Data Processing Agreement in 5 minutes.

What is a DPA?

A Data Processing Agreement (DPA) is a legal requirement under GDPR. It governs the relationship between the data controller, namely your law firm, and the data processor, namely Levano. It specifies what we may do with your data, where it is stored, for how long, and how you can have it deleted.

Why law firms need one

• Legal requirement. GDPR Article 28 requires it for all data processors.
• The bar association. The quality framework requires documentation of data processors.
• Client trust. Your clients expect you to have your sub-processors under control.

Key points in Levano's DPA

a) The processor's role

Levano is the data processor. Your firm is the data controller. Levano processes data only on your documented instructions.

b) Sub-processors

The list of approved sub-processors is publicly available in our sub-processor list. You receive 30 days' notice before any change.

c) Technical and organisational measures

ISO 27001, ISO 42001, encryption (TLS 1.3 and AES-256), RBAC, audit trail and EU hosting.

d) Deletion and return

On termination, all data is exported and deleted within 30 days. Atomic deletion across all systems.

e) Audit rights

You have the right to audit us once a year (or on suspicion of a breach). We provide ISO reports and Vanta documentation as standard.

f) Personal data breaches

We notify you within 24 hours of a breach. The notification includes assessment, actions and next steps.

g) Data subject requests

GDPR access requests, deletion and data portability: we assist within 5 business days.

h) Geographic location

Data stays in the EU. Specifically the Western Europe region, primarily Denmark.

i) AI-specific processing

The Anthropic ZDR agreement is documented separately. No training on your data.

j) Dispute resolution

Danish jurisdiction. Disputes are settled at the Copenhagen City Court, with the option of mediation first.

How to get a signed DPA

1. Download the DPA template (PDF).
2. Read it. We recommend 15 minutes.
3. Sign digitally with Levano's own signing (link provided at onboarding).
4. Save the signed copy in your document system.
5. Send it to contact@levano.io for our countersignature.
6. Within 24 hours you receive a fully countersigned PDF back.

Custom adjustments

For larger clients or specialised requirements (public sector, financial sector) we offer custom adjustments to our DPA. Get in touch before signing if you have specific requirements.

Frequently asked questions

How long does the DPA apply?

For as long as you are a Levano customer. On termination it continues for 30 days, until data export and deletion are complete.

What happens if we change our use of Levano, e.g. start using new features?

The DPA covers the whole of Levano. New features do not change the basis for the data processing.

What if we have our own DPA template?

We can review your template and suggest adjustments. This typically takes 5 to 10 business days.

Does the DPA include sub-processors?

Yes. Approval of sub-processors is part of the DPA, with a 30-day notice rule. See the full sub-processor list.

Do we update the DPA when we add new seats?

No. The DPA applies to the whole firm regardless of the number of users.

What happens in a data breach?

We notify you within 24 hours with assessment, actions and next steps. You remain responsible towards your own clients. We assist.

Can we get the DPA in English?

Yes. The DPA is available in Danish and English.

Ready to get the DPA signed?

Download the template, read it at your own pace, and sign digitally. The whole thing takes five minutes, and you are compliant from day one.

Download the DPA template or sign digitally with Levano's own signing.