Legal
Data Processing Addendum
Last updated: 7 October 2026
This Data Processing Addendum (“DPA”) forms part of the agreement between Licenseware Technology Services S.R.L. (“Licenseware”, “Processor”) and the Customer or Partner named in the applicable Order Form or agreement (“Controller”). It applies wherever Licenseware processes personal data on behalf of the Controller in connection with the provision of Licenseware Products and services. For MSP Partners, additional provisions in Section 9 apply to reflect the controller → processor → sub-processor chain.
Capitalised terms not defined herein have the meanings given in the applicable Licenseware agreement (EULA, Reseller Agreement, Appendix 1G, or other).
Definitions
| Term | Definition |
|---|---|
| Applicable Data Protection Law | (a) The EU General Data Protection Regulation (EU) 2016/679 (“EU GDPR”); (b) the UK GDPR as defined in section 3(10) of the Data Protection Act 2018; (c) Romanian Law no. 190/2018 on measures for the implementation of the EU GDPR; and (d) any other applicable data protection legislation in force from time to time. |
| Personal Data | Has the meaning given in Applicable Data Protection Law. |
| Processing | Has the meaning given in Applicable Data Protection Law. |
| Data Subject | Has the meaning given in Applicable Data Protection Law. |
| Personal Data Breach | Has the meaning given in Applicable Data Protection Law. |
| Sub-Processor | Any third party engaged by Licenseware to process Personal Data on behalf of the Controller. |
| Standard Contractual Clauses (SCCs) | The standard contractual clauses for the transfer of personal data to third countries as adopted by the European Commission from time to time. |
| Regional Instance | A geographically isolated deployment of the Licenseware platform, currently: EU Instance (Netherlands); US Instance (United States); AU Instance (Sydney, Australia). |
1. Scope and Nature of Processing
1.1 Licenseware processes Personal Data on behalf of the Controller solely to the extent necessary to provide the Licenseware Products and services in accordance with the applicable agreement.
1.2 Licenseware acts as a data processor with respect to Personal Data processed on behalf of the Controller. The Controller is the data controller and is responsible for the lawfulness of the processing, including obtaining any necessary consents or establishing any other valid legal basis for processing.
1.3 The subject matter, nature, purpose and duration of processing, the types of Personal Data processed, and the categories of Data Subjects are set out in Schedule 1 to this DPA.
1.4 Licenseware shall process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law. Licenseware shall inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law, before carrying out the instruction. Licenseware may suspend the execution of such instruction until the Controller confirms, amends or withdraws it in writing.
2. The Parties' obligations
2.1 The Controller:
- warrants that it has a valid legal basis for processing Personal Data and for instructing Licenseware to process Personal Data on its behalf;
- is responsible for ensuring that Data Subjects have been informed of the processing of their Personal Data by Licenseware as processor/sub-processor, to the extent required by Applicable Data Protection Law;
- shall not instruct Licenseware to process Personal Data in a manner that would cause Licenseware to breach Applicable Data Protection Law.
2.2 Licenseware shall:
- process Personal Data only on the Controller's documented instructions in order to perform the contractual services and for no other purpose;
- ensure that all persons authorised to process Personal Data are subject to appropriate confidentiality obligations;
- implement and maintain appropriate technical and organisational security measures in accordance with Schedule 2;
- assist the Controller in fulfilling its obligations under Applicable Data Protection Law as set out in this DPA;
- delete or return all Personal Data to the Controller on termination of the applicable agreement, in accordance with this DPA;
- make available to the Controller all information necessary to demonstrate compliance with this DPA and cooperate with audits and inspections in accordance with this DPA.
3. Sub-Processors
3.1 General authorisation. The Controller grants the Processor general written authorisation, for the purposes of Article 28 (2) GDPR, to engage subprocessors to process Personal Data in connection with the Services, subject to this clause. The subprocessors authorised as at the date of this Agreement are those initially set out in the list maintained by the Processor at https://licenseware.io/legal/sub-processor-list/ (the “Subprocessor List”).
3.2 Subprocessor List. The Processor shall keep the Subprocessor List complete, accurate and up to date at all times. For each subprocessor, the Subprocessor List shall state its legal name, processing location(s), a description of the processing entrusted to it and, where applicable, the basis and safeguards relied upon for any transfer of Personal Data outside the EEA. The Processor shall provide any further information reasonably required by the Controller to assess the subprocessor’s guarantees and the proposed processing.
3.3 Notice of changes. The Processor shall proactively notify the Controller in writing of any intended addition or replacement of a subprocessor at least five (5) calendar days before that subprocessor begins processing Personal Data. The notice shall identify the proposed new Subprocessor List and include, or provide a direct means of accessing such Subprocessor List.
3.4 Right to object. The Controller may object in writing, within five (5) calendar days after notice is received, to the intended addition or replacement on reasonable data-protection grounds, including where the proposed subprocessor does not provide sufficient guarantees under Article 28 (1) GDPR. The objection shall state the relevant legal and technical grounds in reasonable detail. The Parties shall cooperate in good faith to resolve the objection in 30 days, including by agreeing reasonable safeguards or an alternative subprocessor. If the Controller does not object within the notice period, the proposed change shall be deemed authorised.
4. International Data Transfers
4.1 Regional instance isolation. Customer data is processed exclusively within the Regional Instance selected by the Controller. No Personal Data is transferred between Regional Instances. Each Regional Instance is isolated at VPC, cluster, and storage level.
4.2 EU Regional Instance. Where the Controller accesses the EU Regional Instance (Netherlands), Personal Data is processed within the European Union, across Licenseware's Google Cloud (Eemshaven) and Microsoft Azure (West Europe) infrastructure, and is not subject to cross-border transfer for the purposes of Chapter V of the EU GDPR.
4.3 US and AU Regional Instances. Where the Controller accesses the US Regional Instance (United States) or AU Regional Instance (Sydney, Australia), Personal Data is processed within the United States or Australia respectively. Such processing is governed by the Data Processing Addendums of Google Cloud Platform and Microsoft Azure, each of which incorporates Standard Contractual Clauses or equivalent transfer mechanisms as applicable.
4.4 Multi-instance. Where a Controller simultaneously accesses more than one Regional Instance, the data residency and transfer position for each instance is as set out in Clauses 4.2 and 4.3 above.
4.5 Transfer safeguards. Where the processing involves a transfer of Personal Data from the EEA to a country outside the EEA, Licenseware shall ensure that the transfer is covered by:
(a) an adequacy decision of the European Commission, including, for recipients in the United States certified under it, the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795); or
(b) where no adequacy decision applies (including, as at the date of this DPA, for the AU Regional Instance), the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Three (processor to processor). These are concluded by Licenseware with the relevant Sub-Processor or, where the transfer takes place within that Sub-Processor's own processing chain, by that Sub-Processor with its onward sub-processor.
4.6 Before relying on the Standard Contractual Clauses, Licenseware shall carry out and document a transfer impact assessment and implement any supplementary measures it identifies. Licenseware shall provide the Controller with a summary of such assessment on request.
4.7 Controllers established outside the EEA. Where the Controller is established in a country outside the EEA that is not covered by an adequacy decision, and is not a recipient certified under the EU-US Data Privacy Framework, the Standard Contractual Clauses, Module Four (processor to controller), apply to the transfer of Personal Data by Licenseware to the Controller through the Licenseware Products. They are incorporated into this DPA by reference, as follows:
(a) Clause 7 (docking clause) applies;
(b) the optional language in Clause 11(a) does not apply;
(c) Clauses 17 and 18: the law and the courts of Romania;
(d) Annex I: the parties are those identified in the applicable Licenseware agreement, and the transfer is described in Schedule 1.
4.8 United Kingdom. For Personal Data subject to the UK GDPR, transfers from the United Kingdom to Licenseware rely on the transfers to the EEA approved by regulations under the UK GDPR. Licenseware shall ensure that onward transfers to recipients outside the United Kingdom and the EEA are covered by the UK Extension to the EU-US Data Privacy Framework or by the International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK, as amended or replaced from time to time, as applicable.
5. Assistance to the Controller
5.1 Data Subject rights. Licenseware shall assist the Controller in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law (including rights of access, rectification, erasure, restriction, portability and objection). Licenseware shall forward any Data Subject requests it receives directly to the Controller without undue delay.
5.2 Security, breach notification, DPIA and prior consultation. Taking into account the nature of processing and the information available to Licenseware, Licenseware shall assist the Controller in ensuring compliance with the Controller's obligations under Articles 32–36 of the EU GDPR, including:
- implementing and maintaining appropriate security measures;
- notifying the Controller of Personal Data Breaches;
- assisting with Data Protection Impact Assessments where required.
6. Personal Data Breach Notification
6.1 Licenseware shall notify the Controller without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting the Controller's Personal Data.
6.2 Notification shall include, to the extent available at the time:
- a description of the nature of the breach, including categories and approximate numbers of Data Subjects and Personal Data records concerned;
- the name and contact details of Licenseware's Data Protection contact;
- a description of the likely consequences of the breach;
- a description of the measures taken or proposed to address the breach.
6.3 Where complete information is not available at the time of initial notification, Licenseware shall provide the information in phases without undue further delay.
6.4 Licenseware shall cooperate with the Controller in investigating the breach and in fulfilling any notification obligations the Controller may have to supervisory authorities or Data Subjects.
6.5 The Controller remains solely responsible for any notifications to supervisory authorities and Data Subjects required under Articles 33 and 34 of the EU GDPR. Notification of a Personal Data Breach by Licenseware shall not be construed as an acknowledgement of fault or liability.
7. Deletion and Return of Personal Data
7.1 On termination of the applicable agreement or on the Controller's written request, Licenseware shall, at the Controller's election:
- return all Personal Data to the Controller in a standard machine-readable format (CSV, JSON or via API); or
- securely delete all Personal Data, and certify in writing that it has done so.
7.2 Licenseware shall complete deletion or return within thirty (30) days of the termination date or written request, unless applicable law requires Licenseware to retain certain data for a longer period.
7.3 Licenseware shall procure that Sub-Processors delete or return Personal Data on equivalent terms.
8. Audit Rights
8.1 Licenseware shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits and inspections conducted by the Controller or a mandated auditor.
8.2 Licenseware may respond to an audit request by first providing its most recent independent audit reports or certifications and its answers to a reasonable security questionnaire. An audit or inspection of Licenseware's premises or systems shall take place only where such information is not sufficient to demonstrate compliance with this DPA, following a Personal Data Breach, or where required by a supervisory authority.
8.3 Audits shall take place no more than once per twelve (12) month period, upon a minimum of four (4) weeks' prior written notice, during normal business hours, and subject to confidentiality obligations and reasonable data minimisation measures. The Controller shall bear the cost of the audit unless the audit reveals material non-compliance by Licenseware, in which case Licenseware shall bear its own reasonable costs.
8.4 Any auditor engaged by the Controller must be bound by confidentiality obligations at least as protective as this DPA and must not be a competitor of Licenseware.
9. MSP-Specific Provisions
This Section applies only to MSP Partners under Appendix 1G from the main agreement.
9.1 Controller → Processor → Sub-Processor chain. Where the Controller is an MSP Partner:
- each End User Customer of the MSP Partner is the data controller of Personal Data relating to its own staff, devices and systems;
- the MSP Partner is a data processor, processing Personal Data on behalf of each End User Customer;
- Licenseware is a sub-processor, processing Personal Data on behalf of the MSP Partner in the course of providing the platform.
9.2 MSP Partner's DPA obligations. The MSP Partner must have a compliant Data Processing Agreement in place with each End User Customer prior to onboarding that customer. That DPA must accurately reflect the processing chain, incorporate this DPA's obligations (including the Sub-Processor List), and not make commitments to End User Customers that conflict with this DPA.
9.3 Authorisation by End User Customers. The MSP Partner warrants that its instructions to Licenseware are authorised by the relevant End User Customer and that it has obtained from each End User Customer a general written authorisation to engage Licenseware and the Sub-Processors on the Sub-Processor List, in accordance with Article 28 (2) and (4) of the EU GDPR.
9.4 Breach notification chain. Licenseware shall notify the MSP Partner within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting End User Customer data. The MSP Partner shall notify affected End User Customers in accordance with the MSP Partner's own DPA obligations and applicable law.
9.5 Sub-processor notification. The MSP Partner shall forward each notice received under Clause 3.3 to the affected End User Customers within five (5) days of receipt. The MSP Partner shall ensure that the period within which its End User Customers may object to the change expires no later than five (5) days before the end of the notice period under Clause 3.3, so that any objection can be raised with Licenseware within that notice period. The MSP Partner may exercise the right to object under Clause 3.4 on behalf of an End User Customer. A delay or failure by the MSP Partner to forward a notice or to relay an objection shall not extend the periods under Clause 3.
10. General
10.1 Governing law. This DPA is governed by and construed in accordance with the laws of Romania. Each party irrevocably submits to the exclusive jurisdiction of the Romanian courts for any dispute arising out of or in connection with this DPA.
10.2 Order of precedence. In the event of any conflict between this DPA and the applicable Licenseware agreement, this DPA shall prevail to the extent of the conflict in relation to data processing matters only.
10.3 Updates. Licenseware may update this DPA from time to time to reflect changes in Applicable Data Protection Law or Licenseware's technical architecture. Continued use of the Licenseware Products following the effective date of an update constitutes acceptance of the updated DPA.
11. Entire agreement on data processing.
11.1 This DPA constitutes the entire agreement between the Parties with respect to the processing of Personal Data by Licenseware on behalf of the Controller and supersedes any prior data processing provisions embedded in earlier versions of Licenseware's agreements.
Schedule 1 — Subject Matter, Nature, Purpose and Duration of Processing
| Category | Details |
|---|---|
| Subject matter | Processing of personal data in the course of providing the Licenseware SAM/ITAM platform and associated services. |
| Nature of processing | Collection, storage, organisation, structuring, retrieval, use, disclosure by transmission, and erasure of personal data as necessary to provide the platform. |
| Purpose of processing | To provide the Licenseware Products and services in accordance with the applicable service agreement and this DPA. |
| Duration | For the duration of the applicable agreement, and for such further period as may be required by applicable law. |
| Types of personal data | Identity and directory data (names, usernames, email addresses, job titles, organisational roles, account identifiers); device and endpoint data (device names, hardware identifiers, OS, compliance/ownership attributes); software installation and usage data; licence and entitlement data; SaaS and cloud application usage data; authentication and access data (SSO, directory service, identity provider records); business contact information. |
| Special categories | None. |
| Categories of Data Subjects | Employees, contractors, agents and authorised users of the Controller whose personal data is processed in the course of managing the Controller's software estate. |
| Additional instructions | As provided by the Controller in writing from time to time, provided such instructions are consistent with this DPA and Applicable Data Protection Law. |
Schedule 2 — Technical and Organisational Measures
Licenseware implements the following technical and organisational measures:
1. Information security governance: a written information security programme approved by management and reviewed periodically, risk assessment and treatment proportionate to severity.
2. Personnel: written confidentiality obligations, pre-engagement vetting to the extent permitted by law.
3. Access control: role-based access, named individual accounts, multi-factor authentication for production systems and cloud administration consoles, restricted and logged administrative access, and periodic review and prompt revocation of access rights.
4. Encryption: encryption of Personal Data in transit and at rest using industry-standard algorithms and protocols, key management through the infrastructure provider's key management services, and storage of secrets only in approved secret-management tools.
5. Vulnerability management: regular vulnerability scanning, severity-based remediation and periodic independent security testing.
6. Network security: internal components not directly reachable from the internet, and protection against common web attacks.
7. Logging and monitoring: logging and monitoring of security-relevant events, with alerting and defined escalation.
8. Incident management: a documented incident response plan with severity-based procedures, and notification of Personal Data Breaches in accordance with Section 6.
9. Devices and physical security: endpoint security requirements for devices used to access Personal Data, including disk encryption, up-to-date software, anti-malware protection and screen lock, and hosting in data centres of infrastructure providers whose physical and environmental controls are independently audited.
10. Deletion: deletion or return of Personal Data in accordance with Section 7, including deletion from backups in the ordinary backup cycle.