Sub-Processors List

1. Purpose & Scope

1.1 Purpose. This list is maintained to:

• Satisfy our obligations under GDPR Article 28(2) and (4) regarding sub-processor transparency
• Inform Customers of all third parties that may process Customer Personal Data
• Provide enterprise Customers with the disclosure necessary for their own vendor risk assessments
• Document our compliance with cross-border data transfer requirements

1.2 Scope. This list includes all sub-processors that:

• Process Personal Data of Customers or end users
• Process Customer Content that may contain Personal Data (e.g., photos with identifiable individuals)
• Have access to Personal Data as part of providing infrastructure to the Service

1.3 Out of Scope. This list does NOT include:

• Vendors that do not access Personal Data (e.g., billing software, internal accounting systems with aggregated data)
• Customers' own sub-processors (e.g., the Customer's CRM, email service, or MLS provider)
• Lumistate's professional advisors (lawyers, accountants, auditors) bound by independent confidentiality obligations

2. Definitions

For the purposes of this document:

• "Personal Data" has the meaning given in GDPR Article 4
• "Customer Content" means photos, descriptions, and other materials uploaded to the Service by Customers
• "Sub-Processor" means any third party engaged by Lumistate to process Personal Data
• "SCCs" means the European Commission's Standard Contractual Clauses for international data transfers
• "Adequacy Decision" means a decision by the European Commission that a third country provides adequate data protection

3. Current Sub-Processors

The following Sub-Processors are currently engaged to provide the Service.

These Sub-Processors process Personal Data only for specific Customer-initiated functions.

4. Affiliates and Internal Processors

4.1 Lumistate Affiliates. Lumistate is operated by Ecomerco – Jakub Janus, a sole proprietorship. There are no affiliated entities currently processing Personal Data on Lumistate's behalf.

4.2 Internal Personnel. Personnel of Ecomerco – Jakub Janus and authorized contractors who process Personal Data are bound by confidentiality obligations and are not considered Sub-Processors for the purposes of this list. Access is granted on a need-to-know basis.

4.3 Future Affiliates. If Lumistate establishes affiliated entities (e.g., upon incorporation as a limited liability company or expansion to subsidiary entities), this section will be updated with at least 30 days' advance notice.

5. Notification of Changes

5.1 Material Changes Defined. A "material change" to this list includes:

• Addition of a new Sub-Processor that processes Personal Data
• Material change in the type of Personal Data a Sub-Processor processes
• Material change in the geographic location of processing (e.g., from EU to non-EU)
• Change in transfer mechanism (e.g., loss of adequacy, change of SCCs)
• Replacement of a Sub-Processor

5.2 Non-Material Changes. The following are not material changes:

• Corrections of typographical errors
• Updates to a Sub-Processor's corporate name (e.g., parent company change)
• Clarifications that do not change the substance of processing
• Updates to this document's formatting or structure

5.3 Advance Notice Period.

• For material changes: at least 30 days' advance notice
• For emergency changes (e.g., a Sub-Processor failure requiring immediate replacement): notice as soon as reasonably possible, with explanation of the urgency

5.4 How We Notify. Material change notifications are delivered through:

• Email to billing-contact addresses for active Customer accounts
• Posting to lumistate.ai/legal/sub-processors with date stamp
• For partnership-tier Customers (Brokerage and MLS): direct email to designated technical and legal contacts
• For Customers with executed DPAs: notification per the DPA's specified mechanism

6. Enterprise Customer Notification Mechanisms

6.1 Subscribe to Updates. Enterprise Customers can subscribe to direct sub-processor change notifications by emailing jakub@amaia-estate.com with subject "Sub-Processor Notifications" and providing:

• Account or partnership identifier
• Designated technical contact (name and email)
• Designated legal/compliance contact (name and email)

6.2 Notification SLA for Partnership Tiers. For partnership-tier customers (Brokerage and MLS), we commit to:

• 30-day advance notice for material changes
• 5-business-day response to questions about specific Sub-Processors
• Annual review of the Sub-Processor list with major Customer accounts upon request

7. Customer Right to Object

7.1 Right to Object. Customers may object to a new or replacement Sub-Processor on reasonable, documented data protection grounds.

7.2 How to Object. Send an objection by email to jakub@amaia-estate.com within the 30-day notice period, with:

• Subject line: "Sub-Processor Objection"
• The specific Sub-Processor objected to
• The data protection grounds for the objection
• Suggested remediation if any

7.3 Resolution Process.

• We will work in good faith to address objections
• Possible resolutions include: configuration changes, alternative Sub-Processor for the objecting Customer, additional safeguards, or revision of the proposed change
• If we cannot reach a mutually acceptable resolution within 30 days of the objection, the Customer may terminate their subscription with respect to the affected services with pro-rata refund of prepaid fees

7.4 No Termination Without Objection. Continued use of the Service after the effective date of a sub-processor change without timely objection constitutes acceptance.

8. Updates & Contact

8.1 Updates. This document is updated whenever Sub-Processors are added, removed, or materially changed. The "Last updated" date at the top of this document reflects the most recent revision.

8.2 Version History. Previous versions are maintained on request. Customers may request a specific historical version via email.

8.3 Contact. For questions about Sub-Processors:

• Email: jakub@amaia-estate.com
• Subject line: "Sub-Processor Question"
• Postal: Ecomerco – Jakub Janus, ul. Stefana Czarnieckiego 3/5, 59-400 Jawor, Poland