LogicNodes Legal

Legal documentation and policies

EN | DA

Data Processing Agreement (DPA)

Between the Data Controller and LogicNodes ApS (Data Processor)

Data Processor: LogicNodes ApS
Effective Date: [DATE]
CVR (Processor): DK45318362

1. Definitions

1.1 Defined Terms

For purposes of this Data Processing Agreement (“DPA”):

“GDPR”

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

“Data Protection Laws”

All applicable laws and regulations relating to privacy and data protection, including the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the CCPA/CPRA, and other applicable laws.

“Personal Data”

Any information relating to an identified or identifiable natural person that is processed by LogicNodes on behalf of Partner in connection with the Services.

“Processing”

Any operation or set of operations performed on Personal Data, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.

“Data Subject”

The individual to whom Personal Data relates (Partner’s end-users).

“Services”

The LogicNodes embeddable AI agent platform with associated features and integrations.

“Sub-Processor”

Any third party engaged by LogicNodes to process Personal Data on behalf of Partner.

“Supervisory Authority”

An independent public authority established by an EU Member State pursuant to GDPR Article 51.

“Data Breach”

A personal data breach as defined in the GDPR: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

2. Scope & Roles

2.1 Relationship

This DPA governs the processing of Personal Data by LogicNodes (Data Processor) on behalf of Partner (Data Controller) in connection with the Services.

2.2 Applicability

This DPA applies to all Personal Data processed by LogicNodes on Partner’s behalf, including but not limited to:

2.3 Personal Data — Controller Responsibility

Voiceprints and Biometric Data: The platform offers optional speaker identification that uses biometric voice profiles (“voiceprints”) to identify speakers in audio recordings. Voiceprints constitute biometric data under GDPR Article 9(1) and are processed solely for the purpose of speaker identification. Each voiceprint is linked to a self-chosen name.

Any Personal Data: Partner may instruct LogicNodes to process any Personal Data through the platform, including Personal Data subject to heightened requirements under GDPR Articles 8, 9, and 10 or applicable national law. LogicNodes imposes no technical restriction on the categories of Personal Data Partner may introduce; it remains Partner’s sole responsibility to ensure that all applicable legal requirements are satisfied before instructing LogicNodes to process such data.

Partner Responsibility: Partner, as data controller, is solely responsible for ensuring a valid legal basis under the GDPR and all applicable national law for any Personal Data introduced into the Services, including compliance with any heightened requirements that apply to specific categories of data and compliance with GDPR Article 22 where Partner’s use of the Services involves automated decision-making. LogicNodes processes Personal Data solely as data processor on Partner’s documented instructions and does not verify the lawfulness of those instructions. LogicNodes does not implement GDPR Article 22 safeguards on Partner’s behalf. LogicNodes is not liable for Partner’s failure to comply with applicable law.

DPIA Obligation: Where Partner’s intended processing through the Services is likely to result in high risk to Data Subjects — including where it involves large-scale processing of special category data or national identification numbers — Partner is solely responsible for conducting a Data Protection Impact Assessment (DPIA) under GDPR Article 35 before commencing such processing. Where a DPIA reveals that prior consultation with a Supervisory Authority is required under GDPR Article 36, Partner must notify LogicNodes before commencing processing. The indemnity in §9.3 applies to claims arising from Partner’s failure to conduct a required DPIA.

2.4 EU-Only Data Processing

Partner may request EU-only data processing for their organisation by contacting kontakt@logicnodes.ai. When EU-only data processing is active, the following restrictions and guarantees apply:

The list of AI models available under EU-only data processing is kept up to date and reviewed on an ongoing basis.

3. Processing of Personal Data

3.1 Partner Instructions

LogicNodes shall process Personal Data only:

  1. On documented instructions from Partner (through the platform or written request to kontakt@logicnodes.ai)
  2. To the extent necessary to provide the Services
  3. As required by applicable law (with notice to the Data Controller if permitted by law)

Partner Instructions Include:

3.2 Unauthorized Processing

If LogicNodes has reason to believe a specific instruction conflicts with Data Protection Laws, LogicNodes will notify Partner promptly so it can be reviewed and clarified.

3.3 Processing Details

Subject Matter: Provision of AI agent automation platform

Duration: Term of the Terms & Conditions + retention period (as configured by Partner)

Nature & Purpose:

Type of Personal Data:

Categories of Data Subjects:

4. LogicNodes Obligations

4.1 Confidentiality

LogicNodes shall ensure that all personnel authorized to process Personal Data:

  1. Are subject to confidentiality obligations (employment contracts, NDAs)
  2. Have completed mandatory security awareness training and mandatory personal data and GDPR training before being granted access
  3. Access Personal Data only as necessary for their role

4.2 Security Measures

LogicNodes implements appropriate technical and organizational measures to protect Personal Data, including:

Technical Measures:

Organizational Measures:

Compliance (forward-looking):

4.3 Data Subject Requests

LogicNodes shall assist Partner in fulfilling Data Subject rights under Data Protection Laws. LogicNodes will assist without undue delay.

Right to Access (GDPR Art. 15):

Right to Rectification (GDPR Art. 16):

Right to Erasure (GDPR Art. 17):

Right to Data Portability (GDPR Art. 20):

Right to Restrict Processing (GDPR Art. 18):

Right to Object (GDPR Art. 21):

Assistance: LogicNodes will respond to Partner requests within 5 business days and provide reasonable assistance (documentation, API guidance, technical support).

4.4 Data Breach Notification

In the event of a Data Breach, LogicNodes shall:

Legal Commitment (GDPR Art. 33): LogicNodes shall notify Partner without undue delay and, where feasible, within 72 hours of becoming aware of the Data Breach.

Internal SLA Target (within 24 hours):

  1. Contain the breach (stop unauthorized access)
  2. Notify Partner via email (security contact)
  3. Provide preliminary incident report (scope, affected data, root cause)

Follow-Up Actions (within 72 hours):

  1. Detailed incident report (timeline, impact assessment, affected Data Subjects)
  2. Remediation plan (steps taken, preventive measures)
  3. Assistance with Supervisory Authority notification (if required by GDPR Art. 33)

Partner Obligations:

4.5 Data Protection Impact Assessment (DPIA)

LogicNodes shall provide reasonable assistance if Partner is required to conduct a DPIA under GDPR Article 35, including:

4.6 Prior Consultation

If a DPIA indicates high risk and Partner must consult a Supervisory Authority (GDPR Art. 36), LogicNodes will provide necessary information and assistance. Any disclosures will be limited to information strictly necessary for the consultation.

5. Sub-Processing

5.1 Authorized Sub-Processors

Partner grants general authorization for LogicNodes to engage Sub-Processors, subject to the conditions in this section.

Current Sub-Processors:

Complete Sub-Processor List: https://legal.logicnodes.ai/en/subprocessors

Summary:

The authoritative and up-to-date list of Sub-Processors is maintained at https://legal.logicnodes.ai/en/subprocessors and is updated with 7 days’ advance notice of changes.

Bring Your Own Key (BYOK) — AI Inference Services: Partner may at any time choose to use their own API keys for AI services. When own keys are used, the AI provider processes data directly on Partner’s behalf and is Partner’s direct processor — not LogicNodes’ sub-processor.

Sub-Processors of Sub-Processors: Sub-processors may engage their own sub-processors (e.g., Supabase uses AWS; Vercel uses AWS/Google Cloud; Hetzner processes data exclusively in its own EU data centres). These are covered under respective vendor DPAs.

5.2 Sub-Processor Requirements

LogicNodes shall ensure that all Sub-Processors (excluding BYOK-selected AI providers, which are Partner’s direct processors):

  1. Are bound by data protection obligations equivalent to this DPA
  2. Implement appropriate technical and organizational security measures
  3. Are bound by Data Processing Agreements or equivalent contractual mechanisms, including Standard Contractual Clauses (SCC EU 2021/914) for processors outside the EEA
  4. Undergo regular security assessments

Scope of LogicNodes’ obligations: LogicNodes ensures each Sub-Processor has signed a GDPR-compliant data processing agreement and, where required, Standard Contractual Clauses. LogicNodes does not guarantee that Sub-Processors hold any security certifications (such as SOC 2 or ISO 27001) unless expressly stated in this DPA.

5.3 New Sub-Processors

Notification: LogicNodes will notify Partner at least 7 days before engaging new Sub-Processors or materially changing existing Sub-Processors.

Notification Method:

Objection: Partner may object to new Sub-Processor on reasonable data protection grounds by notifying LogicNodes within 7 days.

If Partner Objects:

5.4 Sub-Processor Liability

LogicNodes remains fully liable to Partner for Sub-Processor performance. If Sub-Processor fails to fulfill data protection obligations, LogicNodes is liable to Partner as if LogicNodes had performed the processing. This liability does not apply to AI services that Partner uses via their own API keys (BYOK), as those providers are in that case Partner’s direct processors.

6. International Data Transfers

6.1 Data Location

Primary Storage: European Union (AWS EU-North-1, Stockholm via Supabase)

US Data Residency (Optional): Partner may request US data residency. Additional fees may apply.

Clarification — AI inference: Regardless of chosen data storage region, standard platform use involves agent prompts and responses being transmitted to LLM providers (OpenAI, Anthropic, Google Cloud, xAI) with servers in the USA at each agent run. These inference calls constitute international data transfers covered by SCCs and the respective Sub-Processors’ DPAs as described in §5 and Appendix C. Partner can reduce the scope of such transfers by using their own API keys (BYOK), whereby the LLM provider becomes Partner’s direct processor.

EU-only data processing: If Partner has activated EU-only data processing (§2.4), all Personal Data — including AI inference calls — is processed and stored exclusively within the EU. No international transfers to LLM providers outside the EU take place, and the AI inference clarification above does not apply.

6.2 Transfer Mechanisms

Default: Data stored in EU (no international transfer for EU customers)

For transfers of Personal Data to countries without an adequacy decision (if Partner requests US residency), LogicNodes relies on:

Standard Contractual Clauses (SCCs):

UK Addendum / IDTA: For transfers subject to UK law, the ICO International Data Transfer Addendum (or IDTA) applies by incorporation.

Swiss Addendum: For transfers subject to Swiss FADP, references to the GDPR and “EU” in the SCCs shall be read, mutatis mutandis, as references to the FADP and “Switzerland”.

Supabase SCCs:

6.3 Additional Safeguards

In addition to SCCs, LogicNodes implements supplementary measures required by Schrems II:

Encryption:

Key Management:

Access Controls:

Data Minimization:

Transparency & Oversight:

Government Access Requests:

6.4 Government Access Requests

If LogicNodes receives a lawful request from government authorities to access Personal Data:

  1. Promptly notify Partner unless legally prohibited;
  2. Use reasonable legal means to challenge or narrow the request;
  3. Disclose only the minimum Personal Data required by law, and document the request and disclosure.

7. Data Retention & Deletion

7.1 Retention Periods

Data Type Retention Deletion Method
Agent runs, events 1-90 days (Partner-configurable) Automatic daily cleanup
Transcriptions 1-90 days (Partner-configurable) Automatic daily cleanup
Agent execution context (checkpoints) 1-90 days (Partner-configurable) Automatic daily cleanup
User account data Until deletion request Manual or Partner-initiated
Identity tombstone (deleted user) 5 years from account deletion Automatic after 5 years
Billing-linked identity records 5 years from end of financial year (Bogføringsloven §10) Automatic after 5 years
Audit logs 5 years from date of event Automatic after 5 years

Backups are encrypted at rest (AES-256).

7.2 End of Service

Upon termination or expiration of the Terms & Conditions, LogicNodes shall (at Partner’s choice):

Option A: Delete

Option B: Return

Exception: LogicNodes may retain Personal Data to the extent required by applicable law (e.g., audit logs for compliance).

7.3 Partner-Initiated Deletion

Partner may delete data at any time via:

LogicNodes will delete immediately from production database (synchronous CASCADE) and purge from backups within 30 days.

Audit logs are exempt from this section. They cannot be deleted on Partner or end-user request.

8. Audit & Compliance

8.1 Partner Audit Rights

Partner has the right to audit LogicNodes’ compliance with this DPA, subject to:

Frequency: Once per calendar year (or more if Data Breach occurs)

Scope:

Method:

Confidentiality: Partner agrees to sign NDA and limit access to confidential information.

Costs:

Audits must not unreasonably disrupt LogicNodes’ operations and shall not require access to other customers’ data or proprietary systems unrelated to Partner’s data processing.

8.2 LogicNodes Certifications

LogicNodes will maintain industry-standard security practices and provide documentation upon reasonable request:

9. Liability & Indemnification

9.1 Limitation of Liability

Each party is liable for losses directly caused by a breach of this DPA. Neither party is liable for indirect losses, consequential damages, or loss of data, unless the loss is caused by willful misconduct or gross negligence. These limitations do not apply where prohibited by law, including in the event of a breach of the GDPR.

9.2 Controller Indemnity

Notwithstanding §9.1, Partner shall indemnify, defend, and hold harmless LogicNodes from any claims, losses, fines, penalties, and reasonable legal costs arising from Partner’s failure to comply with its obligations under §2.3, including Supervisory Authority investigations or enforcement actions and Data Subject claims under GDPR Article 82 directed at LogicNodes. Where LogicNodes is held jointly liable under GDPR Article 82 in connection with Personal Data introduced by Partner in breach of §2.3, Partner shall reimburse LogicNodes for any amounts paid to Data Subjects or authorities.

10. Term & Termination

10.1 Term

This DPA is effective as of the Effective Date and continues until terminated by either party in accordance with Section 10.2.

10.2 Termination

This DPA terminates automatically upon termination of the Terms & Conditions.

10.3 Survival

The following sections survive termination:

11. General Provisions

11.1 Governing Law

This DPA is governed by Danish law. For GDPR compliance, EU data protection law applies to the extent required by GDPR Article 28(3)(a). In case of conflict between this DPA and the SCCs with respect to personal data transfers, the SCCs shall prevail.

11.2 Amendments

LogicNodes may update this DPA by providing at least 7 days’ written notice to Partner. Partner may, before the notice period expires, choose to terminate this DPA with effect from the end of the notice period. Continued use of the Services after the notice period expires constitutes acceptance of the updated DPA.

11.3 Severability

If any provision of this DPA is invalid or unenforceable, the remaining provisions remain in full force and effect. The invalid provision shall be replaced with a valid provision that achieves the original intent.

11.4 Entire Agreement

This DPA constitutes the entire agreement on data processing between the parties.

11.5 Order of Precedence

In the event of conflict:

  1. This DPA (for data protection matters)
  2. Privacy Policy (for end-user data rights)

12. Signatures

Partner (Data Controller):

Signature: ___________
Name: [PARTNER AUTHORIZED SIGNATORY]
Title: ___________
Date: ___________

LogicNodes ApS (Data Processor):

Signature: ___________
Name: [LOGICNODES AUTHORIZED SIGNATORY]
Title: ___________
Date: ___________

Appendix A: Standard Contractual Clauses (SCCs)

EU Commission Decision 2021/914 - Module 2 (Controller to Processor)

Full text available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

Party Details:

Data Exporter (Controller):

Data Importer (Processor):

Competent Supervisory Authority:
[Partner’s local data protection authority, e.g., Datatilsynet for Denmark]

Clause 9 (Use of Sub-Processors):

Clause 13 (Supervision):
Supervisory Authority: The competent supervisory authority in the country where the Data Exporter is established

Clause 17 (Governing Law):
Law of EU Member State where Data Exporter is established

Clause 18 (Choice of Forum):
Courts of EU Member State where Data Exporter is established

UK Addendum:
Where required, the UK Addendum to the SCCs (version issued by the ICO) forms part of this DPA.

Swiss Addendum:
For Swiss FADP transfers, references in the SCCs to the GDPR and EU law shall be read as references to the FADP and Swiss law.

Appendix B: Technical and Organizational Measures

Security Measures Implemented by LogicNodes:

1. Access Control

Physical Access:

System Access:

Data Access:

2. Transmission Control

Encryption in Transit:

API Security:

3. Storage Control

Encryption at Rest:

Backup Security:

4. User Control

User Authentication:

Authorization:

5. Data Separation

Multi-Tenancy:

Test Coverage:

6. Pseudonymization

Shadow Users:

Audit Logs:

7. Availability & Resilience

Infrastructure:

Disaster Recovery:

8. Incident Management

Detection:

Response:

Escalation:

9. Data Portability & Deletion

Export:

Deletion:

10. Logging & Monitoring

Audit Logs:

Security Monitoring:

11. Technical Support Access

The Processor may access the Controller’s organisational data and, where strictly necessary for support delivery or bug investigation, access individual agent runs and User account data. Permitted purposes include:

The Processor shall:

(a) Restrict such access to a limited number of staff who have signed an NDA and completed mandatory security and personal data/GDPR training;

(b) Ensure all access actions are tied to an accountable staff member and audit-logged;

(c) Retain access logs in accordance with the purpose-limited retention schedule in §7.1 and App. B §12 (security event logs: 5 years; identity tombstones: 5 years);

(d) Where access is initiated without a prior Partner support request (e.g. in response to an automated error alert), notify Partner’s designated contact within 48 hours;

12. Audit Log Personal Data on User Deletion

LogicNodes retains audit logs for 5 years from the date of the logged event. Audit logs are retained regardless of whether the relevant user account has been deleted.

Partners can access audit logs for their own organisation via the platform or by contacting kontakt@logicnodes.ai. Data is available in a readable format. Requests are fulfilled within 5 business days.

Audit logs cannot be deleted on Partner or end-user request. They are permanently deleted at the end of the 5-year period.

Legal basis: GDPR Art. 6(1)(f) and Art. 17(3)(e), in conjunction with Bogføringsloven §10 and Straffeloven §93.

Appendix C: Sub-Processor List

Authoritative List: https://legal.logicnodes.ai/en/subprocessors

Summary:

LLM Providers: By default, LogicNodes provides API keys for LLM services. Partners may optionally provide their own API keys, in which case the LLM provider becomes Partner’s direct processor (not LogicNodes’ sub-processor).

Sub-Processors of Sub-Processors: Each sub-processor may engage their own sub-processors (e.g., Supabase uses AWS; Vercel uses AWS/Google Cloud). These are covered under respective vendor DPAs.

Changes: Partners will be notified 7 days before any changes to this list (new Sub-Processor, material change to existing).

The authoritative sub-processor list is maintained at https://legal.logicnodes.ai/en/subprocessors.

Change Log

Date Section
2026-07-07 §2.3; §3.3; §4.1; §4.2; §7.1; §7.3; §9.3; App. B §1; App. B §10; App. B §11; App. B §12
2026-04-21 Initial publication

LogicNodes ApS Sletvej 2D, 8310 Tranbjerg, Denmark CVR: DK45318362

This DPA is confidential and intended for Partner execution. Public distribution is not permitted.