LAWMATICS, INC.

How this DPA Works

This Data Processing Addendum (the “DPA”) forms part of, and is incorporated by reference into, the Lawmatics SaaS Services Agreement and any related order form (the “Agreement”) between Lawmatics, Inc. (“Lawmatics”, “we,” or “us”) and the customer that is a party to the Agreement (“Customer” or “you”). This DPA governs Lawmatics’ processing of Personal Data on Customer’s behalf in connection with the Services. By executing the Agreement (including by accepting an Order Form), Customer accepts and is bound by this DPA without further signature.

If you are a Lawmatics customer and require a separate, countersigned DPA for your records, please email legal@lawmatics.com and we will provide one. The terms will be substantively identical to those set forth here.

Capitalized terms not defined here have the meanings given in the Agreement.

At a Glance

Part I — General Terms

1. Definitions

In addition to terms defined elsewhere in this DPA or the Agreement:

“Applicable Data Protection Laws” means all data protection and privacy laws applicable to a Party’s processing of Personal Data, including: (i) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and its implementing regulations (the “CCPA”); (ii) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”); (iii) the UK Data Protection Act 2018 and the UK GDPR (the “UK GDPR”); (iv) the Swiss Federal Act on Data Protection (the “FADP”); (v) state privacy laws of the United States, including those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and any others later enacted; and (vi) the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), where applicable.

“Authorized Personnel” means employees, contractors, and agents of Lawmatics who are authorized to process Personal Data and are bound by appropriate confidentiality obligations.

“Customer Personal Data” means Personal Data that Customer or its Users submit to, or generate using, the Services, and that Lawmatics processes on Customer’s behalf in providing the Services.

“Personal Data” means information relating to an identified or identifiable natural person and any other information falling within the scope of “personal data,” “personal information,” “personally identifiable information,” or any equivalent term under Applicable Data Protection Laws.

“Personal Data Breach” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

“Process / Processing” has the meaning given to such terms in the GDPR (or, where the GDPR does not apply, the equivalent term under Applicable Data Protection Laws).

“Standard Contractual Clauses” or “SCCs” means (i) for transfers from the EEA, the standard contractual clauses for the transfer of personal data to third countries adopted by European Commission Decision (EU) 2021/914 of June 4, 2021, and (ii) for transfers from the UK, the International Data Transfer Addendum to those SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018 (the “UK Addendum”).

“Subprocessor” means any third party engaged by Lawmatics to process Customer Personal Data in connection with the Services.

2. Scope and Application

2.1  This DPA applies to Lawmatics’ processing of Customer Personal Data in connection with the Services. This DPA does not apply to Personal Data that Lawmatics processes for its own purposes as a controller / business (e.g., billing contact information used to manage the Lawmatics account), which is governed by the Lawmatics Privacy Policy at lawmatics.com/privacy-policy.

2.2  Annex 1 (Description of Processing) sets out the categories of data subjects, types of Personal Data, processing operations, and other particulars of the processing carried out under this DPA.

3. Roles of the Parties

3.1  For the purposes of Applicable Data Protection Laws and with respect to Customer Personal Data: (a) Customer is the “controller” (under the GDPR and similar laws) or “business” (under the CCPA), and (b) Lawmatics is the “processor” (under the GDPR and similar laws) or “service provider” (under the CCPA), in each case acting on Customer’s documented instructions.

3.2  Each Party is independently responsible for complying with its obligations under Applicable Data Protection Laws. Customer is responsible for ensuring that there is a valid legal basis for the processing of Customer Personal Data through the Services and for providing required notices and obtaining required consents from data subjects.

4. Permitted Processing

4.1  Documented Instructions. Lawmatics will process Customer Personal Data only on Customer’s documented instructions, including those reflected in the Agreement, this DPA, and Customer’s use of the Services. Lawmatics will not process Customer Personal Data for any other purpose, except to comply with applicable law, in which case Lawmatics will (where legally permitted) inform Customer of that legal requirement before processing.

4.2  Lawful Instructions. Lawmatics will inform Customer if, in Lawmatics’ reasonable opinion, an instruction infringes Applicable Data Protection Laws.

4.3  Prohibited Uses. Lawmatics will not (a) sell or share (as defined under the CCPA) Customer Personal Data, (b) retain, use, or disclose Customer Personal Data outside of the direct business relationship with Customer or for any purpose other than the specific purpose of providing the Services, (c) combine Customer Personal Data with personal data received from or on behalf of any other person, except as expressly permitted by the CCPA, or (d) use Customer Personal Data to train, develop, or improve any generative artificial intelligence model that is intended to be made available to any third party or for any purpose other than operating and improving the Services for Customer except using aggregated and de-identified data that cannot reasonably identify Customer or any data subject.

5. Confidentiality of Personnel

5.1  Lawmatics will ensure that Authorized Personnel who process Customer Personal Data are subject to written confidentiality obligations or appropriate statutory obligations of confidentiality, are reliable, and have received appropriate training on their data protection responsibilities.

5.2  Lawmatics will limit access to Customer Personal Data to Authorized Personnel who need such access to perform their duties.

6. Customer Responsibilities

6.1  Customer is responsible for: (a) determining the lawfulness of the processing carried out through the Services, (b) providing required notices to data subjects and, where required, obtaining and managing consents, (c) determining whether the Services are appropriate for the types of Personal Data Customer processes through them, and (d) the accuracy, quality, and legality of Customer Personal Data.

6.2  Customer warrants that it will not submit through the Services any Personal Data of a kind for which the Services are not designed (for example, payment-card account numbers in unstructured fields, or other sensitive categories that Customer has not configured the Services to handle), unless the Parties agree otherwise in writing.

7. Security

7.1  Security Program. Lawmatics maintains a written information security program designed to protect the confidentiality, integrity, and availability of Customer Personal Data. The program is consistent with SOC 2 Type II standards and aligns with the HIPAA Security Rule. Lawmatics has implemented and will maintain appropriate technical and organizational measures (the “TOMs”) as set forth in Annex 2.

7.2  Continuous Improvement. Lawmatics will periodically review and update the TOMs in accordance with changes in technology, threat profile, and regulatory expectations, provided that any such changes will not materially diminish the level of protection of Customer Personal Data.

7.3  Customer-Side Configuration. Customer is responsible for configuring the security features made available within the Services (such as multi-factor authentication, role-based access, single sign-on, and audit logging) appropriately for its use case.

8. Personal Data Breach Notification

8.1  Notification. Lawmatics will notify Customer of a confirmed Personal Data Breach without undue delay and in any event within seventy-two (72) hours of confirmation. Notice will be sent to the legal/notices contact on file for Customer.

8.2  Content. The notification will include, to the extent then known: (a) the nature and scope of the Personal Data Breach, including the categories and approximate number of data subjects and Personal Data records concerned, (b) the likely consequences, (c) the measures taken or proposed to address the breach and mitigate adverse effects, and (d) the name and contact details of a point of contact at Lawmatics.

8.3  Cooperation. Lawmatics will provide reasonable cooperation in connection with Customer’s investigation, mitigation, and notification obligations under Applicable Data Protection Laws.

8.4  No Acknowledgment of Fault. Notification of a Personal Data Breach is not, and will not be construed as, an acknowledgment by Lawmatics of any fault or liability.

9. Subprocessors

9.1  Authorization. Customer provides general authorization for Lawmatics to engage Subprocessors to assist in providing the Services.

9.2  Current List. The current list of Subprocessors is available at lawmatics.com/subprocessors and is updated from time to time.

9.3  Notification of Changes. Lawmatics will provide Customer with at least thirty (30) days’ advance notice of the addition of any new Subprocessor that will process Customer Personal Data, by email to the legal/notices contact on file or by updating the Subprocessor list and posting a notice on the Services.

9.4  Right to Object. If Customer reasonably objects to a new Subprocessor on data-protection grounds, Customer must notify Lawmatics in writing within fifteen (15) days of Lawmatics’ notice. The Parties will work in good faith to resolve the objection. If they cannot, Customer may terminate the affected Services.

9.5  Subprocessor Obligations. Lawmatics will impose on each Subprocessor data protection obligations appropriate to the nature of the processing, and Lawmatics remains responsible for the acts and omissions of its Subprocessors with respect to Customer Personal Data.

10. Cooperation with Data Subject Requests

10.1  Self-Service Tools. The Services include functionality that allows Customer to access, correct, delete, restrict, export, and otherwise respond to data subject requests with respect to Customer Personal Data within Customer’s account.

10.2  Additional Assistance. To the extent Customer cannot fulfill a data subject request through the Services, Lawmatics will provide reasonable assistance, taking into account the nature of the processing and the information available to Lawmatics. Material assistance beyond standard support may be subject to Lawmatics’ then-current professional services rates.

10.3  Direct Requests. If Lawmatics receives a request directly from a data subject regarding Customer Personal Data, Lawmatics will, without undue delay, forward the request to Customer and will not respond to the data subject except to acknowledge receipt or as required by law.

11. Audit Rights

11.1  Compliance Reports. Lawmatics will, at Customer’s written request and not more than once per twelve (12)-month period, make available the most recent third-party SOC 2 Type II report and HIPAA compliance summary, subject to the confidentiality obligations of the Agreement and an appropriate non-disclosure agreement.

11.2  Additional Audits. To the extent Applicable Data Protection Laws require Customer to conduct an audit beyond Lawmatics’ standard reports, the Parties will agree on the scope, timing, and duration of the audit, which: (a) will be conducted during normal business hours on at least thirty (30) days’ written notice, (b) will not unreasonably interfere with Lawmatics’ business operations, (c) will not require disclosure of information that would compromise the security of other customers, and (d) will be conducted at Customer’s expense, except where the audit reveals material non-compliance by Lawmatics, in which case Lawmatics will reimburse reasonable audit costs.

11.3  Regulator Audits. Lawmatics will reasonably cooperate with any audit conducted by a competent supervisory authority where required by Applicable Data Protection Laws.

12. International Transfers

12.1  Hosting Locations. Lawmatics primarily processes Customer Personal Data in the United States. The locations of the Lawmatics Subprocessors are listed at lawmatics.com/subprocessors.

12.2  Cross-Border Transfers. Where Customer Personal Data originates from the European Economic Area, the United Kingdom, or Switzerland and is transferred to a country not recognized as providing an adequate level of protection, the cross-border transfer mechanism set forth in Part IV of this DPA applies.

13. Return and Deletion

13.1  On termination or expiration of the Agreement, Lawmatics will make Customer Personal Data available for export through the Services for the period set forth in the Agreement (currently ninety (90) days). Following such period, Lawmatics will delete Customer Personal Data from its production systems in the ordinary course.

13.2  Backups and Logs. Customer Personal Data residing in routine backups and security/audit logs will be deleted in accordance with Lawmatics’ retention schedule. While such residual copies remain, the protections of this DPA continue to apply.

13.3  Legal Hold. Lawmatics may retain Customer Personal Data to the extent and for so long as required by applicable law, in which case Lawmatics will continue to protect such data in accordance with this DPA and will use the data only for the purpose of complying with such legal requirement.

14. Liability

14.1  The Parties’ aggregate liability arising out of or in connection with this DPA is subject to the limitations of liability set forth in the Agreement, including any super-cap that applies to claims arising from a Party’s breach of confidentiality or data-protection obligations.

15. Term and Survival

15.1  This DPA takes effect on the Effective Date set forth at the top of this document or, for any specific Customer, on the date Customer enters into the Agreement, whichever is later, and continues for the term of the Agreement and for as long as Lawmatics processes Customer Personal Data.

15.2  Sections that by their nature should survive termination, including Sections 1, 4.3, 5, 8, 13, and 14, will survive.

16. Order of Precedence; Modifications

16.1  In the event of a conflict between this DPA and the Agreement with respect to the processing of Customer Personal Data, this DPA controls. In the event of a conflict between this DPA and the SCCs (where the SCCs apply), the SCCs control.

16.2  Lawmatics may update this DPA from time to time. Material changes that are adverse to Customer will not take effect with respect to Customer until the start of Customer’s next renewal term, and Lawmatics will provide reasonable advance notice of such changes by email to the legal/notices contact on file or by posting on the Services. Non-material updates take effect upon posting.

16.3  The current version of this DPA is the version posted at lawmatics.com/dpa and is the version incorporated into the Agreement of any Customer whose initial subscription term begins on or after the “Effective” date shown above. Customers whose initial term began before that date remain on the prior version through the end of their then-current renewal term.

Part II — California Consumer Privacy Act (Service Provider Terms)

This Part II applies where Customer is a “business” under the CCPA and Lawmatics processes Personal Information of California residents on Customer’s behalf. Capitalized terms used but not defined in this Part II have the meanings given in the CCPA.

17. Service Provider Designation

17.1  The Parties acknowledge that Lawmatics is a “service provider” to Customer under the CCPA. The Personal Information disclosed by Customer to Lawmatics is provided only for the “business purposes” specified in the Agreement and Annex 1 of this DPA.

18. Service Provider Obligations

Lawmatics will:

• Process Personal Information only for the business purposes specified in the Agreement and Annex 1, or as otherwise permitted by the CCPA.
• Not sell or share Personal Information.
• Not retain, use, or disclose Personal Information outside of the direct business relationship between Lawmatics and Customer or for any commercial purpose other than performing the Services.
• Not combine Personal Information received from or on behalf of Customer with personal information received from or on behalf of any other person, except as expressly permitted by Section 1798.140(ag)(1) of the CCPA.
• Comply with applicable obligations of the CCPA and provide the same level of privacy protection to Personal Information as required of a business under the CCPA.
• Notify Customer if Lawmatics determines that it can no longer meet its obligations under the CCPA.
• Permit Customer to take reasonable and appropriate steps to stop and remediate Lawmatics’ unauthorized use of Personal Information.
• Engage Subprocessors only by means of a written agreement that requires the Subprocessor to observe equivalent obligations.

19. Cooperation with Consumer Requests

19.1  Lawmatics will provide reasonable assistance to enable Customer to respond to verifiable consumer requests under the CCPA (including requests to know, delete, correct, and limit the use of sensitive personal information), as further described in Section 10 of this DPA. Customer is responsible for verifying the identity of the requesting consumer and determining whether and how to respond.

Part III — HIPAA Business Associate Terms

20. HIPAA Status

20.1  Lawmatics maintains a HIPAA-aligned compliance program and is prepared to act as a “business associate” (as defined in 45 C.F.R. § 160.103) for Customers that are “covered entities” or that are themselves business associates handling Protected Health Information (“PHI”) in connection with the Services.

21. Business Associate Agreement

21.1  Customer is responsible for determining whether its use of the Services involves PHI. If Customer’s use does or may involve PHI, Customer must enter into a separate Business Associate Agreement (“BAA”) with Lawmatics before submitting PHI to the Services.

21.2  To request a BAA, Customer should email legal@lawmatics.com. Lawmatics provides a standard form BAA that satisfies 45 C.F.R. §§ 164.502(e) and 164.504(e). Once countersigned, the BAA forms part of the Agreement and, with respect to PHI, controls over any inconsistent term in this DPA or the Agreement.

21.3  Until a BAA is in place between the Parties, Customer agrees not to submit PHI to the Services. Lawmatics has no obligation to treat Customer Personal Data as PHI in the absence of a BAA, even if such data may otherwise constitute PHI.

Part IV — EEA, UK, and Swiss Data Transfers

Effectiveness. Lawmatics is preparing for general availability of the Services in the European Economic Area, United Kingdom, and Switzerland. The provisions of this Part IV are effective with respect to a Customer only to the extent that Customer transfers Customer Personal Data of EEA, UK, or Swiss data subjects to Lawmatics in connection with the Services. Where this Part IV does not apply, Customer’s rights and Lawmatics’ obligations are governed by Parts I through III above.

22. Article 28 Processor Terms

22.1  Where the GDPR or UK GDPR applies, this DPA constitutes the written processor contract required by Article 28(3) of the GDPR (and the equivalent provision of the UK GDPR), and the Parties agree that the terms of Parts I through III of this DPA, supplemented by this Part IV and the Annexes, satisfy that requirement.

23. Standard Contractual Clauses

23.1  Application. Where Customer Personal Data of data subjects in the EEA is transferred to Lawmatics in a country not recognized by the European Commission as providing an adequate level of protection, the SCCs (Module Two: Controller to Processor) are incorporated into and form part of this DPA. Module Three (Processor to Processor) applies to onward transfers to Subprocessors.

23.2  Selection of Options. With respect to the SCCs: (a) Clause 7 (docking clause) is included; (b) under Clause 9, option 2 (general written authorization) is selected, with the prior-notice period set to thirty (30) days as set forth in Section 9.3; (c) under Clause 11, the optional independent dispute resolution body language is not included; (d) under Clause 17, the SCCs are governed by the law of the Republic of Ireland; (e) under Clause 18, the courts of Ireland have jurisdiction; and (f) Annexes I, II, and III to the SCCs are populated by reference to Annexes 1, 2, and 3 of this DPA.

23.3  UK Addendum. For transfers from the United Kingdom, the UK Addendum is incorporated and applies. The information required by Tables 1, 2, and 3 of the UK Addendum is provided in the SCCs and the Annexes; with respect to Table 4, neither Party may end the UK Addendum solely as permitted by Section 19 of the UK Addendum.

23.4  Swiss FADP. For transfers from Switzerland, the SCCs apply with the following adjustments: (a) references to “Member State” are interpreted to include Switzerland, (b) the term “GDPR” is read to include the FADP where applicable, and (c) the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.

24. Conflict

24.1  In the event of any conflict between this DPA and the SCCs, the SCCs control. In the event of any conflict between the SCCs and the UK Addendum (with respect to UK transfers), the UK Addendum controls.

Annex 1 — Description of Processing

Annex 2 — Technical and Organizational Measures (TOMs)

Lawmatics maintains the following technical and organizational measures to protect Customer Personal Data. These measures are aligned with SOC 2 Type II standards and the HIPAA Security Rule.

Governance and Compliance

• Annual SOC 2 Type II audit by an independent third-party assessor; report available to Customer under NDA on request.
• HIPAA compliance program with documented policies, designated Privacy Officer and Security Officer, and annual workforce training.
• Documented information security policies reviewed at least annually.
• Risk assessments conducted at least annually and after material changes to systems or threat profile.

Access Controls

• Role-based access controls applied on the principle of least privilege.
• Multi-factor authentication required for administrative and remote access to production systems and for systems that store or process Customer Personal Data.
• Access to Customer Personal Data limited to Authorized Personnel with a documented business need.
• User access reviews performed at least annually. Access deprovisioned promptly upon role change or termination — within one business day for privileged accounts and involuntary terminations.
• Customer-side controls available within the Services for User-level role permissions, single sign-on (SSO), and multi-factor authentication.

Encryption

• Customer Personal Data encrypted at rest using AES-256 (or equivalent).
• Data in transit encrypted using TLS 1.3 or higher across public networks.
• Cryptographic key management with periodic rotation.

Network and Infrastructure Security

• Hosting in tier-1 cloud infrastructure with physical, environmental, and network security controls maintained by the underlying provider.
• Network segmentation between production, test, and corporate environments.
• Web application firewall, DDoS protection, and intrusion detection.
• Centralized logging of authentication, access, and administrative events; logs retained in accordance with the Lawmatics retention schedule.
• Vulnerability scanning at least quarterly and at least annual third-party penetration testing.

Application Security

• Secure development lifecycle including mandatory peer code review prior to production release, input validation, and automated dependency and open-source vulnerability scanning.
• Separation of duties between development and production environments.
• Patch management process for operating systems, libraries, and dependencies.

Personnel Security

• Background checks on Authorized Personnel where permitted by law.
• Confidentiality / non-disclosure obligations imposed on all Authorized Personnel.
• Security and privacy training on hire and at least annually thereafter.

Business Continuity and Resilience

• Documented business continuity and disaster recovery plans, tested at least annually.
• Encrypted backups of production data, with tested restore procedures.
• Defined recovery objectives consistent with the SLA in the Agreement.

Incident Response

• Documented incident response plan, exercised at least annually.
• 24x7 on-call security and engineering coverage for high-severity incidents.
• Customer notification within 72 hours of confirmation of a Personal Data Breach (Section 8).
• Post-incident review and remediation tracking.

Vendor / Subprocessor Management

• Risk-based diligence of Subprocessors before engagement and periodically thereafter.
• Written contracts requiring data protection commitments no less protective than this DPA.
• Public Subprocessor list maintained at lawmatics.com/subprocessors.

Annex 3 — Subprocessors

The current list of Subprocessors that may process Customer Personal Data in connection with the Services is maintained at lawmatics.com/subprocessors. The list identifies each Subprocessor, the country of processing, and the function performed.

Customers may subscribe to notifications of changes to the Subprocessor list by following the instructions on that page. The notification and objection process is set forth in Section 9 of this DPA.

Annex 4 — Standard Contractual Clauses Reference

Effective when Part IV applies. The Standard Contractual Clauses adopted by European Commission Decision (EU) 2021/914 of June 4, 2021, available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj, are incorporated by reference, with the Module selections, Annexes, and customizations set forth in Section 23 of this DPA. The UK International Data Transfer Addendum, available at https://ico.org.uk/, is incorporated by reference for transfers from the United Kingdom, with the customizations set forth in Section 23.3.

A signed paper or electronic copy of the SCCs and UK Addendum tailored to a specific Customer is available on request to legal@lawmatics.com.