Data Processing Agreement (DPA)

Article 1. Parties and scope

1.1. This Data Processing Addendum (“DPA”) governs the processing of personal data by Festina Technology d.o.o. za informatičke usluge (“Processor”) on behalf of a business customer, another organization or a natural person independently determining the purposes and essential means of the processing concerned (“Controller”) when using the European Lexandro.ai service (“Service” or “Platform”). The Controller’s identity is established from the agreement, order or acceptance record of an authorized person.

1.2. The DPA applies to the Platform’s European environment, including related contracted features and the Lexandro add-in for Microsoft Word where its content is processed in that environment. It applies whether the Service is contracted directly or purchased or made available through Microsoft Marketplace. It does not apply to separate deployments intended for processing in other geographical areas; these require an appropriate separate contractual framework.

1.3. “Main Agreement” means the agreement, order and other validly agreed terms governing provision of the Service. For directly contracted Services, this DPA forms an integral part thereof. Article 16 applies to Services purchased through Microsoft Marketplace.

1.4. The DPA governs only activities in which the Processor processes personal data on behalf of the Controller. Processing for which Festina independently determines the purposes and essential means — for example, its own accounting, billing and management of contractual relationships — is governed by its Privacy Policy and applicable law. The allocation of roles is determined by the actual processing, not merely by the designation in a document.

1.5. If the contractual customer is itself a processor for another controller, Festina acts as a further processor in relation to those data. The contractual customer confirms that it has the necessary authorization to engage Festina and issue instructions covered by this DPA. Provisions concerning the Controller apply to that customer within the scope of its powers and obligations towards the original controller.

Article 2. Definitions

2.1. Terms defined in Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), have the same meaning in this DPA.

2.2. “Customer Content” includes documents, parts thereof, queries, instructions, conversations, workspaces, knowledge base data and outputs processed by the Controller or its authorized persons through the Service, to the extent they contain personal data.

2.3. “Documented Instructions” include this DPA, agreed settings and features, instructions from an authorized person of the Controller recorded in the Platform, and other verifiable written or electronic instructions from the Controller.

2.4. “Subprocessor” means a separate person entrusted by the Processor with processing personal data on behalf of the Controller. “European environment” means the configuration described in Article 8 and Annex 3.

2.5. The “EU/EFTA area” comprises the Member States of the European Union and Iceland, Liechtenstein, Norway and Switzerland. This agreed geographical scope does not mean that all these countries belong to the European Union or the European Economic Area, nor does it exclude the application of international transfer rules where applicable.

Article 3. Subject matter, purpose and duration of processing

3.1. The Processor processes personal data to provide the Service used by the Controller: receipt and storage of Customer Content, document search and analysis, query processing, generation of results, translation where enabled, workspace and permission management, support, security, backup, recovery, return and deletion.

3.2. The types of data, categories of data subjects and processing operations are set out in Annex 1. The Controller determines the specific matters, purposes and content it inputs and, within the contracted features, the permissions of its users.

3.3. Processing continues for the duration of the Service. After termination, it continues only as necessary for return or deletion under Article 12 or for retention required by Union or Member State law.

3.4. Customer Content is retained in accordance with the organization’s Documented Instructions for the period necessary to manage its matters and comply with applicable retention obligations. Content is not automatically deleted merely because three years have elapsed. The Controller determines appropriate retention periods for its matters and instructs deletion when retention is no longer necessary.

Article 4. Documented Instructions and prohibited purposes

4.1. The Processor processes personal data only in accordance with the Controller’s Documented Instructions, including instructions on the permitted geographical scope of processing and transfers to third countries.

4.2. If different processing is required by Union or Member State law to which the Processor is subject, the Processor will inform the Controller before such processing, unless that law prohibits such information on important grounds of public interest.

4.3. If the Processor considers that an instruction infringes the GDPR or other applicable data protection law, it will immediately inform the Controller. Pending clarification, it may suspend execution of the disputed instruction to the extent necessary.

4.4. The Processor will not use Customer Content, queries, outputs or logs revealing their content for advertising, data sales, development of separate user profiles, or training, fine-tuning or general improvement of AI models belonging to Festina or third parties. It will not instruct or permit a subprocessor to make such use. Processing necessary to perform an individual user task does not constitute permission to train models.

Article 5. Obligations of the Controller

5.1. The Controller is responsible for the lawfulness of the purposes it determines, an appropriate legal basis, informing data subjects, lawful input of data, appropriate retention periods and the instructions it gives to the Processor.

5.2. The Controller determines the persons authorized to access data, their roles and the scope of access. It ensures that the person instructing deletion of the entire organizational environment or accepting this DPA has the necessary authority.

5.3. If it intends to process special categories of data or data relating to criminal convictions and offences, the Controller determines the applicable additional legal requirements and assesses the risks and suitability of the contracted Service. This does not relieve the Processor of its security obligations or its obligation to assist the Controller.

Article 6. Confidentiality

6.1. The Processor ensures that persons authorized to process data are bound by contractual or statutory confidentiality obligations and access data only to the extent necessary for their assigned work.

6.2. Personnel access for support, maintenance or security is limited by assigned permissions and appropriately recorded. The confidentiality obligation continues after the relationship with the authorized person ends.

Article 7. Subprocessors and objections

7.1. The Controller grants general written authorization to engage the direct subprocessors listed in Annex 3 within the scope specified there. New engagements are subject to this Article.

7.2. Before entrusting processing to a subprocessor, the Processor contractually imposes the same data protection obligations as those established in this DPA for the entrusted processing, including sufficient technical and organizational safeguards. The Processor remains responsible to the Controller for the subprocessor’s performance of those obligations.

7.3. The Processor informs the Controller of any planned addition or replacement of a direct subprocessor at least 30 days before that subprocessor begins processing its data. The notice contains the identity, role, data to be accessed, relevant locations and date of the change. It is delivered to the administrative contact by email or by a verifiable notice in the Platform; merely changing the list without such notice is insufficient.

7.4. The Controller may submit a reasoned data protection objection within 20 days of the notice. It need not prove that a breach has already occurred. The Processor will consider the objection and propose a safeguard, exclusion of the affected feature or a reasonable alternative.

7.5. A timely objection is resolved before the new direct subprocessor begins processing that Controller’s data. If no solution is possible, the Controller may terminate the affected part of the Service before such processing. Billing and possible refunds are governed by the agreement applicable to the purchasing channel; this paragraph does not itself change Marketplace billing or refund rules.

7.6. The Processor maintains an up-to-date record of further subprocessors in the chain and makes their identities, roles and relevant processing locations available to the Controller. It informs the Controller of an announced addition or replacement of a further subprocessor involved in processing the Controller’s data without undue delay after learning of the change, providing information and an opportunity for effective objection before the affected processing. If a timely objection cannot be resolved, the Processor takes an appropriate safeguard, suspends the affected feature or offers a lawful alternative.

7.7. An exceptionally necessary urgent replacement due to an immediate security threat or binding legal requirement may take place without the regular notice period in paragraph 7.3, within the authorization in this Article, with notice as soon as possible and a subsequent opportunity to object. Urgency does not remove the obligations in Articles 8 and 9.

7.8. A change in the name, version or technical configuration of an AI model, software component or infrastructure within an already approved subprocessor is not in itself considered the addition or replacement of a subprocessor and is not subject to the periods in paragraphs 7.3 and 7.4, provided it does not involve a new person processing data, a new purpose, an extension of the agreed categories of data or recipients, longer agreed retention periods, processing outside the permitted geographical scope or a material reduction in protection. The fact that a model is available through Microsoft Azure is not itself proof that the subprocessor has not changed.

7.9. If a change under paragraph 7.8 nevertheless involves a new subprocessor, the procedure in this Article applies. If it constitutes another material change to the processing terms, Article 17.1 applies. Technical changes must not be used to circumvent agreed safeguards or the Controller’s rights.

Article 8. European environment, AI and translation

8.1. Primary storage of Customer Content in the European environment is located in the Microsoft Azure Sweden Central region. Replicas and backups of that content are located in regions within the EU/EFTA area. The Processor will not independently move storage or replicas outside that area.

8.2. AI models used by the Processor to process Customer Content are provided through contracted Microsoft Azure business services. Inference for the European environment uses the EU Data Zone within Microsoft’s EU Data Boundary, covering the EU/EFTA area, or another configuration that actually restricts inference to that area and provides at least equivalent geographical protection. Global Standard and other global processing modes permitting inference outside the EU/EFTA area are not permitted for this environment. Unavailability of a model in the permitted zone does not entitle the Processor to switch automatically to global processing.

8.3. The Processor may change an individual AI model without updating a list of models in this DPA if the permitted purpose, agreed geographical scope and relevant safeguards remain unchanged and the conditions in Articles 7.8 and 7.9 are met. This DPA does not require each model to be identified by its commercial name.

8.4. For translation of Customer Content through DeepL, the Processor uses a contracted business configuration in which personal data included in the translation are processed within the European Union. The Processor ensures that the agreed EU restriction also covers further subprocessors and access involved in that processing. DeepL receives the content necessary for the translation requested by the Controller or its authorized user, subject to the prohibition in Article 4.4.

8.5. The geographical scope provisions cover processing organized by the Processor through its systems and subprocessors, subject to the access and transfer rules in Article 9. The mere fact that an authorized person of the Controller accesses the Platform from another country does not change the location of Azure storage and inference. The Controller and Processor separately assess the legal implications of such access according to the person’s actual role and the manner in which data are made available.

Article 9. Access and international transfers

9.1. The Processor does not give a subprocessor access to personal data of the European environment from outside the EU/EFTA area or organize their processing outside that area as a regular means of providing the Service. The restriction is verified separately for storage, AI inference, translation, email, support, logs, backups and further subprocessors. The narrower EU scope in Article 8.4 continues to apply to DeepL.

9.2. Agreed processing within the EU/EFTA area includes a documented instruction to use approved locations in Switzerland where applicable to an approved subprocessor. Transfers of personal data from the European Economic Area to Switzerland take place on the basis of the applicable European Commission adequacy decision under Article 45 GDPR. If that basis ceases to apply to a particular transfer, before continuing it the Processor ensures another valid Chapter V GDPR mechanism and necessary supplementary measures or suspends the affected transfer. EFTA membership alone is not a substitute for a legal basis for transfer.

9.3. If a particular situation requires making data available to a separate recipient outside the EU/EFTA area, the Processor will not regard that action as pre-authorized by this DPA. Before processing, it is necessary to identify the recipient, data, location, purpose and scope of access, obtain appropriate Documented Instructions from the Controller and, where this constitutes a transfer under the GDPR, ensure an applicable Chapter V mechanism and necessary supplementary measures. If this is incompatible with the agreed European service, the affected processing will not take place. This does not exclude Article 4.2.

9.4. This DPA is not itself a set of standard contractual clauses for international transfers. Where such an instrument is required for a permitted transfer, the appropriate transfer parties ensure that it is validly agreed before the transfer begins.

9.5. The Processor will provide the Controller with information reasonably available to it about actual access and transfers relevant to its processing, including information on applicable safeguards. Access requests under third-country law are handled in accordance with applicable law and agreed safeguards.

9.6. A general exception for international transfers or remote access in a subprocessor’s standard terms does not itself constitute the Controller’s Documented Instructions or extend the geographical scope agreed in this DPA.

Article 10. Security of processing

10.1. The Processor implements risk-appropriate measures, at least to the extent set out in Annex 2, and periodically verifies their effectiveness. In assessing risk, it takes account of the fact that documents may contain confidential information, special categories of data and data from proceedings.

10.2. The Processor may replace an individual control with an equivalent or more effective one but must not materially reduce the overall level of protection or circumvent the geographical restrictions in Articles 8 and 9.

10.3. The Controller manages its users’ permissions to the extent made available by the Platform. This does not diminish the Processor’s obligation to protect the systems it manages.

Article 11. Personal data breaches and assistance to the Controller

11.1. The Processor notifies the Controller without undue delay and at the latest within 24 hours after becoming aware of a personal data breach affecting data processed on its behalf. The period runs irrespective of working days or business hours. The Processor does not wait for completion of the entire investigation before sending the initial notification.

11.2. The initial notification includes information then available to the Processor: the nature of the breach, affected types of data and groups of persons, approximate scope, possible consequences, measures taken or proposed and a contact for further communication. The Processor supplies missing information in stages without further undue delay. Incomplete initial information does not delay the notification under paragraph 11.1.

11.3. The Processor takes measures to contain and remedy the breach, preserves relevant evidence and assists the Controller in assessing its duty to notify the supervisory authority and inform data subjects.

11.4. Taking account of the nature of processing and the information available to it, the Processor assists the Controller through appropriate measures with data subject requests, security of processing, data protection impact assessments and prior consultation. It forwards any data subject request received in connection with processing on behalf of the Controller to the Controller without undue delay, unless prohibited by law.

11.5. Breach notifications are sent to the Controller’s security contact or, if none is designated, its administrative contact. The Processor agrees subprocessor notification obligations in a manner enabling it to fulfil its own obligations under this Article.

Article 12. Return, export and deletion

12.1. During the contractual relationship, the Controller may, in accordance with its Documented Instructions, request deletion of a particular user, matter or content or, through an appropriately authorized representative, the entire organizational environment. The Processor verifies the scope and the requester’s authority so that one user cannot delete the entire organization’s data without authorization.

12.2. Following a valid deletion request during the Service, the Processor deletes the affected data from active systems without undue delay, normally within 14 days and at the latest 30 days after confirmation of scope and authority, unless Union or Member State law requires retention. It verifies scope and authority without undue delay. It informs the Controller in advance of a justified need for more than 14 days.

12.3. Upon termination of the Service, the Controller chooses return or deletion of the personal data processed on its behalf. The Processor enables submission of that instruction and reasonable return of the data, including stored documents and other stored personal data covered by the Service, in an available structured and commonly usable format. Return takes place through an available Platform feature or another effective and secure procedure.

12.4. Unless the Controller requests earlier deletion, the period for requesting return lasts up to 30 days after termination of the Service. At its expiry, the Processor deletes the data from active systems. If the Controller requests earlier deletion, the Processor does so without undue delay; in any event, regular active storage after termination does not exceed those 30 days, unless otherwise validly agreed or Union or Member State law requires retention. Choosing return does not confer a right to retain copies beyond the periods and exceptions in this Article.

12.5. Data in backups remain protected, are unavailable for regular use and are removed according to the documented backup cycle, at the latest within 30 days after deletion of the corresponding data from active systems, unless Union or Member State law requires retention. If a backup is restored before that period expires, previously deleted data are deleted again before regular use of the restored environment. Restoring a backup does not extend that final deadline. On request, the Processor confirms completion of deletion, identifying any permitted statutory exceptions.

12.6. Technical and security logs are not automatically retained for as long as Customer Content. Their categories, the roles of processing participants and retention periods are governed according to their actual purpose, the separate Privacy Policy where Festina acts as controller and documented retention rules where it acts as processor, subject to the deletion obligations in this Article. Full Customer Content must not be recorded in diagnostic logs without a necessary and protected reason.

Article 13. Demonstrating compliance and audits

13.1. The Processor makes available to the Controller information necessary to demonstrate compliance with Article 28 GDPR and allows and contributes to audits and inspections conducted by the Controller or its authorized auditor.

13.2. Verification normally begins with appropriate control documentation, available reports, responses to security questions and relevant audit records. The Processor may provide available Microsoft audit records and other Microsoft evidence insofar as it can actually access and is permitted to share them, while protecting other users and system security. It does not guarantee unrestricted access to Microsoft infrastructure.

13.3. If the above is insufficient, the parties coordinate additional verification within a reasonable scope, with appropriate notice, confidentiality and protection of other users. Lack of agreement on logistics must not prevent an effective audit. A reasonable suspicion of a breach, a significant change in risk or a supervisory authority’s request justifies more urgent verification.

13.4. The Controller bears its own audit costs, and the Processor’s reasonable additional costs are communicated in advance, unless the audit identifies a significant breach of its obligations. A cost dispute must not prevent urgent verification required by law.

Article 14. Liability

14.1. Each party is liable for its statutory and contractual obligations. The Controller’s responsibility for the lawfulness of its instructions does not relieve the Processor of liability for its independent obligations or the performance of subprocessors’ obligations.

14.2. Contractual claims between the parties are subject to the liability rules in the agreement applicable to the relevant purchasing channel, insofar as mandatory law permits. This DPA does not restrict data subjects’ rights or the powers of the supervisory authority.

Article 15. Relationship with other documents

15.1. For directly contracted Services, this DPA prevails over the General Terms and other general rules of use of the Service in matters concerning personal data processing performed by the Processor on behalf of the Controller. The Main Agreement governs other matters.

15.2. If a separate signed security addendum provides greater protection, it applies to that extent. No provision of another document is interpreted as removing the mandatory content of a processing agreement under the GDPR.

15.3. For Marketplace offers, Article 16 governs the relationship between this DPA and the agreement for the particular offer. Annexes 1, 2 and 3 form an integral part of this DPA.

Article 16. Microsoft Marketplace and electronic acceptance

16.1. This DPA covers processing performed by Festina on behalf of the Controller when using Lexandro.ai through Microsoft Marketplace, including the related Microsoft Word add-in. Purchase, price, renewal, cancellation, refunds and other commercial matters remain governed by the agreement and order applicable to the particular offer.

16.2. If the offer is based on the Microsoft Marketplace Standard Contract and supports amendments thereto, this DPA is incorporated into the agreement through a validly accepted universal or specific amendment identifying the DPA’s title and version and including its annexes. The Processor ensures that the complete available DPA text is identical to the identified version and that the Controller’s authorized person can review and store it before acceptance. Reference to the DPA does not confer a right to subsequent unilateral material amendment.

16.3. If this DPA has not been validly incorporated into the Marketplace agreement for a particular offer, the Processor obtains separate electronic acceptance or signature from an authorized representative of the Controller before permitting processing of its Customer Content. The same applies to the Microsoft Word add-in when its installation or download does not include valid agreement to the DPA. Mere installation, download or sign-in by an individual end user is not a substitute for that acceptance.

16.4. A person accepting the DPA on behalf of an organization confirms their authority. The Processor records the organization’s identity, the accepting user’s account, their role, the time and method of acceptance, and the version of the DPA and annexes. It enables download or other durable storage of the accepted copy and retains evidence of acceptance.

16.5. Subsequent confirmations by other users are recorded as their acknowledgements of the usage rules, not as separate contracts changing the organization’s instructions. If this DPA has already been validly agreed for the same organization and European environment, use of the related Microsoft Word add-in does not require another DPA solely because the access interface changes.

16.6. When validly agreed under this Article, this DPA prevails in the event of conflict solely in matters of agreed instructions, protection and processing of personal data processed by Festina on behalf of the Controller. It does not replace the commercial terms of the Marketplace offer or itself change the agreed liability rules in Article 14.2, except insofar as mandatory law requires otherwise.

16.7. This DPA governs the relationship between Festina and the Controller. Incorporating it into a Marketplace offer does not make Microsoft a party to this DPA or change the agreements the Controller separately enters into with Microsoft. Microsoft’s role as Festina’s subprocessor for contracted Azure services is governed by Article 7 and Annex 3.

Article 17. Amendments, law and contact

17.1. The Processor retains previous DPA versions and a record of the version applicable to each Controller. It does not apply a material amendment to an existing Controller merely because it has published new text, including an extension of the agreed geographical scope, a change in processing purpose or a material reduction in protection. It obtains a valid contractual basis for the amendment; Article 7 also applies to changes of subprocessors.

17.2. This DPA is governed by the law of the Republic of Croatia and directly applicable EU law. Contractual disputes between business parties are subject to the jurisdiction determined by their applicable agreement, with the protection required by mandatory rules. This does not restrict data subjects’ rights.

17.3. Instructions and enquiries concerning this DPA are sent to privacy@lexandro.ai, unless a separate monitored security contact was communicated to the Controller when contracting. The Controller keeps its administrative and security contacts up to date.

ANNEX 1. DESCRIPTION OF PROCESSING

Subject matter: provision of the contracted European Lexandro.ai service, including related features and the Microsoft Word add-in within the scope of this DPA.

Duration: during provision of the Service and after termination solely for return, deletion and legally required retention under Article 12.

Nature of operations: receipt, organization, storage, search, retrieval, analysis, comparison, display, translation where enabled, generation of outputs, backup, return and deletion.

Purposes: performing operations requested by the Controller through the Platform, access and workspace management, contracted support, and security and continuity of the Service. General model training is not a processing purpose.

Types of data: identification and contact details; user account and permission data; data in documents, queries, conversations, matters, workspaces and stored results; technical and security data insofar as processed on behalf of the Controller. Depending on the content input by the Controller, special categories of personal data and data relating to criminal convictions and offences may be included.

Categories of data subjects: authorized users; employees and candidates; clients, parties, witnesses, representatives and other participants in proceedings; business partners and other persons whose data appear in materials lawfully processed by the Controller.

Frequency: storage according to the Controller’s instructions; individual analyses, queries and translations when the corresponding feature is initiated.

Locations: primary storage in the Azure Sweden Central region; processing, replicas and backups within the permitted EU/EFTA area; DeepL translation within the European Union, subject to the detailed rules in Articles 8 and 9.

ANNEX 2. MINIMUM SECURITY MEASURES

The Processor applies the following controls to the European environment:

Organizational separation: logical separation of organizations’ data and authorization checks when accessing data.

Access control: access according to roles and the principle of least privilege, including intra-organization access control and the granting, modification and revocation of privileged access.

Protection in transit and at rest: cryptographic protection of data in transit and at rest appropriate to the contracted infrastructure; protection of credentials and secrets.

Administrative access: individual administrative accounts, enhanced authentication for privileged access and review of those permissions.

Logging: recording security-relevant administrative access, permission changes and incidents while restricting log access and minimizing content recorded in logs.

Continuity: protected backups, restricted access to them, a recovery procedure and periodic recovery testing; removal of deleted data from backups within the period in Article 12.5.

Secure development: change control, vulnerability and security patch management, and restrictions on the use of actual user data in testing.

Personnel and suppliers: confidentiality obligations, appropriate training, supplier assessment and a documented incident management procedure, including notification of the Controller within the period in Article 11.1.

Review: periodic review of the effectiveness of controls and their adaptation to risks.

A more detailed technical description may be provided to the Controller in a controlled manner without disclosing information that would jeopardize other users’ security.

ANNEX 3. SUBPROCESSORS AND PERMITTED SCOPE

Microsoft Ireland Operations Limited

Purpose: Azure infrastructure, storage, related business services and Azure AI.

Data covered: Customer Content and other personal data to the extent necessary for the contracted infrastructure, processing, security and support.

Permitted scope: primary storage in the Sweden Central region; replicas and backups within the EU/EFTA area; AI inference in the EU Data Zone or another permitted configuration under Article 8.2. Further subprocessors, access and transfers are subject to Articles 7–9.

DeepL — the legal entity under the agreement with Festina

Purpose: translation of content selected by the Controller or its authorized user.

Data covered: personal data contained in material submitted for translation and data necessary to perform that task.

Permitted scope: a contracted business configuration processing translation data within the European Union in accordance with Article 8.4. The prohibition on using Customer Content for training and general improvement of AI models applies.

Identity of the contracting entity: the full legal name and registered office of the DeepL entity with which Festina has contracted are stated in the subprocessor register available to the Controller before acceptance of this DPA. That register supplements this annex and is stored with the accepted version.

The Processor keeps up-to-date identities, roles and relevant locations of further subprocessors involved in the Controller’s processing available to the Controller. Changes are made in accordance with Article 7.