Data Processing Agreement (GDPR)

1. Roles

Where you are a business customer and Lexora processes personal data contained in documents or prompts on your documented instructions, you are the controller and ORVENTRA LTD is the processor for that processing. For account, billing, and site analytics data about your users as our customers, we typically act as an independent controller - see the Privacy Policy.

2. Subject matter and duration

Subject matter: hosting and processing document content and related prompts to provide drafting, storage, export, and optional review workflows.

Duration: for the term of your account and any post-termination retention required for backups or legal compliance, then deletion or return per your instructions where feasible.

3. Nature and purpose

Nature: collection, storage, structuring, transmission to subprocessors (including AI inference providers), and deletion.

Purpose: solely to provide the Lexora service you request.

4. Types of data and data subjects

Data may include names, contact details, contractual terms, and other personal data you choose to include in drafts. Data subjects may include your employees, counterparties, and other individuals referenced in documents. You must not submit special-category data unless you have a lawful basis and we have agreed in writing.

5. Processor obligations

• Process personal data only on documented instructions unless required by law.
• Ensure staff authorised to process data are bound by confidentiality.
• Implement appropriate technical and organisational security measures.
• Engage subprocessors under written terms offering equivalent protections and keep an up-to-date list available on request.
• Assist with data subject requests and DPIAs where reasonably required.
• Delete or return personal data at the end of the service relationship, subject to legal retention.
• Make available information necessary to demonstrate compliance and allow audits by mutual agreement on reasonable notice.

6. International transfers

Where personal data is transferred outside the UK/EEA, we will ensure a valid transfer mechanism is in place (such as adequacy or SCCs).

7. Your obligations

You warrant that you have a lawful basis to submit personal data to the service and that your instructions are lawful. You remain responsible for the accuracy of content you upload.

8. Contact

For DPA or subprocessor enquiries, contact info@lexora.biz. Enterprise customers may request a signed DPA addendum.