Lemax standard Data Processing Agreement, version 2.0, effective 15 September 2026
This Data Processing Agreement (“Agreement”) forms part of the Service Subscription Contract or other agreement for the provision of the Lemax system and related services (“Principal Agreement”) between the customer identified in the Principal Agreement (“Controller”) and Lemax d.o.o., Zagreb, Croatia (“Processor”). It applies whenever it is signed as an addendum to the Principal Agreement or attached to and incorporated in the Principal Agreement by reference.
Except as modified below, the terms of the Principal Agreement remain in full force and effect. Capitalised terms not defined in this Agreement have the meaning given in the Principal Agreement or, failing that, in the GDPR.
1. Definitions
“Authorised Sub-processors” means the Sub-processors set out in the Sub-processor List and any additional Sub-processors authorised in accordance with Section 7.
“AI Features” means functionality of the Lemax system that uses AI Sub-processors to generate, summarise, translate, classify or suggest content, as described in the Documentation.
“AI Sub-processor” means an Authorised Sub-processor that provides large language model or other machine learning services used by Processor to deliver AI Features.
“Approved Transfer Mechanism” means a mechanism under Chapter V GDPR permitting the transfer of Personal Data to a Third Country, including an adequacy decision of the European Commission (including the EU-US Data Privacy Framework in respect of certified recipients), the Standard Contractual Clauses, or binding corporate rules.
“Controller Personal Data” means the Personal Data described in Annex 1 and any other Personal Data Processed by Processor on behalf of Controller in connection with the Principal Agreement.
“Data Protection Laws” means Regulation (EU) 2016/679 (“GDPR”), any applicable national data protection laws implementing or supplementing it, and, where Controller is established in the United Kingdom or the Processing is otherwise subject to UK law, the UK GDPR and the Data Protection Act 2018 (“UK Data Protection Laws”), and, where Controller is established in Switzerland, the Swiss Federal Act on Data Protection. References to GDPR articles include the equivalent provisions of the UK GDPR where UK Data Protection Laws apply.
“Documentation” means Processor’s then-current user documentation for the Lemax system.
“EEA” means the European Economic Area.
“Principal Agreement” means the agreement between Controller and Processor for the provision of the Lemax system and related services, whether titled Service Subscription Contract, Master Agreement or otherwise, together with any Order Forms, schedules or amendments under it, to which this Agreement is attached, into which it is incorporated, or which references it. Where one Order Form terminates while others remain in force, this Agreement continues to apply to the remaining Order Forms.
“Material Breach” means a breach of this Agreement that (a) results in unauthorised access to, disclosure of, or loss of Controller Personal Data which has, or is reasonably likely to have, material adverse consequences for Data Subjects or Controller, or (b) consists of a repeated or persistent failure to comply with an obligation of this Agreement after written notice from Controller identifying the failure.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Controller Personal Data.
“Services” means the services and products supplied by Processor to Controller under the Principal Agreement.
“Standard Contractual Clauses” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914, or any clauses that amend, replace or supersede them.
“Sub-processor” means any third party engaged by Processor to Process Controller Personal Data on behalf of Controller.
“Sub-processor List” means the list of Authorised Sub-processors published by Processor at the address set out in Annex 3, as updated in accordance with Section 7.
“Third Country” means a country outside the EEA that is not the subject of a valid adequacy decision by the European Commission.
“Process”, “Processing”, “Data Controller”, “Data Processor”, “Data Subject”, “Personal Data”, “Special Categories of Personal Data” and “Supervisory Authority” have the meanings given in the GDPR.
2. Scope and roles
2.1In providing the Services, Processor Processes Controller Personal Data on behalf of Controller. For the purposes of Data Protection Laws, Controller is the Data Controller and Processor is the Data Processor in respect of Controller Personal Data. Where Controller acts as a processor for its own customers, Controller warrants that it is authorised to appoint Processor as a sub-processor and that this Agreement is consistent with its obligations to its own customers.
2.2Processor acts as an independent Data Controller in respect of (a) account and contact data of Controller’s personnel used to administer the relationship (billing, support, security notices), and (b) aggregated or anonymised usage and performance data that does not identify Data Subjects of Controller. Such Processing is governed by Processor’s Privacy Notice and not by this Agreement.
2.3The subject matter, duration, nature and purpose of Processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1.
3. Processing of Controller Personal Data
3.1Processor shall Process Controller Personal Data only on Controller’s documented instructions and only for the purposes of providing the Services. The Principal Agreement, this Agreement and Controller’s use of the Lemax system’s functionality (including configuration and activation of features) constitute Controller’s documented instructions. Additional instructions must be agreed in writing and may be subject to a fee where they require work outside the Services.
3.2Processor shall not Process Controller Personal Data for its own purposes, sell it, or disclose it to any third party except (a) to Authorised Sub-processors in accordance with Section 7, (b) as instructed by Controller, or (c) where required by Union, Member State or United Kingdom law to which Processor is subject, in which case Processor shall, to the extent permitted, inform Controller of that requirement before Processing.
3.3Processor shall promptly inform Controller if, in its opinion, an instruction infringes Data Protection Laws. Processor is not obliged to perform a legal review of Controller’s instructions.
3.4Controller instructs Processor to transfer Controller Personal Data to Authorised Sub-processors located in Third Countries as set out in the Sub-processor List, subject to Section 14.
4. Controller obligations
4.1Controller warrants and undertakes that (a) it has a lawful basis for the Processing of Controller Personal Data, including any Special Categories of Personal Data entered into free-text fields of the Lemax system (such as allergies, dietary requirements, medical or assistance needs); (b) its instructions to Processor comply with Data Protection Laws; (c) it has provided Data Subjects with the information required by Articles 13 and 14 GDPR, including in relation to AI Features where applicable; (d) it shall not submit to the Lemax system Personal Data that is not necessary for the Services; and (e) it shall configure and use the Lemax system, including user access rights, in a manner consistent with Data Protection Laws.
4.2Controller shall indemnify Processor against claims, fines and losses arising from Controller’s breach of Section 4.1, subject to Section 16.
5. Personnel
5.1Processor shall ensure that access to Controller Personal Data is limited to personnel who need it to perform the Services, and that such personnel (a) are informed of the confidential nature of Controller Personal Data, (b) are bound by written confidentiality obligations, (c) have received data protection training in accordance with Processor’s internal training programme, and (d) access Controller Personal Data only through authenticated, logged accounts.
6. Security
6.1Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk to the rights and freedoms of natural persons, Processor shall implement and maintain the technical and organisational measures set out in Annex 2.
6.2Processor may update Annex 2 from time to time provided that the updates do not materially reduce the overall level of security. Processor shall provide the current version of Annex 2 to Controller on request.
7. Sub-processing
7.1Controller grants Processor a general authorisation to engage Sub-processors for the Processing of Controller Personal Data. The Sub-processors engaged as at the effective date of this Agreement are set out in the Sub-processor List.
7.2Processor shall notify Controller of any intended addition or replacement of a Sub-processor at least thirty (30) days before the new Sub-processor Processes Controller Personal Data, by updating the Sub-processor List and sending notice to the email address Controller has registered for such notifications. Controller may subscribe to notifications at the Sub-processor List URL. Controller is responsible for keeping its notification address current.
7.3Controller may object to a new Sub-processor on reasonable, documented data protection grounds by notifying Processor in writing within the thirty (30) day period. The parties shall discuss the objection in good faith. An objection is resolved if Processor confirms that the Sub-processor is bound by obligations meeting Section 7.4 and, where relevant, an Approved Transfer Mechanism. If the objection cannot be resolved, Controller’s rights and remedies are those available under the Principal Agreement, and this Section does not create any additional right of termination, refund or compensation. An objection does not prevent Processor from engaging the Sub-processor for its other customers, and neither the engagement of a new Sub-processor in accordance with this Section nor an unresolved objection constitutes a breach of this Agreement or the Principal Agreement by Processor. If Controller does not object within the thirty (30) day period, the new Sub-processor is deemed authorised.
7.4With respect to each Sub-processor, Processor shall (a) carry out appropriate due diligence before engagement; (b) enter into a written agreement imposing data protection obligations no less protective in substance than those in this Agreement, to the extent applicable to the services provided by that Sub-processor; (c) where the Sub-processor Processes Controller Personal Data in a Third Country, ensure that an Approved Transfer Mechanism is in place; and (d) remain liable to Controller for the performance of the Sub-processor’s obligations to the same extent Processor is liable under this Agreement.
7.5On request, Processor shall provide Controller with a summary of the data protection terms agreed with a Sub-processor, or a reference to the Sub-processor’s publicly available terms. Processor is not required to disclose commercial terms or the confidential information of third parties.
7.6Third parties that Controller selects, connects to or instructs Processor to transmit Controller Personal Data to (including suppliers, distribution systems, payment providers, communication services and other systems integrated with the Lemax system at Controller’s request or through Controller’s configuration) are not Sub-processors of Processor. Controller Personal Data transmitted to such third parties is transmitted on Controller’s instruction, and Controller is responsible for its own contractual arrangements with them.
8. AI Features
8.1Processor may use AI Sub-processors to deliver AI Features. Controller Personal Data submitted to an AI Sub-processor is limited to the data necessary for the specific AI Feature and is transmitted under the AI Sub-processor’s enterprise or API terms, not its consumer terms. AI Features may process free-text fields as entered by Controller’s users, which may contain Special Categories of Personal Data; Controller is responsible for the lawful basis for such Processing in accordance with Section 4.1 and for instructing its users accordingly.
8.2Processor shall ensure that each AI Sub-processor is contractually prohibited from using Controller Personal Data to train, retrain or improve its models, and that Controller Personal Data is retained by the AI Sub-processor only in accordance with its enterprise or API terms, using zero-data-retention or equivalent minimum-retention options where the AI Sub-processor offers them.
8.3AI Features produce drafts, summaries, translations, classifications or suggestions for review by Controller’s users. AI Features are not designed or intended to make decisions producing legal or similarly significant effects on Data Subjects within the meaning of Article 22 GDPR, and Controller shall not use them for such decisions without human review. Controller remains responsible for any decision taken by its users on the basis of AI Feature output.
8.4Controller acknowledges that AI Feature output may contain inaccuracies and that Processor’s obligations under this Agreement do not extend to the accuracy of such output. Where required by applicable law, the Lemax system indicates to users that content is AI-generated.
8.5Processor shall not use Controller Personal Data to train or fine-tune any model, whether its own or a third party’s, without Controller’s prior written consent.
9. Data Subject rights
9.1Taking into account the nature of the Processing, Processor shall assist Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling Controller’s obligation to respond to requests from Data Subjects exercising their rights under Chapter III GDPR.
9.2Processor shall promptly notify Controller if it receives a request from a Data Subject, a Supervisory Authority or another competent authority concerning Controller Personal Data, and shall not respond to the request except on Controller’s instructions or where required by law.
9.3Processor provides the assistance in this Section primarily through the standard functionality of the Lemax system (including export, correction and deletion tools available to Controller). Assistance beyond standard functionality is provided at Processor’s then-current professional services rates, unless the request results from Processor’s breach of this Agreement.
10. Personal Data Breach
10.1Processor shall notify Controller without undue delay after becoming aware of a Personal Data Breach affecting Controller Personal Data, and in any event within seventy-two (72) hours. The initial notification may contain limited information; Processor shall provide further information in phases as it becomes available.
10.2The notification shall, to the extent known, (a) describe the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records concerned; (b) provide the contact details of Processor’s data protection contact; (c) describe the likely consequences; and (d) describe the measures taken or proposed to address the breach and mitigate its effects.
10.3Processor shall take the measures reasonably necessary to investigate, mitigate and remediate the Personal Data Breach, in consultation with Controller, and shall cooperate with Controller’s own investigation. Processor shall not notify a Personal Data Breach to Data Subjects or Supervisory Authorities on Controller’s behalf without Controller’s prior written consent.
10.4Nothing in this Section restricts Processor from notifying (a) its other customers whose Personal Data is affected by the same incident, (b) its Sub-processors, (c) a Supervisory Authority where Processor is required to do so as a Data Controller of its own data, or (d) as otherwise required by law.
11. Data protection impact assessment and prior consultation
11.1Taking into account the nature of the Processing and the information available to Processor, Processor shall assist Controller in ensuring compliance with Controller’s obligations under Articles 32 to 36 GDPR. In particular, Processor shall provide reasonable assistance to Controller with data protection impact assessments under Article 35 GDPR and prior consultations with Supervisory Authorities under Article 36 GDPR, in each case solely in relation to the Processing of Controller Personal Data by Processor and taking into account the nature of the Processing and the information available to Processor. Such assistance consists of providing Processor’s existing documentation (including this Agreement and Annexes 1 and 2); further assistance is provided at Processor’s then-current professional services rates.
12. Return and deletion of Controller Personal Data
12.1During the term of the Principal Agreement, Controller may export Controller Personal Data using the functionality of the Lemax system.
12.2Within ninety (90) days after termination or expiry of the Principal Agreement, Controller may elect in writing to have Processor return Controller Personal Data in a commonly used electronic format using the standard export functionality of the Lemax system; return in other formats is provided at Processor’s then-current professional services rates. Within thirty (30) days after that period, or earlier on Controller’s written instruction, Processor shall delete all copies of Controller Personal Data held by Processor and shall procure that its Sub-processors do the same, subject to Sections 12.3 and 12.4.
12.3Controller Personal Data held in backups shall be deleted in accordance with Processor’s backup rotation cycle and shall not be restored except as required by law or to recover from a technical incident. Any deleted Controller Personal Data that is restored from a backup shall be deleted again without undue delay.
12.4Processor may retain Controller Personal Data to the extent and for the period required by applicable law to which Processor is subject, ensuring its confidentiality and Processing it only for that purpose. On request, Processor shall confirm deletion in writing.
13. Audit
13.1Processor shall make available to Controller, on request, the information reasonably necessary to demonstrate compliance with this Agreement, including certifications held by Processor (if any), responses to reasonable security questionnaires (once per year, and additionally at onboarding or following a Personal Data Breach affecting Controller Personal Data), and the current Annex 2.
13.2Where the information under Section 13.1 is not sufficient to demonstrate compliance, Controller, or an independent auditor appointed by Controller and bound by confidentiality obligations, may audit Processor’s compliance with this Agreement, subject to: (a) not more than once in any twelve (12) month period, unless required by a Supervisory Authority or following a Personal Data Breach affecting Controller Personal Data; (b) at least thirty (30) days’ written notice and a mutually agreed scope, except where a shorter period is reasonably required following a Personal Data Breach affecting Controller Personal Data or by a Supervisory Authority; (c) conduct during normal business hours with minimal disruption to Processor’s operations; (d) no access to the data of Processor’s other customers or to information unrelated to Controller Personal Data; and (e) Controller bearing its own costs and reimbursing Processor’s reasonable costs where the audit exceeds two (2) business days.
13.3Audit findings are confidential information of Processor. Controller shall share findings with Processor and allow Processor a reasonable period to remediate before relying on the findings for any other purpose, except where immediate action is required by applicable law, a Supervisory Authority or a material security risk to Controller Personal Data.
14. International transfers
14.1Processor shall not transfer Controller Personal Data to a Third Country, or permit a Sub-processor to do so, unless an Approved Transfer Mechanism is in place. The locations of Processing by Authorised Sub-processors and the applicable transfer mechanisms are set out in the Sub-processor List. For transfers to the United States, the Standard Contractual Clauses are the primary mechanism, with the EU-US Data Privacy Framework relied on additionally where the recipient is certified. Processor maintains a transfer impact assessment for each Third Country transfer and provides a summary to Controller on request.
14.2Where the Standard Contractual Clauses are the Approved Transfer Mechanism for a transfer from Controller (as data exporter) to Processor (as data importer), the Standard Contractual Clauses, Module Two (controller to processor) or Module Three (processor to processor) as applicable, are incorporated into this Agreement by reference, with the information required by their Annexes I to III taken from Annex 1, Annex 2 and the Sub-processor List respectively, and with the optional docking clause and the governing law and forum of Croatia selected. Processor shall provide a signed copy on request. Where UK Data Protection Laws apply to a transfer, the Standard Contractual Clauses apply together with the UK International Data Transfer Addendum issued by the UK Information Commissioner (or the UK International Data Transfer Agreement, where applicable), which is incorporated by reference with the parties’ details taken from this Agreement.
14.3Where a Supervisory Authority or court requires additional measures for a transfer, the parties shall cooperate in good faith to implement them. If that is not possible, Controller may instruct Processor to suspend the affected transfer, and Controller’s further rights and remedies are those available under the Principal Agreement. A transfer restriction arising under this Section does not of itself constitute a breach of this Agreement or the Principal Agreement by Processor, and any unavailability or reduction of the Services resulting solely from a suspension instructed by Controller or required by law does not constitute a breach of the Principal Agreement or of any service level commitment, provided Processor uses reasonable efforts to identify an alternative.
15. Codes of conduct and certification
15.1Processor shall, on request, provide Controller with evidence of any information security certifications it holds.
15.2Processor may, at its discretion, adhere to codes of conduct approved under Article 40 GDPR or obtain certifications under Article 42 GDPR, and shall inform Controller of any it obtains. Nothing in this Agreement obliges Processor to adhere to any particular code of conduct or to obtain any particular certification at Controller’s request.
16. Liability
16.1Each party’s liability arising out of or in connection with this Agreement, including under any indemnity, is subject to the limitations and exclusions of liability set out in the Principal Agreement. Nothing in this Agreement increases either party’s aggregate liability beyond what is agreed in the Principal Agreement.
16.2Each party is liable to Data Subjects and Supervisory Authorities to the extent provided in Articles 82 and 83 GDPR. Where both parties are held liable, each party bears the share corresponding to its responsibility for the damage.
17. Term, changes and general
17.1This Agreement takes effect on the effective date of the Principal Agreement (or, if later, the date on which this Agreement is signed or incorporated) and terminates automatically on termination or expiry of the Principal Agreement. Upon signature or incorporation, this Agreement replaces any previous data processing agreement or addendum between the parties relating to the Services. Processor’s obligations under this Agreement continue to apply to any Controller Personal Data that Processor holds after termination, until that data has been returned or deleted in accordance with Section 12. Sections 12, 13 and 16 survive termination.
17.2Processor may update this Agreement by written notice to Controller, with effect thirty (30) days after the notice, (a) where the update is required by a change in Data Protection Laws or by guidance or a decision of a Supervisory Authority, or (b) to update Annex 2 to reflect changes in the Services, provided the overall level of security is not materially reduced. Any other change to this Agreement, including any change to Annex 1, requires the written agreement of both parties.
17.3A breach of this Agreement constitutes a breach of the Principal Agreement only if it is a Material Breach and Processor has not remedied it within the cure period provided in the Principal Agreement or, where the Principal Agreement provides no cure period, within ninety (90) days of written notice from Controller. A breach that cannot be reversed is deemed remedied when Processor has taken the measures reasonably necessary to prevent its recurrence.
17.4In the event of conflict, the following order of precedence applies with respect to the Processing of Controller Personal Data: (a) the Standard Contractual Clauses, where applicable; (b) this Agreement; (c) the Principal Agreement.
17.5This Agreement is governed by the governing law of the Principal Agreement, provided that it is the law of an EU Member State; otherwise by the laws of the Republic of Croatia, without prejudice to mandatory provisions of Data Protection Laws.
17.6If any provision of this Agreement is invalid or unenforceable, the remainder remains in force and the invalid provision shall be replaced by a valid one that most closely reflects the parties’ intention.
17.7Notices under this Agreement shall be sent in writing to the addresses stated in the Principal Agreement. Notices to Processor concerning data protection shall be copied to admin@lemax.net.
Signatures
Where this Agreement is attached to and incorporated in the Principal Agreement, the signature of the Principal Agreement constitutes acceptance of this Agreement and no separate signature is required. Where this Agreement is signed as a separate addendum:
| Controller | Processor |
| Company: ____________________ | Company: Lemax d.o.o. |
| Name: ______________________ | Name: Mate Kostovski |
| Title: ______________________ | Title: Chief Executive Officer |
| Signature: __________________ | Signature: __________________ |
| Date: ______________________ | Date: ______________________ |
Annex 1: Details of Processing
Subject matter and duration
The provision of the Lemax system and related Services under the Principal Agreement, for the term of the Principal Agreement and any post-termination retention period under Section 12.
Nature and purpose of Processing
- Lemax system: reservation and booking process activities (creation, management, fulfilment of travel bookings)
- Lemax system: reporting and analytics activities
- Lemax system: integration with Controller’s other systems and processors, as configured by Controller
- Lemax system: AI Features, being the generation of drafts, summaries, translations, classifications and suggestions from reservation and communication data, for review by Controller’s users, using AI Sub-processors listed in the Sub-processor List
- Hosting of Controller’s website (where included in the Principal Agreement)
- Support, maintenance and security of the Lemax system
Types of Personal Data
- Identification data: name, middle name, surname, date and place of birth, sex, citizenship / nationality
- Contact data: email, postal address, phone / mobile number
- Identity document data: personal ID number, passport number, passport issue and expiry dates
- Travel data: arrival / departure details, travelling party details, reservation and travel details, services booked, interests and preferences, remarks
- Technical data: IP address, user account data
- Special Categories of Personal Data (Article 9 GDPR): data concerning health, and data from which religious or philosophical beliefs may be inferred (e.g. dietary requirements), may be Processed only where submitted by Controller or its travellers in free-text fields (e.g. allergies, dietary requirements, special assistance and medical requirements). Controller is responsible for the lawful basis for such Processing (Section 4).
Categories of Data Subjects
- Controller’s customers and travellers / passengers
- Controller’s employees and users of the Lemax system
- Controller’s suppliers, travel agents and business partners (contact persons)
- Visitors to Controller’s website, where hosted by Processor
Annex 2: Technical and organisational measures
Organisational measures
- Security policy and procedures: Processor documents a security policy with regard to the Processing of Personal Data.
- Roles and responsibilities: roles and responsibilities related to the Processing of Personal Data are defined and allocated in accordance with the security policy; on internal re-organisation, termination or change of employment, revocation of rights and hand-over procedures are defined.
- Access control policy: access rights are allocated to each role involved in the Processing of Personal Data on a need-to-know basis.
- Resource and asset management: Processor maintains a register of the IT resources used for the Processing of Personal Data (hardware, software and network), maintained by an assigned person.
- Change management: changes to the IT system are registered and monitored by an assigned person and the process is regularly reviewed.
- Incident handling: an incident response plan is defined to ensure an effective and orderly response to incidents concerning Personal Data; Personal Data Breaches are reported in accordance with Section 10.
- Business continuity: procedures and controls are established to ensure the required level of continuity and availability of the IT system Processing Personal Data in the event of an incident.
- Personnel: employees are informed of their responsibilities and obligations related to the Processing of Personal Data during pre-employment or induction, and are informed about the security controls relevant to their work and about data protection requirements through regular awareness activities.
Technical measures
- Access control and authentication: an access control system is implemented for all users of the IT system, allowing accounts to be created, approved, reviewed and deleted; shared accounts are avoided and, where necessary, limited to users with the same role; the need-to-know principle is applied when granting access; where authentication is password-based, passwords are subject to Processor’s password policy on length, complexity and non-repeatability; credentials are never transmitted unprotected over the network.
- Logging and monitoring: log files are activated for each system or application used for the Processing of Personal Data, covering access to data (view, modification, deletion).
- Server and database security: database and application servers run under separate accounts with minimum operating system privileges, and Process only the Personal Data required for the Processing purposes.
- Workstation security: users cannot deactivate or bypass security settings; anti-virus software and detection signatures are updated regularly; users cannot install or deactivate unauthorised software; sessions time out after a period of inactivity; critical security updates from the operating system vendor are installed regularly.
- Network and communication security: access over the Internet is encrypted through cryptographic protocols; traffic to and from the IT system is monitored and controlled through firewalls and intrusion detection systems.
- Backups: backup and restore procedures are defined, documented and linked to roles and responsibilities; backups receive physical and environmental protection consistent with the originating data; execution of backups is monitored for completeness.
- Mobile and portable devices: management procedures define rules for proper use; devices allowed to access the information system are pre-registered and pre-authorised.
- Application lifecycle security: recognised secure development practices are followed during the development lifecycle.
- Data deletion and disposal: software-based overwriting is performed on media prior to disposal or, where not possible, physical destruction; paper and portable media used to store Personal Data are shredded.
- Physical security: the physical perimeter of the IT system infrastructure is not accessible to unauthorised personnel; appropriate technical or organisational measures protect security areas and their access points.
Annex 3: Sub-processor List
The Authorised Sub-processors are set out in the Sub-processor List published at https://www.lemax.net/legal/subprocessors. The list below reproduces the Sub-processor List as at the effective date of this version. Processor provides the current Sub-processor List to Controller with each notification under Section 7.2; in case of discrepancy, the most recent Sub-processor List notified to Controller under Section 7.2 prevails.
| No. | Sub-processor (legal name) | Processing activity | Location(s) | Transfer mechanism |
| 1 | LeaseWeb Deutschland GmbH | Hosting of the Lemax system | Germany | EEA |
| 2 | LeaseWeb Netherlands B.V. | Hosting of the Lemax system | The Netherlands | EEA |
| 3 | LeaseWeb USA, Inc. | Hosting of the Lemax system | United States | DPF |
| 4 | LeaseWeb Asia Pacific PTE. LTD. | Hosting of the Lemax system | Singapore, Hong Kong | SCC |
| 5 | Amazon Web Services EMEA SARL / Amazon Web Services, Inc. | Hosting of the Lemax system | Germany, Singapore | DPF |
| 6 | Google Cloud EMEA Limited / Google LLC | Hosting of the Lemax system | EU | DPF |
| 7 | Microsoft Ireland Operations Ltd / Microsoft Corporation | Hosting of the Lemax system | Ireland/EU | DPF |
| 8 | Elasticsearch B.V. | Hosting of parts of the Lemax system (search functionality) | Germany | DPF |
| 9 | New Relic, Inc. | System performance monitoring and analysis | United States, Germany | DPF |
| 10 | Cloudflare, Inc. | Content delivery network and security | Global anycast network; data at rest in EU | DPF |
| 11 | OpenAI Ireland Limited | AI Sub-processor: AI Features (enterprise / API terms, no training) | Ireland, United States | SCC |
| 12 | Anthropic entity per signed DPA, e.g. Anthropic PBC / Anthropic Ireland Limited | AI Sub-processor: AI Features (enterprise / API terms, no training) | United States | SCC |
Version history: v2.0, 15 September 2026.