Data Processing Addendum (DPA)

Effective date: 2026-02-22

This DPA applies when LegacyLint processes personal data on behalf of a customer.

1. Roles

• Customer: Controller (or Business).
• LegacyLint: Processor (or Service Provider), unless otherwise stated in writing.

2. Subject Matter and Duration

• Subject matter: processing necessary to deliver the LegacyLint service.
• Duration: for the term of the services agreement, plus retention/deletion periods required by contract or law.

3. Nature and Purpose of Processing

• Hosting and processing tenant account data, security logs, project metadata, and scan outputs.
• Authentication, authorization, billing operations, support, and incident response.

4. Categories of Data Subjects and Data

• Data subjects: customer users and authorized personnel.
• Data categories: account identifiers, contact data, authentication/security events, usage metadata, and support content.

5. Processor Obligations

LegacyLint will:

• Process personal data only on documented instructions from customer.
• Ensure personnel confidentiality obligations.
• Apply appropriate technical and organizational security measures.
• Assist customer with data subject requests where applicable.
• Notify customer of personal data breaches without undue delay as required by law/contract.
• Support audits through reasonable evidence and controls documentation.

6. Subprocessors

• LegacyLint may use subprocessors to deliver infrastructure, email, and payment operations.
• Subprocessors are bound by data protection obligations materially equivalent to this DPA.

7. International Transfers

• Where transfers occur across jurisdictions, LegacyLint applies contractual safeguards and required transfer mechanisms.

8. Deletion and Return

• On termination or request, customer may export tenant data through provided workflows.
• Deletion requests are executed according to product deletion automation and retention windows, unless legal retention is required.

9. Security Measures (Summary)

• Authentication and authorization controls.
• Encryption in transit and secret management controls.
• Audit logging for high-impact admin/security actions.
• Monitoring and incident response procedures.

10. Contact

• support@legacylint.com