscription amounts.

7.4 Sub-Processor Obligations

LITA imposes data protection obligations on Sub-Processors that are at least as protective as those imposed on LITA under this DPA and Applicable Data Protection Law. LITA remains responsible to Clients for Sub-Processor compliance with this DPA.

Article 8: International data transfers

8.1 USA-Based Clients

LITA's primary operations are based in Portland, Oregon, United States. Data collected from USA-based Clients is processed and stored within the United States, with limited exceptions for Hostinger UAB (EU-based) and similar infrastructure vendors operating in their respective jurisdictions.

8.2 EEA and UK Clients: Transfer Mechanisms

For Clients located in the EEA or UK whose Personal Data is transferred to LITA in the United States (a third country for GDPR purposes), LITA relies on the following transfer mechanisms:

(a) Standard Contractual Clauses (Module 2: Controller to Processor). For transfers of EEA Client data from LITA (as Controller) to LITA's USA-based Sub-Processors (as Processors), LITA ensures that SCCs Module 2 (adopted by the European Commission Decision 2021/914) are in place. LITA maintains signed SCCs with each relevant Sub-Processor identified in Article 7.

(b) Standard Contractual Clauses (Module 1: Controller to Controller). For transfers where LITA receives Personal Data from an EEA-based Business-Path client (as Controller) and LITA acts as an independent Controller, LITA and the client will execute SCCs Module 1 as part of the Business-Path engagement agreement.

(c) UK International Data Transfer Agreement (IDTA). For transfers involving UK Data Subjects, LITA uses the UK IDTA issued by the UK Information Commissioner's Office (March 2022) or the UK Addendum to the EU SCCs (also issued March 2022), as applicable. Clients requiring the UK IDTA or Addendum should contact staff@lostintheastral.com to execute the appropriate instrument.

(d) Adequacy Decision. Where a relevant adequacy decision covers a specific transfer (e.g., transfers to Hostinger UAB in Lithuania, an EU member state), LITA may rely on the adequacy determination without requiring additional SCCs.

8.3 Transfer Impact Assessment

Where required by supervisory authority guidance or applicable law, LITA will conduct or cooperate in a transfer impact assessment ("TIA") for cross-border data transfers. Relevant TIA documentation is available to Business-Path clients and EEA/UK Clients upon written request.

8.4 Supplementary Measures

Where a TIA or applicable law requires supplementary measures for a specific transfer, LITA will implement appropriate technical or contractual supplementary measures, which may include: (a) additional encryption at the application layer; (b) pseudonymization before transfer; (c) contractual provisions restricting Sub-Processor disclosures to third-country authorities; or (d) other measures appropriate to the risk.

Article 9: Cookies and tracking technologies

LITA's website uses the following categories of cookies and tracking technologies:

LITA will obtain explicit consent before setting non-essential cookies. Consent is managed through the cookie consent banner and may be withdrawn at any time via the cookie preferences link. LITA does not use cookies for cross-site behavioral advertising to third-party advertisers beyond standard conversion tracking for LITA's own services.

Article 10: Children's data

LITA services are not directed to persons under 18 years of age. LITA's Terms of Service require all Clients to represent that they are at least 18 years old before accessing any LITA service. LITA implements the following controls:

(a) Age Gate. Platform registration requires affirmative confirmation of age 18 or older.

(b) No Knowing Collection. LITA does not knowingly collect or solicit Personal Data from individuals under 18.

(c) Remediation. If LITA discovers it has inadvertently collected Personal Data from an individual under 18, LITA will delete such data without undue delay, terminate the associated account, and notify the individual (or, where required by law, the individual's parent or guardian) of the deletion.

(d) COPPA. LITA's services are not directed to children under 13 and LITA does not collect Personal Data from children under 13 within the meaning of the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. Section 6501 et seq.

Article 11: California privacy rights (CCPA/CPRA)

For California residents, LITA confirms:

• LITA does not sell Personal Data within the meaning of the CCPA/CPRA.
• LITA does not share Personal Data for cross-context behavioral advertising beyond conversion tracking for LITA's own services.
• California residents have the rights described in Article 5 above.
• LITA does not use Sensitive Personal Information for purposes beyond those described in Article 2.
• LITA's retention periods are set forth in Article 4.
• Requests under the CCPA/CPRA may be submitted to staff@lostintheastral.com with subject line "California Privacy Request."
• LITA will respond to verified California resident rights requests within 45 days, with one 45-day extension available upon notice.

Article 12: Nevada privacy law

For Nevada residents:

• LITA does not sell covered information as defined under NRS 603A.
• Nevada residents may submit opt-out requests to staff@lostintheastral.com with subject line "Nevada Opt-Out Request."
• LITA will respond to Nevada opt-out requests within 60 days, with one 30-day extension available upon notice.

Article 13: Amendments

LITA may update this DPA to reflect changes in Applicable Data Protection Law, Sub-Processor arrangements, or LITA's data practices. Material changes will be communicated to active Platform subscribers by email with thirty (30) days' notice before the effective date of the change. Continued use of LITA services following the effective date of a revised DPA constitutes acceptance of the revision. Clients who do not accept a material change may terminate their account prior to the effective date and receive a prorated refund of any prepaid subscription amounts.

Article 14: Contact and supervisory authority

Data Controller Contact: staff@lostintheastral.com | Lost in the Astral, LLC | Portland, Oregon, USA

EEA and UK Clients have the right to lodge a complaint with their local supervisory authority (e.g., the Irish Data Protection Commission for EU matters, the UK Information Commissioner's Office for UK matters) if they believe LITA has processed their Personal Data in violation of Applicable Data Protection Law. LITA requests that Clients contact LITA first at staff@lostintheastral.com to attempt informal resolution before lodging a complaint.

Annex A: Data processing details for GDPR / UK GDPR purposes

Nature of Processing: Collection, storage, use, disclosure (to Sub-Processors as necessary), and deletion of Client Personal Data for service delivery and platform operation.

Purpose of Processing: Delivery of holistic wellness sessions, coaching platform services, and related communications; security and fraud prevention; legal compliance; service improvement (using Aggregate Data only).

Duration of Processing: For the duration of the active client relationship plus the applicable retention periods set forth in Article 4.

Types of Personal Data: As described in Article 2.1.

Categories of Data Subjects: Clients (individuals and business representatives) who engage LITA for personal path, business path, or events services, or who register for the coaching platform.

Special Category Data: Health and wellness data and spiritual/philosophical data as described in Article 2.2. Legal basis for processing: explicit consent under GDPR Article 9(2)(a).

Transfers to Third Countries: As described in Article 8 and Annex B.

Annex B: Sub-processor schedule

The following table sets forth the full Sub-Processor schedule with entity details, data categories handled, and transfer mechanisms as of the date of this DPA. LITA will update this schedule in accordance with Article 7.2.

Note: LITA requires all AI inference Sub-Processors (Google AI Studio, Groq, OpenAI) to process Client data under zero-retention or minimum-retention API terms where available, and to not use Client inputs as Training Data. LITA reviews Sub-Processor AI training policies at each contract renewal.

Annex C: Standard contractual clauses and UK transfer instruments

C.1 EU SCCs Reference

LITA implements the Standard Contractual Clauses adopted by the European Commission by Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 ("EU SCCs"). The applicable modules are:

• Module 1 (Controller to Controller): Used when a Business-Path client (EEA-based Data Controller) transfers Personal Data to LITA (USA-based Data Controller).
• Module 2 (Controller to Processor): Used when LITA (as Controller) transfers Personal Data to USA-based Sub-Processors (as Processors).

The EU SCCs are incorporated into LITA's agreements with each applicable Sub-Processor. Clients requiring a copy of the executed SCCs for compliance purposes may request them at staff@lostintheastral.com.

C.2 UK Transfer Instruments

For transfers involving UK Data Subjects, LITA uses:

(a) UK International Data Transfer Agreement (IDTA). The IDTA issued by the UK Information Commissioner's Office under Article 46(2)(d) of the UK GDPR, effective March 21, 2022.

(b) UK Addendum to EU SCCs. Where LITA has already executed EU SCCs with a Sub-Processor, LITA attaches the UK Addendum (issued by the ICO under S119A(1) Data Protection Act 2018) to convert those SCCs for UK transfers.

Clients wishing to execute the UK IDTA or UK Addendum directly with LITA (in the context of Business-Path engagements) should contact staff@lostintheastral.com.

Annex D: GDPR Article 28 processor obligations (LITA as processor)

Where LITA acts as a Data Processor for a Business-Path client, LITA confirms the following obligations required by GDPR Article 28(3):

(a) LITA processes Personal Data only on documented instructions from the client (Article 28(3)(a)).

(b) LITA ensures that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Article 28(3)(b); see Article 6E of this DPA).

(c) LITA takes all measures required pursuant to GDPR Article 32 (security of processing) (Article 28(3)(c); see Article 6 of this DPA).

(d) LITA respects the conditions for engaging Sub-Processors as set out in GDPR Article 28(2) and (4), and Annex B of this DPA (Article 28(3)(d)).

(e) Taking into account the nature of the processing, LITA assists the client by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the client's obligation to respond to requests for exercising the Data Subject's rights as set out in GDPR Chapter III (Article 28(3)(e)).

(f) LITA assists the client in ensuring compliance with GDPR Articles 32-36 (security, breach notification, DPIA, prior consultation), taking into account the nature of the processing and the information available to LITA (Article 28(3)(f)).

(g) LITA deletes or returns all Personal Data to the client after the end of the provision of processing services, and deletes existing copies unless applicable law requires storage (Article 28(3)(g); see Article 6C of this DPA).

(h) LITA makes available to the client all information necessary to demonstrate compliance with GDPR Article 28, and allows for and contributes to audits, including inspections, conducted by the client or an auditor mandated by the client (Article 28(3)(h); see Article 6B of this DPA).

(i) LITA immediately informs the client if, in LITA's opinion, an instruction from the client infringes GDPR or other applicable EU or Member State data protection provisions (Article 28(3) in fine).

Effective May 22, 2026  ·  Lost in the Astral, LLC, a limited liability company  ·  Version 2.0