Data Processing Agreement

Contract formation and selections

The Customer and Legiscope UAB (Parties) agree to the Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/915 of 4 June 2021 under Article 28(7) GDPR (Commission Clauses), reproduced in full below with the applicable GDPR selections completed and the non-applicable EUDPR alternatives omitted.

The Customer is the controller and Legiscope is the processor unless the Order Form states that the Customer acts as processor for another controller, in which case Legiscope is the sub-processor. Option 1 in Clause 1(a), Article 28(3) and (4) GDPR, is selected. Clause 5, the optional docking clause, is retained. Option 2 in Clause 7.7(a), general written authorisation, is selected with a 30-calendar-day notice period. The GDPR options in Clauses 8 and 9 are selected.

An Order Form or other Agreement accepted by authorised signatories automatically incorporates the DPA version it identifies. The customer identity, role, service scope, effective date and any service-specific processing details stated there complete Annexes I and II. No separate DPA signature is required. Each party receives or can reproduce the incorporated version, and the contract record retains its exact PDF and SHA-256 hash.

The Commission Clauses prevail over any conflicting supplementary term. This DPA prevails over the Terms of Service for processing Customer Personal Data, and an applicable Chapter V transfer instrument prevails for a restricted international transfer. This DPA does not itself provide a Chapter V transfer mechanism.

Section I — Commission clauses

Section II — Commission clauses

Section III — Commission clauses

Annex I — List of parties

• Controller: the Customer legal entity identified in the Order Form. Its registered address, registration information, privacy or DPO contact, role, authorised signatory and signature or accession date are the corresponding details recorded in the accepted Order Form or accession document. Activities relevant to the data: use and administration of the purchased Legiscope compliance workflows.
• Processor: Legiscope UAB, company code 304581221, Laisvės pr. 60-1107, LT-05120 Vilnius, Lithuania. Privacy contact: privacy@legiscope.com. Activities relevant to the data: provision, security, support and administration of the purchased Legiscope Service.
• Signature and accession date: the effective date and acceptance evidence recorded in the applicable Order Form or signed accession document. No separate signature on this Annex is required unless a party uses Clause 5 to accede after the Agreement takes effect.

Annex II — Description of processing

• Categories of data subjects: Customer personnel and authorised users; the Customer’s clients, suppliers, processors, sub-processors and business contacts; applicants, employees, contractors, complainants and data-rights requesters; persons described in processing activities, DPIAs, transfer assessments, incidents, audits, evidence or other Customer compliance records; and other individuals whose personal data the Customer lawfully submits.
• Categories of personal data: identity, contact, account and professional details; employment and organisational information; online and technical identifiers; access, role and activity information; correspondence; contractual and supplier information; data-rights and complaint information; incident and security information; processing, retention, recipient and transfer information; uploaded documents, evidence, prompts and customer-specific generated output; and any other category deliberately included by the Customer within purchased scope.
• Sensitive data and safeguards: the Service does not require special-category or criminal-conviction data by default. Where the Customer lawfully includes it, the Order Form identifies material or systematic categories and workflows. Applicable safeguards include strict purpose limitation, least-privilege role access, confidentiality, encryption in transit and at rest, access and security logging, onward-transfer restrictions, provider-input minimisation and competent human review of legally significant AI-assisted output.
• Nature of processing: collect, receive, host, store, organise, retrieve, consult, display, transmit, structure, compare, analyse, generate customer-specific output, export, secure, back up, support and delete Customer Personal Data solely to provide the instructed Service.
• Purpose: provide, secure, support and administer the hosted Legiscope privacy and compliance platform, its purchased modules, organisations, integrations and professional services as identified in the Order Form and documented Customer instructions.
• Duration: the Agreement term, applicable Data Act transition and retrieval periods, active-system deletion without undue delay, and the bounded 90-day technically immutable backup cycle described in the supplementary terms. Independent-controller records are outside this DPA.
• Frequency: continuous hosting and security processing during the term; user-initiated or scheduled processing when an authorised workflow, integration, support action, provider operation or export is performed.
• Sub-processor processing: each authorised sub-processor’s subject matter, purpose, data scope and processing context are identified in Annex IV and the service-specific snapshot incorporated into the Agreement.

Annex III — Technical and organisational measures

These measures apply according to the processing in scope. The current public Security record supplies the concrete control descriptions and evidence boundaries referenced by this Annex; it does not replace the contractual measures below.

• Pseudonymisation and minimisation: tenant and record identifiers rather than customer names address primary records, storage prefixes and security events; uploaded filenames are normalised; provider inputs are limited to the material required for an authorised operation.
• Encryption and transmission: customer-facing endpoints use HTTPS/TLS; production database tables and private customer object storage use AWS server-side encryption at rest; storage policies reject insecure transport and public access is blocked.
• Identity and authorisation: authenticated individual accounts, role-based permissions, tenant-scoped record and object access, administrative access controls, TOTP MFA capability and periodic personnel access review.
• Confidentiality, integrity and tenant isolation: authorised personnel are bound by confidentiality; point reads and list queries enforce the authenticated account boundary; allow-listed fields, typed validation and conditional writes protect integrity.
• Availability and recovery: monitored managed infrastructure, point-in-time and versioned recovery controls, encrypted private recovery copies in a geographically separate EU region, documented restoration procedures and protected recovery retention.
• Logging and detection: privacy-controlled application diagnostics, security events, managed service logs and distributed traces; relevant identifiers are pseudonymised or omitted; access to logging systems is restricted and incidents follow documented triage and escalation.
• Development and change: separated development, pre-production and production paths; source control, reviewed changes, automated packaging, dependency and vulnerability management, source-bound release evidence and MFA-protected production approval.
• Assistance and effectiveness: controlled export and deletion procedures, incident investigation, data-subject-request assistance, DPIA and prior-consultation support, periodic control review and proportionate audit cooperation.
• Return and erasure: active-system deletion without undue delay following the applicable instruction; encrypted, access-restricted and technically immutable disaster-recovery copies automatically purge no later than 90 days after active deletion; restored copies have recorded deletion instructions re-applied before ordinary use.

Annex IV — List of sub-processors

The Customer gives general written authorisation for the sub-processors below to the extent they apply to the purchased Service. The service-specific snapshot of the Subprocessor Register incorporated on the effective date identifies the applicable contracting entity and forms the agreed list for that Order. The current online register is maintained at https://www.legiscope.com/subprocessors.html.

A provider used solely for Legiscope’s independent-controller contracting, billing or business-communication activity is not an Annex IV sub-processor unless it also processes Customer Personal Data on the Customer’s behalf.

• Amazon Web Services (AWS) — cloud infrastructure and transactional email. Processing: host, secure, back up, monitor and transmit Customer Personal Data and service records required for the application. Primary application processing is in AWS eu-west-1 (Ireland), with protected customer-object recovery in eu-west-3 (France); the incorporated snapshot identifies the applicable AWS contracting entity and any service-specific transfer context.
• OpenAI — commercial API, when selected for an authorised AI-assisted workflow. Processing: receive the minimum source material, Customer Content, task instructions and workflow context required to generate structured analysis, drafting or decision-support output. The incorporated snapshot records whether this provider is enabled and the applicable contracting and transfer position.
• Anthropic — commercial API, when selected for an authorised AI-assisted workflow. Processing: receive the minimum source material, Customer Content, task instructions and workflow context required to generate structured analysis, drafting or decision-support output. The incorporated snapshot records whether this provider is enabled and the applicable contracting and transfer position.
• Google Gemini — paid Gemini API services, when selected for an authorised AI-assisted workflow. Processing: receive the minimum source material, Customer Content, task instructions and workflow context required to generate structured analysis, drafting or decision-support output. The incorporated snapshot records whether this provider is enabled and the applicable Google contracting and transfer position.

Supplementary terms — instructions and assistance

The Agreement, authorised user actions in the Service, support requests and documented configuration choices are the Customer’s instructions. Legiscope may suspend affected processing while an instruction that it reasonably believes infringes applicable data-protection law is confirmed, modified or withdrawn.

Taking account of the nature of processing and information available, Legiscope will reasonably assist the Customer with data-subject requests, security obligations, breach notifications, DPIAs and prior consultation. The Customer remains responsible for decisions and communications legally assigned to it.

Legiscope will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and provide information available for the Customer’s assessment and notifications. Notification is not an admission of fault or liability.

Supplementary terms — sub-processors and transfers

The Customer generally authorises the sub-processors in Annex IV. Legiscope will give at least 30 calendar days’ advance written notice of an intended addition or replacement unless an emergency necessary to protect the Service or personal data makes shorter notice necessary.

The Customer may object during the notice period on reasonable documented data-protection grounds. The Parties will work in good faith on a commercially reasonable alternative. If none is available, the Customer may stop the affected feature or terminate the affected Service and receive a pro-rata refund of prepaid unused fees for it.

Legiscope remains responsible for each sub-processor’s performance of the applicable data-protection obligations. Restricted transfers must use an applicable adequacy decision, the relevant module of Commission Implementing Decision (EU) 2021/914 or another lawful Chapter V mechanism, together with supplementary measures where required.

Supplementary terms — audits and confidentiality

Legiscope will make available information reasonably necessary to demonstrate compliance with the Commission Clauses, including appropriate control summaries and relevant independent assurance that it is lawfully permitted to share. Public trust material is not a substitute for information required by Clause 7.6.

The Customer may audit itself or through an independent auditor bound by confidentiality. Except after a material incident, on reasonable indications of non-compliance or where an authority requires otherwise, an audit will occur no more than once in 12 months, during business hours and on reasonable advance notice, and will avoid another customer’s data and material security secrets. The Customer bears reasonable audit costs unless the audit identifies a material breach by Legiscope.

Personnel authorised to process Customer Personal Data are bound by confidentiality and receive instructions appropriate to their role. Nothing restricts mandatory supervisory-authority powers.

Supplementary terms — deletion and immutable backups

At the Customer’s choice, Legiscope will return or delete Customer Personal Data after the relevant services end in accordance with Clause 10(d) and the Data Act exit process. Data selected for deletion is removed from active systems without undue delay and put beyond ordinary use.

Residual copies may remain only in encrypted, access-restricted and technically immutable rolling backups used solely for disaster recovery. They cannot be selectively altered during the protected cycle and are automatically purged no later than 90 days after active-system deletion. Until purge, the Commission Clauses protect those copies and Legiscope will not process them for another purpose.

Legiscope records each deletion instruction. If a backup is restored, Legiscope re-applies the instruction before the restored data returns to ordinary operation. On request, Legiscope will certify active-system deletion and, after the cycle expires, final backup purge. A legal retention requirement is documented and disclosed unless law prohibits disclosure.

Supplementary terms — liability and termination

Without prejudice to data-subject rights and supervisory-authority powers, liability between the Parties is governed by the Agreement’s single global liability cap. Nothing relieves either Party of its own responsibilities under the GDPR.

The Customer may exercise the suspension and termination rights in Clause 10. Legiscope may terminate processing only as permitted by Clause 10(c) or other controlling law.

The governing law and jurisdiction stated in the Terms apply only to supplementary contractual matters. Mandatory data-protection law and the Commission Clauses remain controlling within their scope.