Skip to content
Sign in

Legal

Data processing agreement

The data processing agreement between your organisation (the controller) and us (the processor) for personal data in the questions, documents and transcripts your members put into Gelex. It forms part of the terms of service; no signature is needed.

Last changed October 21, 2026
These pages may still change
Gelex has not launched yet. We may still adjust these pages before launch, for example once we have appointed our data protection officer. Every change is dated in the changelog at the foot of the page.

1. Subject matter, duration, nature and purpose

Subject matter: providing the service under the terms of service. Duration: the subscription, plus the period needed to return and delete data. Nature and purpose: hosting, searching and transmitting customer content so members can research the law with an AI model of the controller's choosing.

Categories of data subjects: the controller's members, and any person named in content the members enter. Types of personal data: whatever the members enter; the service is not designed for special categories (Art. 9) or criminal-offence data (Art. 10), and the controller decides whether to enter them.

2. Instructions

We process customer personal data only on the controller's documented instructions — the terms, this agreement and the settings the controller chooses in the app — unless EU or member-state law requires otherwise, in which case we tell the controller first unless the law forbids it. We tell the controller if we think an instruction infringes data protection law.

3. Confidentiality

Everyone authorised to process customer personal data is bound by confidentiality.

4. Security measures

  • Hosting in the EU (Hetzner, Nuremberg, Germany); encryption in transit. Backups are kept on our server; the off-site copy, once made, is encrypted.
  • No storage of question or answer text unless the controller turns transcripts on; transcripts are encrypted under a key specific to the organisation.
  • AI provider keys sealed when saved; afterwards the app shows only their last four characters.
  • Role-based access within the organisation; passkeys and second factors supported; organisation-level single sign-on through the organisation's own identity provider (Microsoft Entra ID, Google, Okta or any OpenID Connect provider), once the organisation has proved its email domain.
  • Append-only audit log with a signed export.
  • Our staff work through the staff console. It requires a staff account with a second factor and a sign-in from the last 12 hours. Every change staff make to an organisation needs a reason and is recorded in that organisation's own audit log. Granting or removing staff access is recorded in our own audit log. Changing a price, issuing or paying an invoice, recording a VAT number check or changing a retention period from the server's own command line also requires the operator's name and a reason. Support may look at an organisation as a member, read-only, for at most 30 minutes; that is recorded in the organisation's log too. Personal data breaches are handled as set out under Assistance.

5. Subprocessors

The controller gives general authorisation for the subprocessors on the subprocessor list. We give at least 30 days' notice of an addition or replacement by email and on that page; the controller may object on reasonable data protection grounds and, if we cannot resolve the objection, end the affected service with a pro-rata refund. Each subprocessor is bound by data protection obligations equivalent to these, and we remain responsible for it.

The AI provider the controller connects is engaged by the controller, under the controller's own agreement with it, and is not our subprocessor.

6. Assistance

We help the controller answer data-subject requests — the app's export and delete functions cover most — and with security, breach notification, impact assessments and prior consultation, taking into account what we can know. We notify the controller of a personal data breach without undue delay, and aim to within 48 hours of becoming aware of it.

7. Return and deletion

While your organisation is open, the controller can export its data at any time. When it closes, we delete the customer personal data it holds 30 days later, including from backups as they rotate, unless law requires us to keep it.

8. Information and audits

We make available the information needed to demonstrate compliance with Art. 28 and allow for audits by the controller or an auditor it mandates, on reasonable notice and at most once a year unless a breach or an authority requires otherwise. We hold no security certification yet, and no independent penetration test; when we hold one, it is listed here with its date.

Changelog

  1. , version 1: First version.