Data processing agreement

1. Parties and subject matter

1.1 The controller is the customer, meaning you or the organisation you registered for.

1.2 The processor is Ajay Vaidhyanathan Swaminathan, hello@getlexora.de.

1.3 The processor processes personal data only on behalf of the controller and in accordance with this agreement, unless required to do otherwise by Union or Member State law, in which case the processor will inform the controller of that legal requirement before processing, unless the law prohibits it.

2. Scope, nature, purpose, and duration

Nature and purpose

hosting, text extraction, and automated analysis of contract documents to produce risk flags and suggested wording, plus storage and version history, all to provide the Lexora service to the controller

Processing operations

collection, storage, organisation, retrieval, transmission to sub-processors, and erasure

Duration

for the term of the controller's contract for the service, and until deletion or return of the data under section 10

3. Types of personal data and categories of data subjects

3.1 Types of personal data: data contained in the documents and text the controller submits, which may include names, contact details, signatory and representative details, job titles, financial and commercial terms, and any other personal data the controller chooses to include. The controller decides the content and must avoid including special categories of data (Article 9 GDPR) unless separately agreed.

3.2 Categories of data subjects: the controller's contracting counterparties and their staff, signatories, representatives, employees, and any other individuals named in the submitted documents.

4. Rights and instructions of the controller

4.1 The controller is responsible for the lawfulness of the processing and for having a legal basis for submitting the data, including meeting information duties towards data subjects under Articles 13 and 14 GDPR.

4.2 The processor acts only on documented instructions from the controller. This agreement, the terms of service, and the controller's use of the product's features are the initial documented instructions. Further instructions must be given in text form.

4.3 The processor will inform the controller without undue delay if it considers an instruction to infringe the GDPR or other data protection law. The processor may suspend the affected processing until the instruction is confirmed or changed.

5. Obligations of the processor

The processor will:

• process the personal data only as set out in section 4 and for no other purpose;
• ensure that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• implement and maintain the technical and organisational measures required by Article 32 GDPR (section 6 and Annex 2);
• respect the conditions for engaging sub-processors in section 7;
• assist the controller as set out in sections 8 and 9;
• delete or return the personal data as set out in section 10;
• make available the information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits as set out in section 11;
• appoint a contact for data protection questions, reachable at hello@getlexora.de.

6. Technical and organisational measures

The processor maintains the measures described in Annex 2, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to data subjects. The processor may update the measures provided the level of protection is not reduced.

7. Sub-processors

7.1 The controller gives general authorisation for the processor to engage sub-processors. Those engaged at the date of this agreement are listed in Annex 1.

7.2 The processor will impose on each sub-processor, by contract, data protection obligations equivalent to those in this agreement, in particular sufficient guarantees to implement appropriate technical and organisational measures. The processor remains fully liable to the controller for the performance of each sub-processor's obligations.

7.3 The processor will inform the controller of any intended addition or replacement of a sub-processor at least 30 days in advance, giving the controller the opportunity to object on reasonable data protection grounds. If the controller objects and the parties cannot agree, the controller may terminate the affected service for the future.

8. Assistance to the controller

8.1 Taking into account the nature of the processing, the processor will assist the controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the controller's obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR. If a data subject contacts the processor directly, the processor will forward the request to the controller without undue delay and not respond on its own.

8.2 The processor will assist the controller in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments, prior consultation), taking into account the information available to the processor.

9. Personal data breaches

The processor will notify the controller without undue delay after becoming aware of a personal data breach affecting the controller's data. The notification will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. The processor will support the controller's own notification duties under Articles 33 and 34 GDPR.

10. Deletion and return

On termination of the provision of the service, and at the controller's choice, the processor will delete or return all personal data processed on the controller's behalf and delete existing copies, unless Union or Member State law requires storage. Where deletion cannot be immediate for backups, the data is isolated from further processing and deleted on the next backup rotation, within 30 days. The processor will confirm deletion in text form on request.

11. Audits and evidence

11.1 The processor will make available to the controller information necessary to demonstrate compliance with Article 28 GDPR, including summaries of relevant certifications, test results, or audit reports where available.

11.2 The controller may carry out an audit, including inspections, once per year and additionally where there is a specific cause, on reasonable prior notice of at least 14 days, during business hours, without disproportionate disruption to the processor's operations, and subject to confidentiality. The controller bears its own audit costs.

12. International transfers

Any transfer of the controller's personal data to a country outside the European Economic Area takes place only where an adequacy decision applies or appropriate safeguards under Article 46 GDPR are in place, in particular the European Commission's Standard Contractual Clauses, together with any additional measures required. The relevant transfers and safeguards for current sub-processors are shown in Annex 1.

13. Liability, term, and final provisions

13.1 Liability under this agreement follows Article 82 GDPR and the liability provisions of the terms of service.

13.2 This agreement takes effect with the contract for the service and ends when that contract ends and the obligations in section 10 are fulfilled.

13.3 If a provision of this agreement is invalid, the remaining provisions are unaffected. In case of conflict between this agreement and the terms of service on data protection matters, this agreement prevails.

Annex 1: sub-processors

This annex mirrors the recipients table in the privacy policy and is kept in sync with it. Transactional email tied to the account is sent by the authentication provider (Clerk) listed above. No payment sub-processor is engaged yet; one will be added here before paid plans are offered.

Annex 2: technical and organisational measures

The processor maintains measures appropriate to the risk, including the following. The detail of each measure is confirmed as part of the counsel review and kept current.

• Encryption: transport encryption (TLS) for all data in transit; encryption at rest for the application database and backups.
• Access control: authentication through a dedicated identity provider; role-based access to production systems on a least-privilege basis; access reviews; unique accounts; no shared credentials.
• Tenant separation: each account's data is logically separated and access is scoped to the owning account in the application layer.
• Pseudonymisation and minimisation: the uploaded original file is not retained by default; only extracted text needed for the analysis is stored; direct identifiers in the extracted text are not currently masked before transmission to the AI provider.
• Availability and resilience: managed, redundant database hosting; regular backups; monitoring and alerting.
• Integrity: change management for production deployments; audit logging of security-relevant events; rate limiting and abuse protection.
• Restore: documented procedure to restore access to data after an incident, with a target recovery point objective of 24 hours and a target recovery time objective of 24 hours.
• Vendor management: data processing agreements with all sub-processors; review of their security posture before onboarding.
• Evaluation: periodic review and, where appropriate, testing of these measures.