Data Processing Agreement

1. Parties and Roles

For personal data you submit or generate through the services, you are the controller — you decide whose data it is, why you hold it, and what happens to it. LexLab is the processor, acting on your instructions.

For a small set of data we decide about ourselves — your account details, order records, security and abuse logs — we are the controller. That is covered by the Privacy Policy, not by this DPA.

Marketplace orders are relayed to the seller who listed the item, and SMM orders to the upstream panel we use. They receive what the order needs — the item, the target link or username you entered, the quantity — and act under their own terms. They are not processors acting for you through us.

Where you resell LexLab services, you are the controller toward your own customers, and you are responsible for having a lawful basis and equivalent terms in place with them.

2. Your Instructions

We process personal data only to deliver the services you bought, and only as instructed by you through the dashboard, the API, the SMTP interface, or a written request. Your use of the services is the instruction.

We will also process data where law requires it. If we are compelled to do something outside your instructions, we will tell you before doing so unless the law forbids that notification.

If an instruction from you appears to break data protection law, we will say so and may decline it.

3. What We Process

Processing lasts for as long as you hold the service, plus the windows in Section 8.

4. Special Category Data

The services are not designed for special category data under GDPR Article 9 — health, biometric, genetic, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation — nor for criminal offence data, payment card numbers, or government identifiers. Do not send it through LexLab without agreeing additional terms with us in writing first.

5. Confidentiality

LexLab is run by one engineer. Nobody else on our side has access to your data. The sub-processors in Section 7 see only what their job needs. We do not sell your data, use it for advertising, or use it to train models.

6. Security Measures

We maintain technical and organisational measures appropriate to the risk, including:

• TLS in transit for web, API and SMTP submission, with opportunistic TLS on outbound relay
• Encryption at rest on hosted storage where Contabo supports it
• Administrative access held by one person, behind a separate login from customer accounts
• Credential and API key isolation per customer account
• Request-level filtering against injection and cross-site scripting at the application edge
• Logging of administrative access and abuse-relevant events
• A separate Contabo instance per hosting customer; nothing is shared between VPS tenants
• Regular backups of the platform server, held with the same provider in Germany

These measures change as threats change. We may replace a measure with an equivalent or stronger one without notice, and will not reduce the overall level of security during your term.

7. Sub-processors

You give general authorisation for us to use the sub-processors below. Each is bound by data protection terms no less protective than this DPA, either through a contract with us or through terms they publish.

NOWPayments does not receive your name or email from us. It sees an order reference, the amount and a short description.

We give 30 days' notice before adding or replacing a sub-processor, by a notice on this site, by email, or on Telegram. If you have a data protection objection, tell us within that window. If we cannot resolve it, you may terminate the affected service and receive a refund of any unused prepaid period.

8. Retention and Deletion

• While the service is live — data stays for as long as you keep it there. You control deletion through the dashboard, the API, or by deleting it on your own server.
• When the contract ends — within 30 days we delete the data or, if you ask before then, return it to you first. Delivery and bounce logs are part of the service data and go on the same schedule.
• Backups — deleted data persists in backups until they rotate. Backups are overwritten within a further 30 days.
• Legal holds — order records and anything under a legal or law enforcement obligation are kept for the period the law requires, regardless of the above.

Ask for written confirmation of deletion and we will provide it.

9. Assisting You

We will help you meet your own obligations, within what we can actually see:

• Data subject requests. If a recipient or end user contacts us directly, we forward the request to you and do not answer it ourselves. Where the data sits in a system only we can reach, we will help you locate, export, correct or delete it.
• Impact assessments and prior consultation. We will provide the information we hold that you reasonably need.
• Audits. We answer written security questionnaires within 15 business days, and provide a summary of our security measures once a year on request. On-site audits happen only where the law requires them, by prior arrangement and at your cost.

10. Personal Data Breach

If we become aware of a breach affecting your personal data, we notify you within 48 hours of becoming aware of it. Notification goes to your account email address, and to Telegram if you have linked the bot. Keep both current.

We will tell you what we know: what happened, which data and roughly how many records are involved, what we have done, and what we recommend you do. Early notification may be incomplete; we update as the investigation progresses. Reporting to your supervisory authority and to affected individuals is your responsibility as controller.

11. International Transfers

The platform server, the database and the backups are in Germany. Some sub-processors are outside the EEA and the UK. Where personal data moves to a country without an adequacy decision, the transfer relies on the European Commission's Standard Contractual Clauses, with the UK Addendum where UK data is involved, or on the sub-processor's own approved transfer mechanism. Those terms are incorporated into this DPA by reference.

We have not appointed an EU or UK representative under GDPR Article 27 or the UK GDPR. Contact us directly at the address in Section 13.

Hosted workloads stay in the Contabo region you pick at provisioning; the default is the EU. Email delivery cannot be geographically constrained — messages go wherever the recipient's mail server is.

12. Liability, Term and Law

This DPA runs for as long as we process personal data on your behalf. Liability under it is subject to the limitations in the Terms of Service. Where this DPA conflicts with the Terms on the handling of personal data, this DPA wins. Governing law and venue follow the Terms of Service, Section 15.

13. Contact

Data protection questions, DPA signature requests, sub-processor objections and breach correspondence: support@lexlabtools.com, or @lexlabtools on Telegram.