Data Processing Addendum
This Data Processing Addendum ("DPA") forms an integral and binding part of the LEOREXA Terms of Service. In providing the automated SaaS features, campaigns, and integration paths, Legasibild EOOD acts as a Data Processor ("Processor"), and the Customer acts as a Data Controller ("Controller") under the GDPR.
1. Scope and Compliance
The Processor shall process personal data (specifically workspace contacts, lead details, communication metadata, and message content) solely under the documented instructions of the Controller and to provide the contracted SaaS features, in full compliance with Article 28 of the GDPR.
2. Personnel Confidentiality
The Processor ensures that all personnel authorized to process the personal data have committed themselves to strict confidentiality or are under an appropriate statutory obligation of secrecy.
3. Security Measures
The Processor shall implement appropriate technical and organizational measures (such as encrypted OAuth storage, HTTPS encryption, and user access controls) to ensure a level of security appropriate to the risk.
4. Sub-processors
The Controller grants a general written authorization to the Processor to engage sub-processors (such as infrastructure, hosting, and AI API providers). The Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors upon request, giving the Controller the opportunity to object. The Processor shall impose the same data protection obligations on any engaged sub-processor.
5. Data Subject Rights and Cooperation
The Processor shall assist the Controller, insofar as this is technically feasible, by appropriate technical and organizational measures, in fulfilling the Controller's obligation to respond to requests from data subjects exercising their rights under Chapter III of the GDPR. The Processor shall further assist the Controller in ensuring compliance with obligations regarding security, breach notifications, and data protection impact assessments.
6. Audits and Information
The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, subject to reasonable advance notice and confidentiality restrictions.
7. International Transfers
Where the performance of the service involves the transfer of personal data outside the European Economic Area (EEA), the Processor ensures that such transfers are protected by European Commission approved Standard Contractual Clauses (SCCs), active participation in the EU-U.S. Data Privacy Framework, or alternative valid adequacy mechanisms.
8. Return or Deletion
Upon termination of the service or definitive account closure, the Processor shall, at the choice of the Controller, securely delete or return all personal data within its active production systems and delete existing copies, unless mandatory European Union or Member State law requires the continued storage of certain records.