Data Processing Agreement in 5 minutes.

What is a DPA?

A Data Processing Agreement (DPA) is a legal requirement under GDPR. It governs the relationship between the data controller, namely your law firm, and the data processor, namely Levano. It specifies what we may do with your data, where it is stored, for how long, and how you can have it deleted.

Why law firms need one

• Legal requirement. GDPR Article 28 requires it for all data processors.
• The bar association. The quality framework requires documentation of data processors.
• Client trust. Your clients expect you to have your sub-processors under control.

Key points in Levano's DPA

a) The processor's role

Levano is the data processor. Your firm is the data controller. Levano processes data only on your documented instructions.

b) Sub-processors

The list of approved sub-processors is publicly available in our sub-processor list. You receive 30 days' notice before any change.

c) Technical and organisational measures

ISO 27001, ISO 42001, encryption (TLS 1.3 and AES-256), RBAC, audit trail and EU hosting.

d) Deletion and return

On termination, all data is exported and deleted within 30 days. Atomic deletion across all systems.

e) Audit rights

You have the right to audit us once a year (or on suspicion of a breach). We provide the documentation we hold, including the description of the security measures and the sub-processor list. There is no independent auditor's report on our controls today.

f) Personal data breaches

We notify you within 24 hours of a breach. The notification includes assessment, actions and next steps.

g) Data subject requests

GDPR access requests, deletion and data portability: we assist within 5 business days.

h) Geographic location

Your cases and documents are stored in the EU. The vendors that process data outside the EU are named on our sub-processor list and are covered by EU Standard Contractual Clauses.

i) AI-specific processing

Our data processing agreement with Anthropic is documented separately. No training on your data.

j) Dispute resolution

Danish jurisdiction. Disputes are settled at the Copenhagen City Court, with the option of mediation first.

How to get a signed DPA

1. Request the draft at contact@levano.io or through the Trust Center.
2. We send the version that exists today, along with the sub-processor list.
3. Read it and send us the changes you need. The agreement is written for law firms, but it is not finally negotiated.
4. Once both sides have approved the text, we sign it digitally and you receive a countersigned copy for your own document system.

Custom adjustments

For larger clients or specialised requirements (public sector, financial sector) we offer custom adjustments to our DPA. Get in touch before signing if you have specific requirements.

Frequently asked questions

How long does the DPA apply?

For as long as you are a Levano customer. On termination it continues for 30 days, until data export and deletion are complete.

What happens if we change our use of Levano, e.g. start using new features?

The DPA covers the whole of Levano. New features do not change the basis for the data processing.

What if we have our own DPA template?

We can review your template and suggest adjustments. This typically takes 5 to 10 business days.

Does the DPA include sub-processors?

Yes. Approval of sub-processors is part of the DPA, with a 30-day notice rule. See the full sub-processor list.

Do we update the DPA when we add new seats?

No. The DPA applies to the whole firm regardless of the number of users.

What happens in a data breach?

We notify you within 24 hours with assessment, actions and next steps. You remain responsible towards your own clients. We assist.

Can we get the DPA in English?

The draft is currently available in Danish. Tell us if you need an English version and we will arrange it.

Want to see the draft?

The agreement is in legal review, and we do not ask anyone to sign a draft. Request it through the Trust Center and we will send the version that exists today, along with the sub-processor list.

Once it has been reviewed and approved, it can be signed digitally with Levano's own signing.