Data Processing Addendum — Logiqum Software

v1.0 · 2026-11-04 · Effective 2026-11-04 · Processor: Logiqum Kft. (Logiqum Korlátolt Felelősségű Társaság), 2094 Nagykovácsi, Berkenye utca 8., Hungary · Company reg. no. 13-09-246330 · Tax no. 33020983-2-13

This Data Processing Addendum (“DPA”) forms part of the End User License Agreement (https://logrok.com/legal/eula) and any Order between Logiqum Kft. (“Logiqum”) and Customer (together, the “Agreement”). §15 of the End User License Agreement incorporates it by reference. It applies only to the extent that Logiqum processes Customer Personal Data on Customer’s behalf as a processor. It sets out the terms that Article 28 of the GDPR requires.

1. Definitions

Capitalized terms not defined here have the meaning given in the Agreement (for example Software, Agent, Customer Data, Operational Data, Order, Authorized Users, Affiliate, and Documentation).

• GDPR — Regulation (EU) 2016/679 (General Data Protection Regulation).
• Data Protection Laws — the GDPR, Hungarian Act CXII of 2011 on the right to informational self-determination and freedom of information, and any other data-protection law that applies to the processing of Customer Personal Data under the Agreement.
• Customer Personal Data — personal data contained in Customer Data that Logiqum processes on Customer’s behalf in providing the Processing Services.
• Processing Services — the activities listed in §2.2.
• Sub-processor — any third party that Logiqum engages to process Customer Personal Data.
• Personal Data Breach — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Logiqum or its Sub-processors.
• SCCs — the standard contractual clauses for the transfer of personal data to third countries adopted by Commission Implementing Decision (EU) 2021/914.
• Restricted Transfer — a transfer of Customer Personal Data to a country outside the European Economic Area that is not covered by an adequacy decision under Article 45 of the GDPR.
• controller, processor, data subject, personal data, processing, and supervisory authority have the meanings given in the GDPR.

2. Scope and roles

2.1 Roles. Customer is the controller of Customer Personal Data, or a processor acting for its own controller. Logiqum is Customer’s processor or, where Customer is itself a processor, Customer’s sub-processor. Where Customer acts as a processor, Customer warrants that its controller has authorized the instructions it gives and the appointment of Logiqum.

2.2 Processing Services. This DPA covers the following, to the extent they involve Customer Personal Data:

• (a) Support. Support bundles, diagnostic files, log extracts, configuration files, screenshots, and other material that Customer chooses to send to Logiqum in a support case, and support sessions that Customer starts and controls.
• (b) Hosted or managed services. Any service in which an Order provides that Logiqum hosts, operates, or manages the Software for Customer.
• (c) Professional services. Work in which Logiqum personnel access Customer’s deployment of the Software at Customer’s request (for example, installation, migration, or troubleshooting).

2.3 Outside the scope of this DPA.

• The self-managed Software. The Software runs in Customer’s own environment and is designed so that Customer log data stays there (Agreement §5 and §15). Logiqum does not receive or process the data that the self-managed Software processes, so Customer’s own use of it involves no processing by Logiqum as a processor. Managed-agent enrollment, heartbeat, and metrics are exchanged only with Customer’s own control plane.
• Operational Data. Optional telemetry is off by default, is enabled only by the operator, and never includes Customer log content or personal data of data subjects (Agreement §5).
• Logiqum’s own processing as controller of the business contact details of Customer’s personnel (for orders, billing, and correspondence) is described in the Privacy Policy (https://logrok.com/legal/privacy), not in this DPA.

2.4 Details of processing. The subject matter, duration, nature, and purpose of the processing, and the categories of personal data and data subjects, are described in Annex I.

3. Customer’s instructions

3.1 Logiqum processes Customer Personal Data only on Customer’s documented instructions, including with regard to Restricted Transfers, unless Union or Member State law to which Logiqum is subject requires otherwise; in that case Logiqum informs Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.2 Customer’s documented instructions are: the Agreement, this DPA, and any Order; the choices Customer makes when it sends material to Logiqum or starts a support session (for example, which support-bundle sections it includes); and any further written instruction that Customer gives and Logiqum accepts. An instruction that changes the scope of the Processing Services may be subject to an Order.

3.3 Logiqum immediately informs Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the affected processing until Customer confirms or changes the instruction.

4. Customer’s obligations

Customer is responsible for: the lawfulness of the processing it instructs, including having a legal basis and giving any notices required for Customer Personal Data it sends to Logiqum; sending only the Customer Personal Data a support case or service needs (the support bundle lets Customer choose its sections and redacts secret values automatically, and Customer may remove further data before sending); not sending special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR) unless the parties have agreed it in writing; and the security of its own deployment of the Software and of any medium it uses to carry data to Logiqum.

5. Logiqum’s obligations

Logiqum will:

• (a) Instructions. Process Customer Personal Data only on Customer’s documented instructions (§3), and only for the purposes in Annex I.
• (b) Confidentiality. Ensure that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and give access only to those who need it to provide the Processing Services.
• (c) Security. Take all measures required under Article 32 GDPR, including those in Annex II.
• (d) Sub-processors. Respect the conditions in §6 for engaging another processor.
• (e) Data subject requests. Taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests to exercise data subjects’ rights under Chapter III of the GDPR. If Logiqum receives such a request directly, it forwards it to Customer without undue delay and does not respond to it itself except on Customer’s instruction or where the law requires.
• (f) Assistance. Assist Customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR (security, Personal Data Breach notification and communication, data protection impact assessments, and prior consultation), taking into account the nature of the processing and the information available to Logiqum.
• (g) Deletion or return. At the end of the Processing Services, delete or return Customer Personal Data as described in §10.
• (h) Information and audits. Make available to Customer all information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, as described in §9.

Logiqum also keeps a record of processing activities carried out on Customer’s behalf (Article 30(2) GDPR), cooperates with supervisory authorities on request, and does not use Customer Personal Data, or Customer inputs, to train or fine-tune foundation models, or permit any model provider to do so (Agreement §14).

6. Sub-processors

6.1 General authorization. Customer gives Logiqum general written authorization to engage Sub-processors for the Processing Services, on the terms of this §6.

6.2 List on request. Logiqum does not publish the names of its Sub-processors; naming specific tools and providers publicly is an operational-security and competitive-intelligence risk. The current list of Sub-processors, with their location and the processing each performs, is available to Customer on written request to [email protected].

6.3 Notice of changes. Logiqum gives Customer at least 30 days’ advance notice of any intended addition or replacement of a Sub-processor, by email to Customer’s designated contact.

6.4 Objection. Customer may object to the change on reasonable data-protection grounds within 15 days of the notice. Absent a timely objection, the change is deemed accepted. If Customer objects, the parties will discuss the objection in good faith. If they cannot resolve it within a reasonable time, Customer may terminate the affected Processing Service by written notice, and Logiqum will not process Customer Personal Data for that service through the new Sub-processor before the termination takes effect.

6.5 Flow-down and liability. Logiqum imposes on each Sub-processor, by written contract, data protection obligations that offer the same level of protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures. Logiqum remains fully liable to Customer for the performance of each Sub-processor’s obligations.

7. International transfers

7.1 EEA first. Logiqum is established in Hungary and prefers to process Customer Personal Data in the European Union and the European Economic Area.

7.2 Safeguards. Logiqum makes or permits a Restricted Transfer only where a safeguard under Chapter V of the GDPR applies: an adequacy decision (Article 45), or the SCCs together with any supplementary measures that a transfer assessment shows to be needed.

7.3 SCCs. Where processing under this DPA involves a Restricted Transfer between the parties, the SCCs are incorporated into this DPA by reference, with Customer as data exporter and Logiqum as data importer, and completed as follows: Module Two (controller to processor) where Customer is a controller, Module Three (processor to processor) where Customer is a processor, and Module Four (processor to controller) where Logiqum, from the European Economic Area, transfers Customer Personal Data to Customer in a third country. Clause 7 (docking clause) applies. For Clause 9(a), Option 2 (general written authorization) applies with the notice period in §6.3. The optional wording in Clause 11 does not apply. For Clause 13, the competent supervisory authority is the one determined by that clause. For Clause 17, the SCCs are governed by the law of Hungary; for Clause 18, disputes are resolved by the courts of Budapest, Hungary. Annex I.A and I.B of the SCCs are completed by Annex I of this DPA, Annex II of the SCCs by Annex II of this DPA, and Annex III of the SCCs by the Sub-processor list provided under §6.2.

7.4 Onward transfers. Where a Sub-processor outside the European Economic Area processes Customer Personal Data, Logiqum puts the applicable safeguard under §7.2 in place with that Sub-processor before the transfer.

7.5 Copies. A copy of the applicable safeguards is available to Customer on request to [email protected].

8. Personal Data Breach

8.1 Notice. Logiqum notifies Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach.

8.2 Content. The notice describes, as far as then known: the nature of the Personal Data Breach, including, where possible, the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its possible adverse effects; and a contact point for more information. Where Logiqum cannot provide all the information at once, it provides it in phases without undue further delay.

8.3 Response. Logiqum takes reasonable steps to contain and investigate the Personal Data Breach and to reduce its effects, and cooperates with Customer in meeting Customer’s obligations under Articles 33 and 34 GDPR. Customer decides whether to notify supervisory authorities and data subjects, unless the law requires Logiqum to do so itself. Notice of a Personal Data Breach is not an admission of fault or liability.

9. Audits

9.1 Information. On written request, Logiqum provides the information reasonably necessary to demonstrate its compliance with this DPA, including written answers to Customer’s reasonable security and data-protection questionnaires.

9.2 Audits and inspections. Where that information is not reasonably sufficient, or where a supervisory authority requires it, or after a Personal Data Breach, Customer may audit Logiqum’s compliance with this DPA, itself or through an independent auditor bound by confidentiality who is not a competitor of Logiqum. Unless a supervisory authority or a Personal Data Breach requires otherwise, audits take place no more than once in any 12-month period, on at least 30 days’ written notice, during normal business hours, without unreasonable disruption to Logiqum’s business, and in a way that protects the confidentiality of other customers’ data and of Logiqum’s Confidential Information. Customer bears its own costs of an audit. Audit results are Logiqum’s Confidential Information, except where Customer must disclose them to a supervisory authority.

10. Deletion and return

10.1 Support material. Logiqum keeps Customer Personal Data received for a support case only as long as the case needs it, and deletes it once the case is closed and it is no longer needed. Customer may ask at any time that Logiqum delete it earlier.

10.2 End of the Processing Services. When the Processing Services end, Logiqum, at Customer’s choice, returns Customer Personal Data to Customer or deletes it. Consistent with §12 of the Agreement, Customer may retrieve Customer Data that Logiqum holds within 30 days after termination; after that period Logiqum deletes the Customer Personal Data, including existing copies, without undue delay, unless Union or Member State law requires its storage.

10.3 Backups and legal retention. Copies kept in routine backups, or kept because the law requires it, remain protected under this DPA and confidential (Agreement §11) until they are deleted, and are not processed for any other purpose.

10.4 Confirmation. On request, Logiqum confirms the deletion in writing.

11. Liability

Each party’s liability arising out of or in connection with this DPA, together with its liability under the Agreement, is subject to the exclusions and limitations of liability in §10 of the Agreement, as one aggregate. Nothing in this DPA limits either party’s liability to data subjects under Article 82 GDPR, or any liability that cannot be limited under applicable law.

12. Term, governing law, and jurisdiction

12.1 Term. This DPA applies for as long as Logiqum processes Customer Personal Data under the Agreement, and its obligations continue until Logiqum has deleted or returned all Customer Personal Data under §10.

12.2 Governing law and venue. This DPA is governed by the law that governs the Agreement, and disputes about it are resolved in the venue that the Agreement states (§17 of the Agreement: the laws of Hungary; the courts of Budapest, Hungary, for Customers established in the European Union or the European Economic Area; and arbitration before the Commercial Arbitration Court attached to the Hungarian Chamber of Commerce and Industry, Budapest, for all other Customers). The SCCs, where they apply, are governed by their own Clauses 17 and 18 as completed in §7.3.

13. Order of precedence and changes

13.1 Precedence. In case of conflict: the SCCs (where they apply) prevail over this DPA, and this DPA prevails over the rest of the Agreement as to the processing of Customer Personal Data.

13.2 Changes. Logiqum may update this DPA to reflect changes in Data Protection Laws, or guidance or decisions of a supervisory authority or court, or changes in the Processing Services, provided that the update does not reduce the overall protection of Customer Personal Data. Each update carries a new version and effective date. Any other change requires the agreement of both parties.

14. Contact

Data-protection questions, Sub-processor list requests, and notices under this DPA: [email protected], or by post to Logiqum Kft., 2094 Nagykovácsi, Berkenye utca 8., Hungary. No Data Protection Officer is designated.

Annex I — Description of the processing

A. List of parties

• Data exporter / controller (or processor): Customer, as identified in the Order or in its acceptance of the Agreement; contact as designated by Customer. Role: controller, or processor on behalf of its own controller (§2.1).
• Data importer / processor: Logiqum Kft. (Logiqum Korlátolt Felelősségű Társaság), 2094 Nagykovácsi, Berkenye utca 8., Hungary; company reg. no. 13-09-246330; contact: [email protected]. Role: processor (or sub-processor).

The parties’ acceptance of the Agreement is their signature of this Annex.

B. Description of the transfer and processing

C. Competent supervisory authority

The supervisory authority determined under Clause 13 of the SCCs where they apply. The supervisory authority competent for Logiqum is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), the Hungarian National Authority for Data Protection and Freedom of Information, 1055 Budapest, Falk Miksa utca 9-11., https://naih.hu.

Annex II — Technical and organizational security measures (Article 32 GDPR)

A. Measures built into the Software

These features of the self-managed Software keep personal data in Customer’s control and limit what can reach Logiqum. They are described in the Documentation.

• Data stays in Customer’s environment. The Software processes logs within Customer’s own environment; Customer log content is not transmitted to Logiqum.
• No phone-home. Licensing is verified offline by cryptographic signature; the Software needs no connection to Logiqum to run or stay licensed, and works in fully air-gapped deployments.
• Telemetry off by default. Optional telemetry is opt-in, carries only Operational Data, never includes log content or personal data of data subjects, and can be disabled at any time.
• Validated cryptography. The Software’s Go services and the Agent use a cryptographic module validated under FIPS 140-3, and the appliance’s operating system uses a validated OpenSSL provider. The Documentation’s FIPS Mode page states which module and certificate covers each layer, and which components are not covered.
• Support without inbound access. Logiqum support does not need inbound access to Customer’s deployment. Customer produces a support bundle itself, chooses which sections it contains, and carries it out through its own approved process; secret values (passwords, API keys, tokens, credentials) are redacted automatically before they are included.
• Access control and accountability. The Software provides role-based access control and, where licensed, an append-only audit log of platform actions, both administered by Customer.

B. Logiqum’s measures for Customer Personal Data it processes

• Need-to-know access. Only Logiqum personnel who handle the support case or service have access, and each is bound to confidentiality (§5(b)).
• Purpose limitation. Customer Personal Data is used only for the purposes in Annex I, never for model training (§5), and is not combined with other customers’ data.
• Secure exchange. Logiqum agrees the transfer channel with Customer for each support case and does not ask Customer to send data over unencrypted channels; Customer may use encrypted media.
• Storage. Support material is kept only for the support case (§10.1) and only where the personnel described above can reach it. A description of the storage used for a Customer’s support material, including its location and protection at rest, is available to Customer on request to [email protected].
• Deletion. Customer Personal Data is deleted as described in §10.
• Incident response. Personal Data Breaches are handled and notified as described in §8.
• Sub-processors. Sub-processors are bound by written data-protection terms and are selected for their ability to provide sufficient guarantees (§6.5).
• Review. Logiqum reviews these measures regularly and when the Processing Services change, and keeps them at a level appropriate to the risk.

C. Hosted or managed services

Where an Order provides for a hosted or managed service, the Order states the additional measures for that service (for example, hosting location, encryption, backup, and access arrangements).

Contact: [email protected]. Companion documents: End User License Agreement (https://logrok.com/legal/eula); Privacy Policy (https://logrok.com/legal/privacy).