Legal

Data Processing Agreement

Effective date: October 5, 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Use between the customer that owns a Ganymedus workspace (“Customer”, the controller) and Lingua Intellegens (“Processor”). It applies to personal data the Processor processes for the Customer through Ganymedus and meets Article 28 of the General Data Protection Regulation (“GDPR”). A countersigned copy is available on request at [email protected].

1. Instructions

The Processor processes Customer personal data only on the Customer's documented instructions: these Terms, this DPA and the Customer's use and configuration of Ganymedus (including the integrations, AI features and settings it turns on). If an instruction appears to break data protection law, the Processor will tell the Customer. Processing required by law will be notified first unless the law forbids it.

2. Confidentiality

Only people who need access to provide, secure or support the service may access Customer personal data, and they are bound by confidentiality.

3. Security

The Processor applies the technical and organizational measures in Annex 2 and keeps them at least at that level.

4. Sub-processors

The Customer gives general authorization to the sub-processors listed at ganymedus.com/subprocessors. The Processor will tell workspace owners at least 30 days before adding or replacing one; the Customer may object on reasonable data protection grounds, and if no solution is found may end the affected service. Each sub-processor is bound by data protection obligations at least as protective as this DPA, and the Processor remains responsible for it.

5. Help with data subjects' requests

Ganymedus lets the Customer export the whole workspace, correct records, erase one person from a workspace that stays (their name and contacts are removed and their private conversations, voice notes and notes deleted, while the work they did stays without their name), and delete the whole workspace. Where these tools are not enough, the Processor helps on request within 30 days. Requests that reach the Processor directly are passed to the Customer.

6. Personal data breaches

The Processor notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting Customer personal data, with the information the Customer needs to meet its own obligations, and takes reasonable steps to contain it.

7. Impact assessments and consultation

The Processor gives reasonable help with the Customer's data protection impact assessments and prior consultations, as far as they concern Ganymedus.

8. Deletion and return

The Customer can export all of its data at any time and delete the workspace in Settings: it closes at once and is removed for good after 30 days, during which the owner can restore it. When the agreement ends, the Processor deletes Customer personal data within 30 days unless the law requires keeping it; copies in backups are overwritten within five weeks after that.

9. Audits

The Processor makes available the information needed to show compliance with this DPA and allows audits by the Customer or an auditor it mandates, with reasonable notice, during business hours, at most once a year unless a breach or an authority requires more, and under confidentiality.

10. International transfers

Personal data is stored in the EU. Transfers to sub-processors outside the EU rely on the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

11. Liability and order of precedence

Liability under this DPA follows the Terms of Use. If this DPA and the Terms conflict on data protection, this DPA prevails.

Annex 1 — Details of processing

• Subject matter and duration: providing Ganymedus for as long as the Customer uses it, and the deletion period after.
• Nature and purpose: hosting, organizing, analyzing and transmitting data to plan and coordinate work, delegate and verify work, measure KPIs, transcribe and search meetings and notes, and provide AI assistance the Customer turns on.
• Data subjects: the Customer's owners, managers, employees and contractors; people at clients, partners and suppliers who appear in work, messages, meetings or connected services.
• Personal data: names, work email addresses and handles, roles and responsibilities, work items and results, messages and notes, time spent on work cards, end-of-day check-ins, availability and time off, KPI values, meeting transcripts and voice notes, files, and data from connected services (for example calendar events, emails and their metadata, documents, chat messages).
• Special categories: not intended. The Customer should not put special categories of data into Ganymedus unless it has a legal basis; free text and files may contain them if the Customer adds them.

Annex 2 — Technical and organizational measures

• Hosting in the EU (Hetzner, Germany); encryption in transit (TLS) for all connections.
• Passwords stored as salted PBKDF2 hashes; keys for connected services encrypted at rest; secrets never sent to AI models.
• Access in workspaces by role and permission; workspace data separated by workspace on every query; ownership of an email address confirmed before it unlocks invitations.
• Limits on sign-in, sign-up and similar attempts; security headers and a strict content security policy; uploaded files that could run as code are only downloaded, never opened as pages.
• Daily backups with weekly copies, checked by restoring them; backups rotated within five weeks.
• Changes go through automated tests before release; production access limited to authorized personnel.
• AI: requests carry only the data a feature needs; consequential actions (commitments of people, external messages, payments) require a person's approval; a daily AI allowance per workspace.