Data Processing Agreement

Contract formation and selections

The Customer and Legiscope UAB (Parties) agree to the present Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/915 of 4 June 2021 under Article 28(7) GDPR (Commission Clauses), reproduced verbatim below, and to the Supplementary contractual terms that follow them. The applicable GDPR selections are highlighted, and the non-applicable alternatives and the non-retained optional clause are shown struck through.

The Customer is the controller and Legiscope is the processor unless the Order Form states that the Customer acts as processor for another controller, in which case Legiscope is the sub-processor. Option 1 in Clause 1(a), Article 28(3) and (4) GDPR, is selected. Clause 5, the optional docking clause, is not retained. Option 2 in Clause 7.7(a), general written authorisation, is selected with a 30-calendar-day notice period. The GDPR options in Clauses 8 and 9 are selected.

This DPA is published at www.legiscope.com/dpa.html as one complete canonical instrument. When an accepted Order Form applies, the DPA as published at acceptance automatically forms part of the Agreement; no separate DPA signature is required. The customer identity, role, service scope, effective date and any service-specific processing details stated in the Order Form complete Annexes I and II. A professional service is processed under this DPA; the Order Form records its particulars or any deviation before the engagement begins.

SECTION I — OBLIGATIONS OF THE PARTIES

SECTION II — OBLIGATIONS OF THE PARTIES

SECTION III — FINAL PROVISIONS

Annex I — List of parties

• Controller: the Customer legal entity identified in the Order Form or, where the Order Form states that the Customer acts as processor for another controller, that controller, represented towards Legiscope by the Customer. The registered address, registration information, privacy or DPO contact, role and authorised signatory are the corresponding details recorded in the accepted Order Form.
• Processor: Legiscope UAB, company code 304581221, Laisvės pr. 60-1107, LT-05120 Vilnius, Lithuania. Privacy contact: contact@legiscope.com. Activities relevant to the data: provision, security, support and administration of the purchased Legiscope Service.
• Signature and date: the effective date and acceptance evidence recorded in the applicable Order Form. No separate signature on this Annex is required.

Annex II — Description of processing

Every processing activity under this DPA is performed by Legiscope as processor or, where the Customer acts for another controller, as sub-processor; Legiscope does operate independent-controller activities that are outside this DPA and are described separately in the Terms.

• Subject matter: Processing Customer Personal Data to provide, operate, secure, support and administer the Legiscope Service and professional services selected in the applicable Order Form, in accordance with the Customer’s documented instructions and configuration.
• Categories of data subjects: Customer personnel and authorised users; the Customer’s clients, suppliers, processors, sub-processors and business contacts; applicants, employees, contractors, complainants and data-rights requesters; persons described in processing activities, DPIAs, transfer assessments, incidents, audits, evidence or other Customer compliance records; and other individuals whose personal data the Customer lawfully submits.
• Categories of personal data: identity, contact, account and professional details; employment and organisational information; online and technical identifiers; access, role and activity information; correspondence; contractual and supplier information; data-rights and complaint information; incident and security information; processing, retention, recipient and transfer information; uploaded documents, evidence, prompts and customer-specific generated output; and any other category deliberately included by the Customer within purchased scope.
• Sensitive data and safeguards: The Service is not designed for unrestricted processing of underlying identifiable special-category or criminal-conviction data. Whether particular data may be processed lawfully and appropriately depends on the data category, purpose, jurisdiction, provider service and route, configuration, contractual terms, scale and safeguards. Health, genetic, biometric and similarly regulated data may be subject to sector- or country-specific rules that do not apply in the same way to other categories, such as trade-union membership. Before submitting such data, the Customer must determine that the use is lawful, necessary, proportionate and compatible with the selected workflow and provider route, minimise the data and use non-identifying descriptions where sufficient. For example, AWS or an AI provider may be suitable for a particular category and use in one jurisdiction but not another. Legiscope has not assessed the Customer’s sector- or country-specific requirements and does not represent that the standard Service or every provider route satisfies them.
• Nature of processing: collect, receive, host, store, organise, retrieve, consult, display, transmit, structure, compare, analyse, generate customer-specific output, export, secure, back up, support and delete Customer Personal Data solely to provide the instructed Service.
• Purpose: provide, secure, support and administer the hosted Legiscope privacy and compliance platform, its purchased modules, organisations, integrations and professional services as identified in the Order Form and documented Customer instructions.
• Duration of the processing: the Agreement term; the post-termination retention-for-restorability period of up to 12 months described in the supplementary terms; active-system deletion without undue delay on the applicable instruction or election; and the bounded 90-day backup purge cycle described in the supplementary terms. Independent-controller records are outside this DPA.
• Frequency: continuous hosting and security processing during the term; user-initiated or scheduled processing when an authorised workflow, integration, support action, provider operation or export is performed.
• Sub-processor processing: each authorised sub-processor’s subject matter, purpose, data scope, processing context and transfer basis are identified in Annex IV.

Annex III — Technical and organisational measures

These measures apply according to the processing in scope. The current public Security record supplies the concrete control descriptions and evidence boundaries referenced by this Annex; it does not replace the contractual measures below.

• Pseudonymisation and minimisation: tenant and record identifiers rather than customer names address primary records, storage prefixes and security events; uploaded filenames are normalised; provider inputs are limited to the material required for an authorised operation.
• Encryption and transmission: customer-facing endpoints use HTTPS/TLS; production database tables and private customer object storage use AWS server-side encryption at rest; storage policies reject insecure transport and public access is blocked.
• Identity and authorisation: authenticated individual accounts, role-based permissions, tenant-scoped record and object access, administrative access controls, TOTP MFA capability and periodic personnel access review.
• Confidentiality, integrity and tenant isolation: authorised personnel are bound by confidentiality; point reads and list queries enforce the authenticated account boundary; allow-listed fields, typed validation and conditional writes protect integrity.
• Availability and recovery: monitored managed infrastructure, point-in-time and versioned recovery controls, encrypted private recovery copies in a geographically separate EU region, documented restoration procedures and protected recovery retention.
• Logging and detection: privacy-controlled application diagnostics, security events, managed service logs and distributed traces; relevant identifiers are pseudonymised or omitted; access to logging systems is restricted and incidents follow documented triage and escalation.
• Development and change: separated development, pre-production and production paths; source control, reviewed changes, automated packaging, dependency and vulnerability management, source-bound release evidence and MFA-protected production approval.
• Assistance and effectiveness: controlled export and deletion procedures, incident investigation, data-subject-request assistance, DPIA and prior-consultation support, periodic control review and proportionate audit cooperation.
• Return and erasure: active-system deletion without undue delay following the applicable instruction; encrypted, access-restricted disaster-recovery copies automatically purge within the bounded 90-day cycle stated in the supplementary terms; restored copies have recorded deletion instructions re-applied before ordinary use.

Annex IV — List of sub-processors

The Customer gives general written authorisation for the sub-processors below to the extent they apply to the purchased Service. The register below, as published at acceptance, forms the agreed list for that Order and identifies each sub-processor’s contracting entity and transfer basis. The current online register is maintained at https://www.legiscope.com/subprocessors.html.

The listed AI providers are each authorised for any AI-assisted operation of the purchased Service; Legiscope determines the provider or providers used for ai operations according to capability, performance, cost, security and risk profile. A provider not on the agreed list is engaged only through the Clause 7.7(a) change process.

A provider used solely for Legiscope’s independent-controller contracting, billing or business-communication activity is not an Annex IV sub-processor unless it also processes Customer Personal Data on the Customer’s behalf.

SECTION IV — SUPPLEMENTARY CONTRACTUAL TERMS

The provisions that follow supplement the Commission Clauses and the completed Annexes with Service-specific rules for consultancies and DPO services, sub-processor changes and objections, audits, assistance, personal data breaches, deletion and restorability, backups, and public-authority access requests. They must be read together with the Commission Clauses and do not replace, restrict or override them; if a supplementary term conflicts with the Commission Clauses, the Commission Clauses prevail.