06 / A different kind of ambition
Bold horizons. Human scale.
Technology that gives you space.
LegalClarity, from the start
Controller / Processor framework governing use of the Leagen platform — sub-processors, data categories, security architecture, and update process.
Rockhawk Pty Ltd trading as Leagen · ABN 17 673 537 123
Controller / Processor framework governing use of the Leagen platform — sub-processors, data categories, security architecture, and update process.
Version dpa-v1 — effective 8 September 2026
This is the Leagen platform DPA. Each GenX integration the workspace enables (for example, the aXcelerate integration) is governed by an additional App DPA accepted at integration setup time. App DPAs are visible inside the workspace, behind sign-in.
Document content SHA-256: a555ead998f31dda99650467a15a23e48fad6de9d0bf071b375f9a62871c938c
This hash is computed at publication time over the exact markdown source above. When a workspace accepts this DPA in-app, the hash is recorded against the acceptance — so the workspace can later confirm that the text shown to them at acceptance time is the same text published here.
Version: dpa-v1
Effective: 1 May 2026
Document type: Platform DPA (covers the Leagen platform itself; integration-specific data flows are covered by separate per-app DPAs accepted at integration setup time.)
This Data Processing Agreement ("DPA") is entered into between:
This DPA forms part of, and is incorporated into, the Leagen Terms of Service. It governs Leagen's processing of Personal Information that the Customer's workspace transmits to, stores in, or generates within the Leagen platform.
Leagen processes Personal Information solely to provide the Platform to the Customer in accordance with the Customer's documented instructions. Those instructions are given through:
Leagen will not process Personal Information for any purpose other than providing the Platform to the Customer, except as required by applicable law.
Personal Information processed by Leagen on the Customer's behalf may include:
The categories of data subjects whose Personal Information may be processed include:
Leagen will:
The Customer is responsible for:
Leagen engages the following sub-processors to assist in providing the Platform. The Customer's acceptance of this DPA constitutes consent to these sub-processors. Leagen will notify the Customer of intended changes to this list with a reasonable opportunity to object.
All AI model traffic is routed through the Vercel AI Gateway (United States, with regional inference). The Gateway is configured for zero data retention and acts as a routing layer between the Platform and downstream model providers. The Gateway operator does not train models on traffic and does not retain prompt or response content beyond the operational period required to deliver the response.
The Customer may select from any of the following providers and models for AI features (chat agents, summarisation, structured extraction, embeddings):
The Customer's workspace administrators control which models are available for use in the workspace. The default model is Claude 4.6 Sonnet (Anthropic, United States). The Customer can restrict the available providers per workspace through the Platform settings.
When the Customer enables a GenX integration (for example, aXcelerate), the corresponding App DPA discloses the additional sub-processors specific to that integration. Those App DPAs are accepted separately at integration setup time and supplement the list above.
Leagen implements the following technical and organisational measures:
The Platform stores primary Customer data in Australia (ap-southeast-2). Personal Information may be transferred to other jurisdictions where sub-processors operate, including:
Where a transfer falls outside the jurisdictions for which an adequacy decision exists, Leagen relies on the EU Standard Contractual Clauses (Module 2 — Controller to Processor; Module 3 — Processor to Sub-processor) and equivalent mechanisms recognised under the Australian Privacy Act and CCPA/CPRA. The Customer accepts these mechanisms by accepting this DPA.
Leagen will notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data Breach affecting the Customer's data. The notification will include, to the extent reasonably available at the time:
Leagen will assist the Customer, by appropriate technical and organisational measures, in fulfilling the Customer's obligation to respond to requests from data subjects exercising their rights under applicable law (including rights of access, rectification, erasure, restriction, portability, and objection).
The Platform provides the Customer with self-service tools to export and delete workspace data; Leagen will provide additional assistance on reasonable request.
On reasonable written request, Leagen will make available to the Customer information necessary to demonstrate compliance with this DPA. Audits beyond the provision of such information are subject to mutual agreement on scope, timing, and confidentiality.
This DPA takes effect on the Customer's acceptance and continues for so long as Leagen processes Personal Information on behalf of the Customer. On termination of the Customer's use of the Platform, Leagen will delete or return all Customer Personal Information within 30 days, subject to any longer retention required by law.
Leagen may update this DPA from time to time. Material changes (for example, the addition of a sub-processor in a new jurisdiction, a change in the categories of Personal Information processed, or a change in retention periods) will be notified to the Customer at least 30 days before the new version takes effect, and the Customer will be required to re-accept the updated DPA on next sign-in. Non-material changes (typographical corrections, clarifications) will be versioned and logged but will not require re-acceptance.
The currently-effective version of this DPA is identified by the version field at the top of this document and by a SHA-256 content hash recorded against the Customer's acceptance.
This DPA is governed by the laws of New South Wales, Australia. Any dispute arising under this DPA is subject to the non-exclusive jurisdiction of the courts of New South Wales.
Acceptance of this DPA is recorded against the workspace at the time of acceptance, including the accepting user, the timestamp, the IP address from which acceptance was made, the user-agent string, and the SHA-256 hash of the document content shown at acceptance time. The Customer can view and download its accepted version of this DPA at any time from the workspace settings.