DATA PROCESSING
AGREEMENT
Effective date: 1 January 2025 · Last updated: 1 August 2025
1. Scope and applicability
This Data Processing Agreement ("DPA") forms part of the Lengdon Terms of Service and applies to all processing of Personal Data by Lengdon on behalf of Customers in connection with the provision of the closing infrastructure platform. This DPA applies where and to the extent that Lengdon processes Personal Data that is subject to applicable Data Protection Laws on behalf of the Customer.
2. Definitions
"Controller" means the entity that determines the purposes and means of processing Personal Data. "Processor" means the entity that processes Personal Data on behalf of the Controller. "Personal Data" means any information relating to an identified or identifiable natural person. "Processing" means any operation performed on Personal Data. "Data Protection Laws" means all applicable laws relating to processing of Personal Data, including GDPR, UK GDPR, and CCPA where applicable.
3. Roles of the parties
With respect to Personal Data of the Customer's end users (counterparties, investors, founders, and advisors) processed through the Lengdon platform, the Customer acts as Controller and Lengdon acts as Processor. With respect to account data and billing information, Lengdon acts as Controller.
4. Lengdon's processing obligations
Lengdon will: (a) process Personal Data only on documented instructions from the Customer; (b) ensure that persons authorized to process Personal Data are subject to confidentiality obligations; (c) implement appropriate technical and organizational security measures; (d) assist the Customer in responding to data subject requests; (e) delete or return Personal Data at the end of the service relationship; (f) provide all information necessary to demonstrate compliance.
5. Security measures
Lengdon implements technical and organizational measures appropriate to the risks, including: encryption of Personal Data at rest using AES-256 and in transit using TLS 1.3; access controls requiring individual authentication for each transaction room participant; append-only audit logging of all access and processing activities; regular penetration testing and vulnerability assessments; employee training on data protection obligations.
6. Sub-processors
Lengdon uses sub-processors to assist in providing the platform. A current list of sub-processors is maintained at lengdon.com/legal/sub-processors. Lengdon will notify the Customer of any intended additions or replacements of sub-processors, providing at least 30 days notice. The Customer may object to sub-processor changes during this period.
7. International data transfers
Where Lengdon transfers Personal Data outside the European Economic Area or United Kingdom, it does so pursuant to Standard Contractual Clauses as adopted by the European Commission, or such other legally adequate transfer mechanism as may be applicable. A copy of applicable Standard Contractual Clauses is available upon request.
8. Data subject rights
Lengdon will assist the Customer in fulfilling obligations to respond to data subject requests, including requests for access, rectification, erasure, restriction of processing, data portability, and objection to processing. Given the nature of the Lengdon platform — which produces append-only audit records — certain erasure requests may be subject to retention requirements under applicable law.
9. Audit rights
Upon reasonable notice, Lengdon will make available to the Customer all information necessary to demonstrate compliance with this DPA and allow for audits conducted by the Customer or an auditor mandated by the Customer. Lengdon may satisfy audit requirements through the provision of relevant certifications and third-party audit reports.
10. Term and termination
This DPA remains in force for the duration of the Lengdon Terms of Service. Upon termination, Lengdon will, at the Customer's election, delete or return all Personal Data, and delete existing copies unless applicable law requires retention. Lengdon's obligation to maintain the immutability and integrity of sealed close records is not affected by termination.
Questions about this DPA? Contact our data protection team at privacy@lengdon.com. For a copy of applicable Standard Contractual Clauses or for enterprise DPA execution, contact us directly.