Data processing agreement
Version 1 · effective 15 October 2026 · All versions · This is the current version
This data processing agreement ("DPA") is part of the Terms of Service and applies to every organisation account (Terms, section 4). It is concluded between the organisation that holds the account ("Customer") and Eureka.legal, Denmark ("Eureka").
1. Roles
- For the personal data of the Customer's members that Eureka processes to provide the Service to the Customer ("Customer Data", Annex 1), the Customer is the controller and Eureka is the processor within the meaning of article 28 of the General Data Protection Regulation (GDPR).
- Eureka is an independent controller for the data it processes for its own purposes, as described in the privacy policy: the administration of accounts and plans, billing, request logs and security, and pseudonymous statistics used to improve the Service. These purposes are not covered by this DPA.
- Members who also use the Service privately (for instance after leaving the organisation) are served under the privacy policy, not under this DPA.
2. Subject matter, duration, nature and purpose
The processing is described in Annex 1. It lasts as long as the organisation account exists and until the Customer Data has been deleted or returned under section 9.
3. Instructions
Eureka processes Customer Data only on the Customer's documented instructions. The Terms, this DPA, the configuration of the organisation account by its administrators and the use of the Service by the members are the Customer's instructions. Eureka informs the Customer without delay if, in its opinion, an instruction infringes the GDPR or other data protection law. Eureka processes Customer Data outside the instructions only where EU or Member State law requires it, and then tells the Customer of that requirement before processing, unless the law forbids it.
4. Confidentiality
Everyone Eureka authorises to process Customer Data is bound by confidentiality, by contract or by law, and has access only as far as needed to provide the Service.
5. Security
Eureka implements the technical and organisational measures of Annex 2, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks for the rights and freedoms of natural persons (GDPR article 32). Eureka may improve the measures over time as long as the level of protection does not fall.
6. Sub-processors
The Customer authorises Eureka to engage the sub-processors listed in Annex 3. Eureka imposes on each sub-processor, by contract, data protection obligations equivalent to this DPA and remains responsible to the Customer for the sub-processor's performance. Eureka announces an intended addition or replacement of a sub-processor at least 30 days before it takes effect, by a new version of this DPA (see all versions) and by e-mail to the organisation's administrators. The Customer may object on reasonable data protection grounds within those 30 days; if the parties find no solution, the Customer may end the organisation account with immediate effect and is refunded the unused part of any prepaid period.
7. Assistance to the Customer
- Data subject requests: members can see, change and delete their own data on the account page. Eureka helps the Customer answer requests that reach Eureka directly by forwarding them to the Customer without delay and by providing the information the Customer needs.
- Personal data breaches: Eureka notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information the Customer needs for its own notifications (GDPR articles 33 and 34), completed as it becomes available.
- Impact assessments and prior consultation: Eureka provides the information about its processing that the Customer reasonably needs (GDPR articles 35 and 36).
8. Information and audits
Eureka makes available the information necessary to demonstrate compliance with article 28 GDPR: this DPA, Annex 2 and, on request, a description of the hosting and the processing. The Customer, or an auditor it mandates who is not a competitor of Eureka, may audit the processing at most once a year, or after a personal data breach, with at least 30 days' notice, during business hours and without disturbing the Service; the parties agree on scope and method in advance. Each party bears its own costs; where the audit shows no material non-compliance, the Customer bears Eureka's reasonable costs.
9. Deletion and return
When the organisation account ends, the Customer's administrators can remove the members; each member keeps a private account unless they delete it. On the Customer's request, made within 30 days after the account ends, Eureka provides an export of the Customer Data (members, follows and notifications) in a machine-readable form and deletes the Customer Data that Eureka does not need to keep under EU or Member State law. What remains afterwards is the pseudonymous history described in the privacy policy, which no longer points at a person or at the Customer.
10. Where the data is processed
Customer Data is stored and processed in the European Union (Annex 3). Eureka engages a sub-processor outside the European Economic Area only where Annex 3 says so, and then only in a country for which the European Commission has decided that the protection is adequate.
11. Liability, term and precedence
Liability under this DPA follows the Terms. This DPA applies for as long as the organisation account exists and until section 9 has been carried out. Changes to this DPA are published as new versions in the same way as changes to the Terms (Terms, section 14), and the Customer's continued use of the organisation account after a new version applies constitutes its acceptance; a change of sub-processor follows section 6. Where this DPA and the Terms conflict, this DPA prevails for the processing of Customer Data. This DPA is governed by the laws of Denmark and the courts of Denmark have jurisdiction, as in the Terms.
Annex 1: the processing
| Subject matter | Providing the Service to the Customer's members: the extension on EUR-Lex, the reader on eureka.legal, follows, notifications and e-mail alerts, under the organisation account. |
|---|---|
| Nature | Storage, retrieval, display, e-mail delivery, pseudonymous usage recording, deletion. |
| Purpose | Letting the members read EU legislation with Eureka's features and receive news about the acts they follow; letting the Customer's administrators manage seats and members. |
| Categories of data subjects | The Customer's employees and other persons the Customer admits to the organisation account; the Customer's administrators. |
| Categories of personal data | E-mail address; organisation membership and role (administrator or member); plan; e-mail alert settings; the acts and articles a member follows and the notifications about them; connected browsers (install id, when added, last seen); the acts, languages and parts a member reads and the usage events in the Service, under the install id or account number; the articles a member shares; request logs (time, address, answer, install id or account number, user agent, IP address, shortened after 30 days). |
| Special categories | None are needed by the Service. The Customer instructs its members not to enter any in free-text fields (feedback, contact form). |
| Duration | Section 2 and section 9; retention as in the privacy policy. |
Annex 2: technical and organisational measures
- Hosting: servers in the European Union (Annex 3), with the hosting provider's physical and network security; firewall; only the web entry points are reachable from the internet.
- Encryption: all connections between browsers, the website, the extension and the Eureka service use HTTPS/TLS; the hosting provider encrypts storage at rest.
- Authentication: no passwords; one-time sign-in links by e-mail with a short validity; per-browser keys that the member or an administrator can revoke at any time; administrator access to the Service's internal pages only from the operator's network, over an authenticated channel.
- Pseudonymisation and minimisation: usage data and logs are keyed on an install id or account number, never on the e-mail address; IP addresses are shortened after 30 days; the text of the EUR-Lex page is read in the browser and not uploaded; AI providers receive the published text of acts and, when a search for an act finds nothing, the text of that search, never Customer Data.
- Separation: development and production run on separate servers with separate databases; production data is not used in development, with the exception of the published content of acts.
- Availability and recovery: daily backups of the database, kept on the hosting provider's storage in the EU; restoration procedure tested on deployment; monitoring of errors and availability.
- Deletion: a member's deletion of the account removes the personal data and unlinks the history; sign-in links and connect codes are deleted when used or expired; backups expire on a rolling schedule.
- Organisation: a single operator with sole access to production; least-privilege service accounts; changes to the Service are reviewed and tested before deployment; sub-processors are bound by contract.
Annex 3: sub-processors
| Sub-processor | Purpose | Data | Location and safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the Eureka service, its database, the visitor statistics and the website | All Customer Data | Germany (EU) |
| Porkbun LLC | E-mail delivery: sign-in links and e-mail alerts | Recipient e-mail address and the content of the message | United States. Being replaced by a provider in the European Union or in a country with an adequacy decision; the replacement is announced as in section 6. |
| Anthropic, PBC | AI evaluations of acts (translation notices, timeline entries, summaries of changes, corrigenda verdicts) | None: receives the published text of acts and, when a search for an act finds nothing, the text of that search, which members are instructed not to fill with personal data; no Customer Data. Listed for transparency. | United States |
When paid plans start, the payment provider will be added here in a new version of this DPA, with the 30 days' notice of section 6, before any payment is taken.