← Back to Home

Data Processing Agreement

Last updated: March 2026

1. Scope & Purpose

This Data Processing Agreement (“DPA”) supplements the Terms of Service between you (“Data Controller”) and LetzEdge S.à r.l. (“Data Processor”). It governs the processing of personal data in accordance with GDPR Article 28 and applicable Luxembourgish data protection legislation.

2. Processing Details

Subject Matter: Execution of serverless functions and associated data processing on behalf of the Controller.

Duration: For the duration of the service agreement plus any legally mandated retention period.

Data Categories: Function payloads, execution logs, API request metadata, and any personal data processed through deployed functions.

3. Processor Obligations

LetzEdge shall: (a) process personal data only on documented instructions from the Controller; (b) ensure all personnel are bound by confidentiality; (c) implement appropriate technical and organizational security measures per GDPR Article 32; (d) assist the Controller with data subject requests and impact assessments.

4. Sub-Processors

LetzEdge shall not engage any sub-processor without prior written authorization from the Controller. A current list of approved sub-processors is maintained and available upon request. All sub-processors are EU-based entities subject to equivalent data protection obligations.

5. International Transfers

No personal data shall be transferred outside the European Economic Area. All processing occurs exclusively in our sovereign vault regions (Frankfurt, DE and Paris, FR). This commitment is contractually binding under GDPR Article 44.

6. Security Measures

LetzEdge implements state-of-the-art security measures including: AES-256 encryption at rest, TLS 1.3 in transit, hardware-isolated Firecracker microVMs, continuous vulnerability scanning, and SOC 2 Type II audited operations.

7. Data Breach Notification

In the event of a personal data breach, LetzEdge shall notify the Controller without undue delay and no later than 48 hours after becoming aware of the breach, providing all information required under GDPR Article 33.

8. Governing Law

This DPA is governed by the laws of the Grand Duchy of Luxembourg and the General Data Protection Regulation (EU) 2016/679. Any disputes shall be resolved under the exclusive jurisdiction of the courts of Luxembourg City.