Last updated May 8, 2026
Lawcel Version 2.0 Effective Date: 8 May 2026
This Data Processing Agreement (the "DPA") is between Lawcel (Vesterbrogade 52a, 3250 Gilleleje, Denmark), acting as Processor, and the entity that has accepted Lawcel's Terms of Service or otherwise contracted with Lawcel for the Services (the "Customer"), acting as Controller.
This DPA forms part of the agreement between Lawcel and the Customer (the "Main Agreement") and governs Processing of Personal Data by Lawcel on the Customer's behalf in connection with the Services.
If this DPA conflicts with the Main Agreement, this DPA prevails on data-protection matters. If this DPA conflicts with the SCCs incorporated in Annex 4, the SCCs prevail.
Unless defined here, capitalised terms have the meanings given in the GDPR.
The subject matter, duration, nature and purpose, categories of Data Subjects, and categories of Personal Data are set out in Annex 1.
The Customer is the Controller and Lawcel is the Processor. Lawcel Processes Personal Data only on the Customer's Documented Instructions.
Where the Customer is itself a Processor for a third-party controller, Lawcel acts as a Sub-processor; the Customer warrants it has obtained any required authorisations and flow-down terms.
Lawcel's processing of its own visitors, prospects, and administrative users in connection with operating the Services is governed by Lawcel's Privacy Policy, where Lawcel acts as an independent Controller. This DPA does not apply to that processing.
The Customer warrants that:
Lawcel will comply with Article 28(3) GDPR. In particular, Lawcel will:
If Lawcel reasonably believes an instruction infringes Data Protection Laws, it will notify the Customer promptly and may suspend the instruction until confirmed or modified.
The Customer grants Lawcel general written authorisation to engage Sub-processors, subject to this Section.
The current Sub-processor list is at https://app.lawcel.com/legal/lawcel/sub-processor-list (the "Sub-processor List") and forms part of this DPA. The Sub-processors approved at the Effective Date are listed in Annex 3.
Before engaging or replacing a Sub-processor, Lawcel will:
The Customer may object on reasonable data-protection grounds within 14 calendar days of notification. If the parties cannot resolve the objection within a further 30 days, the Customer may terminate the affected portion of the Services without penalty and receive a pro-rata refund for the unused term.
Lawcel will impose on each Sub-processor, by written contract, data-protection obligations materially the same as those in this DPA (Article 28(4) GDPR), and remains fully liable for each Sub-processor's performance.
Taking into account the nature of Processing, Lawcel will assist the Customer in fulfilling Data Subject requests under Chapter III GDPR by appropriate technical and organisational measures.
If Lawcel receives a Data Subject request relating to Personal Data Processed for the Customer, Lawcel will forward it to the Customer within 5 business days and will not respond directly unless authorised by the Customer or required by law.
Assistance fulfillable through standard platform functionality is provided at no additional cost. Custom engineering effort may be chargeable at standard rates, agreed in writing first.
Lawcel implements and maintains appropriate technical and organisational measures under Article 32 GDPR. The current measures are summarised in Annex 2, reviewed periodically, and not materially reduced during the Main Agreement.
Lawcel will notify the Customer of a Personal Data Breach affecting Personal Data Processed under this DPA without undue delay and in any event within 72 hours of becoming aware.
The notification will include, to the extent known: the nature of the breach (categories and approximate numbers of Data Subjects and records); likely consequences; measures taken or proposed; and Lawcel's incident point of contact. Further information will follow without undue delay as it becomes available.
Lawcel will not notify Data Subjects directly unless instructed in writing or required by law, and will reasonably cooperate with the Customer's investigation and remediation.
Lawcel will reasonably assist the Customer with DPIAs (Article 35 GDPR) and prior consultations with Supervisory Authorities (Article 36 GDPR), where the Customer cannot otherwise obtain the relevant information. Assistance is limited to information about the Services and Lawcel's Processing.
Lawcel may transfer Personal Data outside the EEA or the UK in connection with the Services, including via Sub-processors in the Sub-processor List. Lawcel ensures any such transfer is supported by an appropriate Chapter V GDPR mechanism, such as:
Lawcel applies a Transfer Impact Assessment and supplementary measures where necessary, in line with Schrems II (Case C-311/18) and EDPB Recommendations 01/2020. If a transfer mechanism is invalidated, the parties will cooperate in good faith on an alternative.
On reasonable prior written notice, Lawcel will make available the information necessary to demonstrate Article 28 compliance and will allow and contribute to audits by the Customer or an independent auditor.
To minimise disruption and protect the confidentiality of other customers' data:
On termination or expiry of the Main Agreement, at the Customer's election, Lawcel will either return Personal Data in a commonly used machine-readable format or delete it from production systems. Lawcel will certify completion in writing within 30 days of the Customer's election.
Personal Data in routine automated backups is deleted in line with Lawcel's backup rotation (maximum 30 days) and remains subject to all confidentiality, security, and access-control obligations during that period.
Lawcel may retain Personal Data to the extent required by law, only for the period and purpose required, and subject to continuing confidentiality and security obligations.
Each party's liability under this DPA, in contract, tort, or otherwise, is subject to the limitations and exclusions in the Main Agreement.
Nothing limits or excludes either party's liability for: damage caused by Processing in breach of Data Protection Laws where the law does not permit limitation; fraud or wilful misconduct; or any liability that cannot be limited or excluded by applicable law. Article 82 GDPR applies to allocation of liability for compensation to Data Subjects.
This DPA takes effect on the later of (a) the Effective Date and (b) the effective date of the Main Agreement, and remains in effect for the duration of the Main Agreement.
Provisions that by their nature should survive — including post-termination return and deletion (Sections 6 and 14), breach notification for incidents occurring before termination (Section 10), audit rights for 12 months after termination (Section 13), liability (Section 15), and this Section 16 — will survive termination.
Precedence: SCCs (Annex 4) → this DPA → Main Agreement on data-protection matters.
Amendment. Lawcel may amend this DPA to reflect changes in Data Protection Laws, regulatory guidance, or its Processing activities. Material amendments will be notified at least 30 days before taking effect.
Governing law. Save where the SCCs specify otherwise, Danish law governs, and the parties submit to the exclusive jurisdiction of the courts of Copenhagen.
Contact: privacy@lawcel.com.
Subject matter and duration. Personal Data submitted to or otherwise made available through the Services. Duration: the term of the Main Agreement plus the retention periods set out in this DPA and the Privacy Policy.
Nature and purpose. Processing comprises:
Categories of Data Subjects. The Customer's administrative, developer, and legal users; and authors of pull requests, commits, and issues ingested via connected source integrations (typically the Customer's employees and contractors). The Services are not designed for Processing of end-user / consumer data of the Customer's product.
Categories of Personal Data. Names, email addresses, profile images, and authentication identifiers; author names, usernames, and email addresses present in code, PR, and issue metadata; free-text content of PR descriptions, issue titles and descriptions, and commit messages, which may incidentally contain Personal Data; content of legal documents, which may incidentally contain Personal Data; IP addresses and technical request metadata in operational logs.
Special categories. None, unless the Customer submits such data at its own risk.
Lawcel implements the following measures, reviewed at least annually:
The list of approved Sub-processors at the Effective Date is published at https://app.lawcel.com/legal/lawcel/sub-processor-list and incorporated by reference.
For transfers of Personal Data from the EEA (or the UK) to a third country not covered by an adequacy decision, the parties incorporate by reference the SCCs approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (Controller to Processor), with the following specifications:
For UK transfers, the UK International Data Transfer Addendum to the EU Commission SCCs, Version B1.0, is incorporated by reference and completed in line with the above.