How does Langdock handle instructions from the Controller?

The Processor shall process the Controller Data only on documented instructions from the Controller, unless required to do so by Union or Member State law. Instructions are defined in the Agreement and through configuration options within the Langdock Platform.

What security measures does Langdock implement?

The Processor shall take appropriate technical and organizational measures in accordance with Art. 32 GDPR to ensure a level of security for the Controller Data appropriate to the risk, taking into account the state of the art, costs of implementation, and the nature and scope of processing.

Where is Controller Data processed?

The processing of Controller Data by the Processor shall generally take place within the European Union or a member state of the European Economic Area (EEA). Any transfer to a third country requires Controller instruction and compliance with Art. 44 et seq. GDPR.

What happens to data after contract termination?

The Processor shall delete the Controller Data no later than 30 days after termination of the Main Contract, unless subject to a legal obligation to retain the data for a longer period. The Controller has the option to export data during the term and until deletion.

What categories of personal data are processed?

Categories include user account data (names, email addresses, job titles, authentication credentials), content data (chat messages, uploaded documents, AI-generated responses), configuration data (prompts, assistants, workflows), usage data (session IDs, metadata), and integration data from third-party services.

Terms & Legal Notices

Data Processing Agreement

Version 2.1

Download PDF

1. Subject Matter

As part of the provision of services under the General Terms of Use for the Langdock Platform (“Main Contract”), it is necessary for the Processor to process personal data for which the Controller acts as the data controller within the meaning of data protection regulations (“Controller Data”). This Agreement specifies the rights and obligations of the Parties under data protection law in connection with the processing of Controller Data for the performance of the Main Contract.

2. Scope of Data Processing

The Processor shall process Controller Data on behalf of and in accordance with the instructions of the Controller within the meaning of Art. 28 GDPR. The Controller shall remain the controller within the meaning of data protection law.
The details of the processing, in particular the categories of personal data and the purposes for which the Controller Data is processed on behalf of the Controller, are specified in Appendix 1.

3. Instructions by the Controller

The Processor shall process the Controller Data only on documented instructions from the Controller, unless required to do so by Union or Member State law to which the Processor is subject. In this case, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.
The Controller’s instructions are defined in this Agreement. In addition, the Processor makes available to the Controller configuration options within the Langdock Platform through which the Controller may customize the processing of Controller Data within the scope of the Platform’s standard operation. Use of these configuration options constitutes a documented instruction within the meaning of this Agreement. Instructions going beyond the foregoing that require customization of the Processor’s standard service are only binding to the extent they have been agreed in writing and documented in the Main Contract or a separate amendment.
The Processor shall immediately inform the Controller if, in the Processor’s opinion, instructions given by the Controller infringe applicable data protection law.

4. Responsibility of the Controller

As between the Parties, the Controller is solely responsible for the lawfulness of the instructions issued and the lawfulness of the processing of Controller Data. Should any third party bring claims against the Processor in connection with the processing of Controller Data under this Agreement, the Controller shall indemnify the Processor against such claims to the extent they are based on the Controller’s breach of this Agreement or applicable law.

Upon request, the Controller shall provide the Processor with reasonable assistance in fulfilling its data protection obligations, including by supplying information required for the Processor’s records of processing activities pursuant to Art. 30 (2) GDPR and by supporting the Processor in its cooperation with supervisory authorities or other public authorities.

5. Security of Processing

The Processor shall take appropriate technical and organizational measures in accordance with Art. 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing of the Controller Data as well as the risk of varying likelihood and severity for the rights and freedoms of data subjects, to ensure a level of security for the Controller Data appropriate to the risk.

The Parties agree that the technical and organizational measures set out in Appendix 3 ensure an appropriate level of protection for the Controller Data at the time of conclusion of this Agreement. The Processor shall be permitted to change or adapt technical and organizational measures during the term of this Agreement as long as such measures continue to meet the statutory requirements and do not reduce the overall level of data protection set out in Appendix 3.

6. Requirements for Personnel

The Processor ensures that persons authorized to process the Controller Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7. Use of Sub-Processors

The Controller hereby grants the Processor general authorization to engage sub-processors with regard to the processing of Controller Data. The sub-processors engaged at the time of the conclusion of the Agreement are set out in Appendix 2.
The Processor shall inform the Controller of any intended changes with regard to the addition or replacement of sub-processors at least 14 days prior to the planned engagement of the new sub-processor. Notification shall be made by publication at https://trust.langdock.com/subprocessors and via email if the Controller has subscribed to email notifications on that page. The Controller is entitled to object in writing to the intended change within 14 days of publication of the change, provided that the objection is based on specific data protection grounds. If no objection is raised, the change shall be deemed approved. In the event of a timely and duly reasoned objection, the Parties shall attempt to reach a mutually agreeable solution. If no agreement is reached within 14 days of receipt of the objection, either Party shall be entitled to terminate the Main Contract and this Agreement with a notice period of 30 days.
The Processor shall contractually impose on sub-processors data protection obligations that correspond to the level of protection under this Agreement (Art. 28 (4) GDPR). Where a sub-processor processes Controller Data in a third country, the Processor shall ensure that an appropriate transfer mechanism ensuring an adequate level of protection within the meaning of Art. 44 et seq. GDPR is in place, such as by entering into standard contractual clauses pursuant to Art. 46 GDPR in accordance with the applicable template of the European Commission.
The Processor shall remain responsible to the Controller for the performance of the sub-processor’s obligations in accordance with its contract with the Processor.

8. International Data Transfers

The processing of Controller Data by the Processor shall generally take place within the European Union or a member state of the European Economic Area (EEA).

Any transfer of Controller Data by the Processor to a third country or international organization shall take place only on the basis of an instruction from the Controller (e.g., where the Controller actively enables an LLM with a server location outside the EU in the Langdock platform) and in accordance with Art. 44 et seq. GDPR.

Where Controller Data is transferred to or processed in a third country or international organization by the Processor or a sub-processor, the Processor shall ensure that an appropriate transfer mechanism ensuring an adequate level of protection within the meaning of Art. 44 et seq. GDPR is in place, such as by entering into standard contractual clauses pursuant to Art. 46 GDPR in accordance with the applicable template of the European Commission.

9. Data Subject Rights

Taking into account the nature of the processing and the information available, the Processor shall assist the Controller, by appropriate technical and organizational measures to the extent reasonable, to comply with the Controller’s obligation to respond to requests to exercise the rights of data subjects under the GDPR. For this purpose, the Processor shall make available to the Controller functionalities within the Langdock platform that enable the Controller to independently handle typical data subject requests.

The Controller hereby instructs the Processor to implement requests from data subjects regarding (a) the rectification of account or profile data and (b) the deactivation or deletion of the user account and the data exclusively associated with that user account independently and without prior consultation with the Controller, where such requests are addressed directly to the Processor via the standard support channels and the identity of the data subject has been verified by appropriate means (e.g., through the email address associated with the user account). Data subject requests that may concern data outside the Langdock platform will not be handled independently by the Processor.

Where the Processor receives a request from a data subject to exercise the rights under the GDPR that is not handled by the Processor independently (in particular because it raises legal or factual questions or goes beyond the standard cases set out in paragraph 2), the Processor shall forward the request to the Controller without undue delay. Upon the Controller’s request, the Processor shall in such cases assist the Controller by appropriate technical and organizational measures, insofar as reasonably possible and necessary, in fulfilling the Controller’s obligations.

10. Notification and Support Obligations of the Processor

In the event of a personal data breach affecting Controller Data, the Processor shall notify the Controller thereof without undue delay after becoming aware of the breach. The notification shall be made on the basis of the information available to the Processor at the time of the notification; to the extent that further relevant information becomes available, the Processor shall provide such information to the Controller without undue delay.

Upon the Controller’s request, the Processor shall, taking into account the nature of the processing and the information available to the Processor, assist the Controller in fulfilling any notification and communication obligations under the GDPR, insofar as such assistance is necessary and reasonable. The legal assessment as to whether and to what extent any notification or communication obligation exists shall remain the responsibility of the Controller.

Upon the Controller’s request, the Processor shall, taking into account the nature of the processing and the information available to the Processor, assist the Controller with any data protection impact assessments and prior consultations with supervisory authorities, insofar as such assistance is necessary and reasonable. To the extent that such assistance causes significant additional effort exceeding the assistance contractually owed, the Parties shall agree in advance on appropriate additional remuneration.

11. Data Deletion

The Processor shall delete the Controller Data no later than 30 days after termination of the Main Contract, unless the Processor is subject to a legal obligation to retain the Controller Data for a longer period. The Processor shall confirm deletion of the Controller Data to the Controller upon request.

During the term of the Main Contract and until deletion of the Controller Data pursuant to paragraph 1, the Controller shall have the option to export its Controller Data. Upon request, the Processor shall make available the export functions provided for this purpose.

Documentation that serves as proof of the proper processing of Controller Data in accordance with this Agreement or for complying with statutory retention obligations may be retained by the Processor after expiry of the Agreement.

12. Verifications and Audits

The Processor shall provide the Controller, at the Controller’s request, with all information necessary and available to the Processor to verify compliance with its obligations under this Agreement and under Art. 28 GDPR.
The Controller shall be entitled to review the Processor’s compliance with its obligations under this Agreement and under Art. 28 GDPR.
Compliance with the obligations under this Agreement and under Art. 28 GDPR shall, as a rule, be demonstrated by the provision of an appropriate and up-to-date attestation or report from an independent body or an audit report issued in connection with an IT security or data protection certification (e.g., ISO 27001, SOC 2 Type II).
To the extent that the Controller substantiates a specific and justified suspicion of a breach of the obligations under this Agreement or under Art. 28 GDPR, or if the evidence provided pursuant to paragraph 3 does not permit an adequate review in the specific case, the Controller shall be entitled to conduct inspections. Such inspections shall be carried out with due regard to the Processor’s legitimate interests and, where possible, primarily by way of written information or remote reviews.
Inspections shall only be permissible during the Processor’s normal business hours and upon reasonable prior notice and shall not unreasonably interfere with the Processor’s business operations.
The Processor shall be entitled to restrict the disclosure of information to the extent necessary to preserve the confidentiality of other customers’ data, security requirements, and legitimate trade and business secrets. If the Controller appoints a third party to carry out an inspection, such third party may not be a competitor of the Processor and must be bound in writing to confidentiality and non-disclosure prior to the inspection.

13. Liability

As between the Parties, the liability provisions of the Main Contract shall apply accordingly, including any exclusions and limitations of liability. The mandatory statutory liability provisions under Art. 82 GDPR shall remain unaffected.

14. Term and Termination

The term and termination of this Agreement shall be governed by the provisions on the term and termination of the Main Contract. Termination of the Main Contract shall automatically result in termination of this Agreement; this Agreement shall, however, remain in force until the deletion of the Controller Data has been completed. An individual termination of this Agreement is excluded.

15. Final Provisions

Should individual provisions of this Agreement be or become invalid or contain a gap, the remaining provisions shall remain unaffected. The Parties shall replace the invalid provision with a legally permissible provision that comes closest to the purpose of the invalid provision and meets the requirements of Art. 28 GDPR.
Unless otherwise provided in this Agreement, the provisions of the Main Contract shall apply accordingly, in particular with regard to the governing law and jurisdiction. In the event of contradictions between this Agreement and other agreements between the Parties, in particular the Main Contract, the provisions of this Agreement shall take precedence.
Only the German version of this Agreement shall be legally binding. The English translation is provided for information purposes only.

Appendix 1

Purpose, nature, and scope of data processing

Purpose of data processing:

‍Provision of the Langdock platform for the use of AI Models and functions built thereon according to the Main Contract

Nature and scope of data processing:
(in each case to the extent the function is used by the Controller)

User account data: Names, email addresses, job titles and authentication credentials
Content data: Content shared with or generated by AI Models (e.g., chat messages entered by users, uploaded documents, meeting summaries, and AI-generated responses, transcripts or code)
Configuration data: Stored prompts, agents, workflows and data bases (to the extent that instructions or content contain personal data)
Usage data: Session and user ID, user-related metadata (e.g., conversation timestamps)
Integration data: Personal data from third-party service integrations configured by the Controller and accessed via the Langdock platform
Recordings and transcription data: Recordings, transcripts and summaries of meetings and other communications, including information about participants
Analytics data: Log data relating to AI features, analytics, lifecycle and governance data regarding agents, workflows and integrations

Categories of data subjects:

Employees and other users of the Controller who are granted access to the Langdock platform (collectively “Users”)
Third parties whose personal data is submitted to the Langdock platform by the Controller via documents, prompts or integrations
Third parties who access applications created by Users on the Langdock platform
Participants in meetings and other communication that is processed via the Langdock platform

Appendix 2

List of authorized Sub-Processors

Company, Seat	Purpose	Type of Data	Location of data processing	Transfer mechanism
Microsoft Ireland Operations Limited, Ireland	Cloud infrastructure and hosting of Langdock platform Use of AI Models and AI services via Azure	Controller Data	EU	-
Amazon Web Services EMEA SARL, Luxembourg	Use of AI Models and AI services via AWS Temporary sandboxes and comparable ephemeral platform components	Controller Data	EU	-
Google Cloud EMEA Limited, Ireland	Use of AI Models and AI services via GCP Temporary sandboxes and comparable ephemeral platform components	Controller Data	EU	-
OpenAI Ireland Limited, Ireland	Use of AI Models and AI services via OpenAI	Controller Data	EU	-
Mistral AI SAS, France	Use of AI Models and AI services via Mistral	Controller Data	EU	-
Functional Software Inc. (Sentry), US	Error tracking	Error and diagnostic data, pseudonymous user identifier	EU	EU-U.S. Data Privacy Framework, UK Extension, Swiss-U.S. Data Privacy Framework, EU & UK SCCs, Swiss Addendum
Cloudflare Inc., US	Protection against malicious traffic	Network and traffic data	EU	EU-U.S. Data Privacy Framework, UK Extension, Swiss-U.S. Data Privacy Framework, EU & UK SCCs, Swiss Addendum
The following sub-processors are only used if the Controller actively chooses AI Models of these providers with “global deployment” in the settings of the Langdock platform.
Microsoft Ireland Operations Limited, Ireland	Use of AI Models with global deployment via Azure	Controller Data	Storage at rest in EU, processing (inference requests) in other Microsoft data zones, including US	EU-U.S. Data Privacy Framework, UK Extension, Swiss-U.S. Data Privacy Framework, EU & UK SCCs
Amazon Web Services EMEA SARL, Luxembourg	Use of AI Models with global deployment via AWS	Controller Data	Worldwide, including US	EU-U.S. Data Privacy Framework, UK Extension, Swiss-U.S. Data Privacy Framework, EU & UK SCCs, Swiss Addendum
Google Cloud EMEA Limited, Ireland	Use of AI Models with global deployment via GCP	Controller Data	Worldwide, including US	EU-U.S. Data Privacy Framework, UK Extension, Swiss-U.S. Data Privacy Framework, EU & UK SCCs, Swiss Addendum
OpenAI Ireland Limited, Ireland	Use of AI Models with global deployment via OpenAI	Controller Data	Worldwide, including US	EU & UK SCCs

Appendix 3

Technical and Organizational Measures implemented by the Processor

Technical Measures	Organizational Measures
The technical and organizational measures are implemented by Langdock in accordance with Art. 32 GDPR. They are continuously improved by Langdock according to feasibility and state of the art and brought to a higher level of security and protection. The high level of security is also supported by ISO 27001 and SOC 2 Type II certifications.
1. Confidentiality
1.1 Physical Access Control: Measures suitable for preventing unauthorized persons from gaining access to data processing systems with which personal data are processed or used.
Doors with external handles/knobs Manual locking systems	Key management / key register Visitors accompanied by employees Care in selection of cleaning services Information Security Policy
1.2 Logical Access Control: Measures suitable for preventing data processing systems from being used by unauthorized persons.
Login with username + strong password Encryption of devices Enforced MFA Automatic desktop lock Zero-Trust principle for administrative systems and critical components	User permission management Creating user profiles Information Security Policy
1.3 Authorization Control: Measures to ensure that those authorized to use a data processing system can only access the data subject to their access authorization and that personal data cannot be read, copied, modified or removed without authorization during processing, use and after storage.
Logging of accesses to applications, specifically when entering, changing, and deleting data SSH encrypted access Certified SSL encryption Role-based access control (RBAC)	Information Security Policy Minimum number of administrators Management of user rights by administrators Regular review of access permissions (at least annually)
1.4 Separation Control: Measures that ensure that data collected for different purposes can be processed separately. This can be ensured, for example, by logical and physical separation of the data.
Separation of productive and test environments Multi-tenancy of relevant applications	Control via authorization concept Determination of database rights Information Security Policy Data Protection Policy
1.5 Pseudonymization: The processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to appropriate technical and organizational measures.
In case of pseudonymization: separation of the mapping data and storage in separate system (encrypted)	Internal instruction to anonymize/pseudonymize personal data as far as possible in the event of disclosure or even after the statutory deletion period has expired Information Security Policy Data Protection Policy
1.6 Encryption: Measures to ensure that data at rest and in transit cannot be read by unauthorized persons and that cryptographic keys are managed securely.
Encryption of all stored data at rest (minimum AES-256) Encryption of all data transmissions (minimum TLS 1.2) Encryption of backups Centralized secret management for cryptographic keys and certificates	Encryption and key management policy Key rotation policy for cryptographic keys and certificates
2. Integrity
2.1 Transfer Control: Measures to ensure that personal data cannot be read, copied, altered or removed by unauthorized persons during electronic transmission or while being transported or stored on data media, and that it is possible to verify and establish to which entities personal data are intended to be transmitted by data transmission equipment.
Logging of accesses and retrievals Provision via encrypted connections such as https and secure cloud storage services Use of Web Application Firewall (WAF) Use of Email Security solutions, including spam and malware filters Use of Endpoint Security Software (EDR/Antivirus) with regular updates	Survey of regular retrieval and transmission processes Transmission in anonymized or pseudonymized form Information Security Policy Data Protection Policy
2.2 Input Control: Measures that ensure that it is possible to check and establish retrospectively whether and by whom personal data has been entered into, modified or removed from data processing systems. Input control is achieved through logging, which can take place at various levels (e.g., operating system, network, firewall, database, application).
Traceability of system accesses and configuration changes via audit trails Manual or automated control of the logs (according to strict internal specifications)	Traceability of data entry, modification and deletion through individual usernames (not user groups) Assignment of rights to enter, change and delete data on the basis of an authorization concept Clear responsibilities for deletions Information Security Policy
2.3 Development Security: Measures to ensure the integrity of the software development and deployment process.
Automated dependency scanning with vulnerability monitoring for all deployed components Infrastructure as Code with version control and logging Automated testing of all security-relevant components	Code review and approval process
3. Availability and Resilience
3.1 Availability Control: Measures to ensure that personal data is protected against accidental destruction or loss (UPS, air conditioning, fire protection, data backups, secure storage of data media, virus protection, raid systems, disk mirroring, etc.).
Hosting in certified data centers by Microsoft Azure with redundant infrastructure Availability monitoring and automatic notification of anomalies at system and infrastructure components Protection against overload attacks through CDN and bot management	Backup concept Emergency response plan in place Defined response times and escalation paths when availability thresholds are exceeded
3.2 Recoverability Control: Measures capable of rapidly restoring the availability of and access to personal data in the event of a physical or technical incident.
Backup monitoring and reporting Restorability supported by automation tools Backup concept according to criticality and customer specifications	Recovery concept Control of the backup process Regular testing of data recovery and logging of results Existence of an emergency plan Information Security Policy
4. Procedures for Regular Review, Assessment and Evaluation
4.1 Data Protection Management
Central documentation of all data protection regulations with access for employees A review of the effectiveness of the TOMs is carried out at least annually and TOMs are updated Data protection checkpoints consistently implemented in tool-supported risk assessment	External data protection officer appointed Staff trained and obliged to confidentiality/data secrecy Regular awareness trainings at least annually Data Protection Impact Assessment (DPIA) is carried out as required Processes regarding information obligations according to Art. 13 and 14 GDPR established Formalized process for requests for information from data subjects is in place Data protection aspects established as part of corporate risk management
4.2 Vulnerability Management: Proactive measures for identifying, assessing and remediating security vulnerabilities.
Automated vulnerability scans Regular penetration tests (at least annually)	Bug bounty program for coordinated vulnerability disclosure Information Security Policy with dedicated escalation paths and defined response times
4.3 Incident Response Management: Support for security breach response and data breach process.
Centralized log management and security monitoring with automatic alerting for security-relevant events Real-time error and anomaly monitoring with automatic notification of critical incidents Ability to immediately lock compromised user accounts and access tokens	Documented process for detecting and reporting security incidents / data breaches (also with regard to reporting obligation to supervisory authority) Formalized procedure for handling security incidents Involvement of DPO and CTO in security incidents and data breaches Documentation of security incidents and data breaches via ticket system A formal process for following up on security incidents and data breaches Information Security Policy Data Protection Policy
4.4 Data Protection by Design and by Default: Measures pursuant to Art. 25 GDPR that comply with the principles of data protection by design and by default.
No more personal data is collected than is necessary for the respective purpose Use of data protection-friendly default settings in standard and individual software	Data Protection Policy (includes principles “privacy by design / by default”) Perimeter analysis for web applications
4.5 Provider Control (Outsourcing, Subcontractors and Order Processing): Measures to ensure that personal data processed on behalf of the client can only be processed in accordance with the client’s instructions.
Monitoring of remote access by external parties, e.g. in the context of remote support Monitoring of subcontractors according to the principles and with the technologies according to the preceding chapters 1, 2	Work instruction supplier management and supplier evaluation Prior review of the security measures taken by the contractor and their documentation Selection of the contractor under due diligence aspects (especially with regard to data protection and data security) Conclusion of the necessary data processing agreement on commissioned processing or EU standard contractual clauses Agreement on effective control rights over the contractor Ensuring the destruction of data after termination of the contract
5. Organization and Data Protection at Langdock
In its Quality, Risk and Compliance Policy, Langdock has set itself the goal, among other things, of providing its customers with the products and services to be delivered at the highest possible level of information security in compliance with the law. Employees are continuously informed and trained in the area of data protection. In addition, all employees are contractually bound to data secrecy and confidentiality. External parties who may come into contact with personal data in the course of their work for Langdock are obliged to maintain secrecy and confidentiality as well as to comply with data protection and data secrecy by means of a so-called NDA (Non-Disclosure Agreement) before they begin their work.