Last updated May 8, 2026
Lawcel Version 2.0 Effective Date: 8 May 2026
Lawcel (Vesterbrogade 52a, 3250 Gilleleje, Denmark) uses the third parties listed below to process Personal Data on behalf of customers in connection with the Lawcel platform. This list forms part of our Data Processing Agreement (DPA) and constitutes the customer's prior general written authorisation under Article 28(2) GDPR.
Lawcel remains fully liable to customers for the acts and omissions of each sub-processor under Article 28(4) GDPR. Effective from 8 May 2026.
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Anthropic, PBC | LLM reasoning for compliance analysis, document generation, and IDE-integration AI features | PR/issue metadata, code diffs, commit messages, legal document text, legal profile, IDE chat history | United States |
| Hetzner Online GmbH | Application, database, and storage hosting | All platform data at rest | Germany (EU) |
| Resend, Inc. | Transactional email (magic-link sign-in, team invites) | Recipient email addresses, verification tokens, message content and delivery metadata | United States |
Provider notes. Anthropic is engaged under its Commercial Terms and DPA; customer content submitted under the paid API tier is not used to train Anthropic's general models, subject to Anthropic's published terms. Hetzner provides bare infrastructure with no logical access to the application or database; Lawcel applies application-layer encryption. Resend processes only the email envelope and message content needed to deliver transactional mail.
We notify customers of any new or replacing sub-processor at least 30 calendar days before processing begins, by:
A customer may object on reasonable data-protection grounds within 14 calendar days of notification by writing to privacy@lawcel.com. If the parties cannot resolve the objection within a further 30 days, the customer may terminate the affected portion of the Service without penalty and receive a pro-rata refund for the unused term, as set out in the DPA.
Make sure your privacy contact in organisation settings is current to receive these notifications.
Anthropic and Resend are established in the United States. Transfers to them rely on the EU Standard Contractual Clauses (Module Two, Commission Decision 2021/914), incorporated in our DPA and the relevant sub-processor agreements. For UK transfers, the UK International Data Transfer Addendum applies in addition.
Lawcel has conducted a Transfer Impact Assessment for each US sub-processor in line with the Schrems II ruling (Case C-311/18) and EDPB Recommendations 01/2020, and concluded — taking into account the volume and category of data transferred and the technical and contractual safeguards applied — that the level of protection is essentially equivalent to that within the EEA. We will reassess if the legal landscape changes materially.
Before engaging a sub-processor we review its public security and privacy posture, confirm it will accept Article 28(4) GDPR-equivalent contract terms, assess the geographic location and required transfer mechanism, and document the processing purpose and data categories. Sub-processor relationships are reviewed periodically and on material change.
privacy@lawcel.com — questions, change-notification subscriptions, sub-processor objections.
See also the Data Processing Agreement and Privacy Policy.