Data Processing Agreement

Created: 22 December, 2021
Updated: 28, March 2023

Between the Customer and Legacy App ApS (“Legacy”) (together with the Customer, the "Parties” and separately a “Party") 

1 Scope of the Agreement

1.1 This Agreement reflects the Parties' agreement with regard to the processing of personal data.

1.2 Legacy acts as a data processor for the Customer, as Legacy processes personal data for the Customer as set out in Annex 1.

1.3 The personal data to be processed by Legacy concerns the categories of data, the categories of data subjects and the purposes of the processing set out in Annex 1.

1.4 "Personal data" means any information relating to an identified or identifiable natural person, see article 4(1) of Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation "GDPR"). If other confidential information than personal data is processed for the purpose of fulfilling the Agreement, e.g. information considered confidential according to the Financial Business Act, any reference to "personal data" shall include the other confidential information. Sensitive Data and Special Category Data will not be processed pursuant to this DPA and the Customer warrants and represents that the Customer will not be sharing, disclosing or otherwise transferring such data to Legacy. 

2 Processing of Personal Data

2.1 Instructions: Legacy is instructed to process the personal data only for the purposes of providing the data processing services set out in Annex 1. Legacy may not process or use the Customer's personal data for any other purpose than provided in the instructions, including the transfer of personal data to any third country or an international organisation, unless Legacy is required to do so according to Union or member state law. In that case, Legacy shall inform the Customer in writing of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

2.2 If the Customer in the instructions in Annex 1 or otherwise has given permission to a transfer of personal data to a third country or to international organisations, Legacy must ensure that there is a legal basis for the transfer, e.g. the EU Commission's Standard Contractual Clauses for the transfer of personal data to third countries.

2.3 If Legacy considers an instruction from the Customer to be in violation of the GDPR, or other Union or member state data protection provisions, shall immediately inform the Customer in writing about this.

2.4 If Legacy is subject to legislation of a third country, Legacy declares not to be aware of the mentioned legislation preventing Legacy from fulfilling the Agreement. Legacy will notify the Customer in writing without undue delay, if Legacy becomes aware of such hindrance.

3  Legacy' general obligations

3.1 Legacy must ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.2 Legacy shall implement appropriate technical and organisational measures to prevent that the personal data processed is
(i) accidentally or unlawfully destroyed, lost or altered,
(ii) disclosed or made available without authorisation, or
(iii) otherwise processed in violation of applicable laws, including the GDPR.

3.3 Legacy must also comply with any special data security requirements that apply to the Customer, e.g as potentially outlined in Annex 1 or as otherwise required by the Customer, and with any other applicable data security requirements that are directly incumbent on Legacy; including the data security requirements in the country of establishment of Legacy or in the country where the data processing will be performed.

3.4 The appropriate technical and organisational security measures must be determined with due regard for
(i) the current state of the art,
(ii) the cost of their implementation, and
(iii) the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

3.5 Legacy shall upon request provide the Customer with sufficient information to enable the Customer to ensure that Legacy complies with its obligations under the Agreement, including ensuring that the appropriate technical and organisational security measures have been implemented.

3.6 Legacy must give authorities who by Union or member state law have a right to enter the Customer's or the Customer's supplier's facilities, or representatives of the authorities, access to Legacy's physical facilities against proper proof of identity.

3.7 Legacy must without undue delay after becoming aware of the facts in writing notify the Customer about:
(i) any request for disclosure of personal data processed under the Agreement by authorities, unless expressly prohibited under Union or member state law,
(ii) any suspicion or finding of (a) breach of security that results in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed by Legacy under the Agreement, or (b) other material failure to comply with Legacy's obligations under Clause 3.2 and 3.3 in this Agreement.

3.8 Legacy must promptly assist the Customer with the handling of any requests from data subjects under Chapter III of the GDPR, including requests for access, rectification, restriction or deletion. Legacy must also assist the Customer by implementing appropriate technical and organisational measures, for the fulfilment of the Customer's obligation to respond to such requests.

3.9 Legacy must assist the Customer with meeting the other obligations that may be incumbent on the Customer according to Union or member state data protection law where the assistance of Legacy is implied, and where the assistance of Legacy is necessary for the Customer to comply with its obligations. This includes, but is not limited to, at request to provide the Customer with all necessary information about an incident under Clause 3.7 (ii), and all necessary information for an impact assessment in accordance with article 35 and 36 of the GDPR.

3.10 Any services from Legacy as set out in Annex 4 or clause 3.6 and 3.8 to 3.9 are billable and will be charged in accordance with the price list made available to the Customer upon concluding this Agreement.

3.11 In Annex 1, Legacy has stated thel location of the processing used to provide the data processing services. Legacy undertakes to inform the Customer about any changes to the location by providing a prior written notice of 30 days to the Customer. This does not require a formal amendment of Annex 1, but Legacy must give prior written notice by mail or email.

4 Sub-data processors

4.1 Legacy may engage a sub-data processor. At the time of the Agreement, Legacy uses the sub-data processors set out in Annex 2. Legacy undertakes to inform the Customer of any intended changes concerning the addition or replacement of a sub-data processor by providing 30 days prior written notice to the Customer. The Customer may object to the use of a sub-data processor if such objection is relevant and reasoned in regards to data protection issues. If the objection is relevant and reasoned, Legacy may suggest a new sub-data processor in order for the Customer to accept that one or give the Customer the right to cancel the Agreement (at Legacy’ sole discretion). For avoidance of doubt, the discontinuance of sub-data processors do not require written notices to the Customer.  

4.2 Prior to the engagement of a sub-data processor, Legacy shall conclude a written agreement with the sub-data processor, in which at least the same data protection obligations as set out in the Agreement shall be imposed on the sub-data processor, including an obligation to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR.

4.3 The Customer has the right to receive a copy of Legacy's agreement with the sub-data processor as regards the provisions related to data protection obligations. Legacy shall remain fully liable to the Customer for the performance of the sub-data processor's obligations.

5 Confidentiality

5.1 Legacy shall keep personal data confidential pursuant to the signed subscription service agreement in place between the parties.

6 Amendments and Assignments

6.1 The Parties may at any time agree to amend this Agreement. Amendments must be in writing and the Customer accepts that notifications about such amendments can be made via email or via the Customer’s Legacy account.

6.2 Neither party may assign this Agreement without the prior written consent of the other party. Notwithstanding the foregoing, both parties may assign their rights and obligations under this Agreement in connection with a consolidation, merger, acquisition or sale of substantially all of its assets, shares or activities without the prior written consent of the other party.

7 Term and termination of the Agreement

7.1 The Agreement enters into force on the Effective Date and remains in force until terminated by one of the Parties.

7.2 Each party may terminate the Agreement upon 30 days written notice.

7.3 Regardless of the terms of the Agreement, the Agreement shall be in force as long as Legacy processes the personal data, for which the Customer is data controller.

7.4 On termination of the Agreement Legacy shall on the Customer's request immediately delete all personal data, which Legacy is processing for the Customer, unless Union or member state data protection law requires storage of the personal data.

8 Priority

8.1 If any of the provisions of the Agreement conflicts with the provisions of any other written or oral agreement concluded between the Parties, then the provisions of the Agreement shall prevail. However, the requirements in Clause 3 do not apply to the extent that the Parties in another agreement have set out stricter obligations for Legacy. Furthermore, the Agreement shall not apply if and to the extent the EU Commission's Standard Contractual Clauses for the transfer of personal data to third countries are concluded and such clauses set out stricter obligations for Legacy and/or for sup-suppliers.

8.2 This Agreement does not determine the Customer's remuneration of Legacy for Legacy's services according to the service subscription agreement.

ANNEX 1: Processing Activities

This Annex constitutes the Customer's instruction to Legacy in connection with Legacy' data processing for the Customer, and is an integrated part of the Agreement.





Location of Processing



Names, phone numbers, email addresses, mailing addresses, job titles, usernames, passwords, contact preferences, contact or authentication data, billing addresses, debit/credit card numbers, Internet Protocol (IP) address, browser and device characteristics, Location data.

Users of the Legacy App

For purposes based on legitimate business interests, the fulfillment of our contract with you, compliance with our legal obligations, and/or your consent.


ANNEX 2: List of sub-data processors

List of sub-data processors, with the location of the sub-data processor and a description of the processing: 

Full Company Name

Address (street, no, city, country)

Name of service / tool

Description of service


Location of processing

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4 Ireland

Google Workspace (GSuite)

Collection of cloud computing, productivity and collaboration tools.

Legacy uses Google Workspace to engage in email conversations, and store documents pertaining to the business relationships, with our customers.


Google Ireland Limited

Gordon House, Barrow Street, Dublin 4 Ireland

Google Cloud Platform

cloud computing service

Legacy uses Google Cloud Platform to host our platform and store our customer's data safely within EU.

Customer choice of location

ANNEX 3: Security setup

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity of the rights and freedoms of natural persons, the Legacy has implemented the appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in particular the risk of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed.

1. Access Control
(i)  Preventing Unauthorised Product AccessOutsourced processing: We host our Service with outsourced cloud infrastructure providers. Additionally, we maintain contractual relationships with vendors in order to provide the Service in accordance with our DPA. We rely on contractual agreements, privacy policies, and vendor compliance programs in order to protect data processed or stored by these vendors.Physical and environmental security: We host our product infrastructure with multi-tenant, outsourced infrastructure providers. We do not own or maintain hardware located at the outsourced infrastructure providers’ data centers. Production servers and client-facing applications are logically and physically secured from our internal corporate information systems.Authentication: We implement a uniform password policy for our customer products. Customers who interact with the products via the user interface must authenticate before accessing non-public customer data.Authorization: Customer Data is stored in multi-tenant storage systems accessible to Customers via only application user interfaces and application programming interfaces. Customers are not allowed direct access to the underlying application infrastructure. The authorization model in each of our products is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customization options. Authorization to data sets is performed through validating the user’s permissions against the attributes associated with each data set.Application Programming Interface (API) access: Public product APIs may be accessed using an API key.
(ii)  Preventing Unauthorized Product UseWe implement industry standard access controls and detection capabilities for the internal networks that support its products.Access controls: Network access control mechanisms are designed to prevent network traffic using unauthorized protocols from reaching the product infrastructure. The technical measures implemented differ between infrastructure  providers and include Virtual Private Cloud (VPC) implementations, security group assignment, and traditional firewall rules.Static code analysis: Code stored in our source code repositories  is checked for best practices and identifiable software flaws using automated tooling.
(iii)    Limitations of Privilege & Authorization RequirementsProduct access: A subset of our employees have access to the products and to customer data via controlled interfaces. The intent of providing access to a subset of employees is to provide effective customer support, product development and research, to troubleshoot potential problems, to detect and respond to security incidents and implement data security. Employees are granted access by role, and reviews of high risk privilege grants are initiated with regular intervals.

2. Transmission Control
In-transit: We require HTTPS encryption (also referred to as SSL or TLS) on  all pages of our product as well as our Product APIAt-rest: We store user passwords following policies that follow industry standard practices for security.  We have implemented technologies to ensure that stored data is encrypted at rest. 

3. Input Control
Detection: We designed our infrastructure to log extensive information about the system behavior, traffic received, system authentication, and other application requests. Internal systems aggregate log data and alert appropriate employees of malicious, unintended, or anomalous activities. Our personnel, including security, operations, and support personnel, are responsive to known incidents.Response and tracking: We maintain a record of known security incidents that includes description, dates and times of relevant activities, and incident disposition. Suspected and confirmed security incidents are investigated by security, operations, or support personnel; and appropriate resolution steps are identified and documented. For any confirmed incidents, we will take appropriate steps to minimize product and Customer damage or unauthorized disclosure. Notification to you will be in accordance with the terms of the Agreement.

4. Availability Control
Fault tolerance: Backup and replication strategies are designed to ensure redundancy and fail-over protections during a significant processing failure.Disaster Recovery Plans: We maintain and regularly test disaster recovery plans to help ensure availability of information following interruption to, or failure of, critical business processes.Our products are designed to ensure redundancy and seamless failover. The server instances that support the products are also architected with a goal to prevent single points of failure. This design assists our operations in maintaining and updating the product applications and backend while limiting downtime.

ANNEX 4: Audits

Legacy accepts and agrees to the Customer being able to conduct audits in the manner chosen by the Customer. The audits may be conducted as written audits or as inspections at Legacy’s location. The Customer must give Legacy 30 days prior written notice of inspections at Legacy's location.

The Customer is entitled at its own cost to appoint an independent expert who shall have access to Legacy’s location and receive the necessary information in order to be able to audit whether Legacy complies with its obligations under the Agreement, including ensuring that the appropriate technical and organisational security measures have been implemented. The expert shall upon Legacy's request sign a customary non-disclosure agreement, and treat all information obtained or received from Legacy confidentially, and may only share the information with the Customer and Legacy.

Legacy shall cooperate with the Customer without undue delay and provide the Customer with requested signed declarations, statements and similar to verify the compliance with this DPA and GDPR. 

ANNEX 5: International transfers

Where a transfer of personal data occurs between Legacy and a sub-data processor located outside of the EEA, the transfer of personal data will include one of the following appropriate safeguards, as applicable:

(i) The adoption by the parties of the EU model clauses resulting from the EU Commission implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

(ii) Any other appropriate safeguards recognized by the European Data Protection Regulation 2016/679 such as an adequacy decision, an approved code of conduct or an appropriate certification mechanism.