Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between Lexatta LLC (“Lexatta”) and the Customer. It applies when Lexatta processes Customer Personal Data in providing the Service. Capitalized terms not defined here have the meanings in the Agreement.

“Customer Personal Data” means personal information within Customer Data. The Customer is the controller (or “business”) of Customer Personal Data, and Lexatta is its processor (or “service provider”). Lexatta acts as an independent controller only for the account, billing and usage information described in its Privacy Policy.

Lexatta will process Customer Personal Data only on the Customer’s documented instructions. The Agreement, this DPA and the Customer’s configuration and use of the Service are those instructions. Lexatta will tell the Customer if it believes an instruction breaks applicable law, unless the law prohibits it from doing so.

Lexatta will not:

• sell or share Customer Personal Data, as those terms are defined in applicable privacy law;
• retain, use or disclose it for any purpose other than providing the Service, including for any commercial purpose or outside the direct business relationship with the Customer, except as applicable law permits a service provider to do;
• combine it with personal information from other sources, except as the law permits; or
• use it to train artificial intelligence models.

The Customer is responsible for the lawfulness of its instructions and for having provided all notices and obtained all consents needed for Lexatta to process Customer Personal Data under this DPA.

Lexatta will limit access to Customer Personal Data to personnel who need it to provide, support or secure the Service, make sure they are bound by confidentiality obligations, and log privileged access.

Lexatta will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These include, at a minimum, the measures in Annex 2. Lexatta may update them as long as the overall level of protection does not decrease.

The Customer authorizes Lexatta to engage subprocessors in the categories in Annex 3. Lexatta will:

• bind each subprocessor by written contract to data-protection obligations no less protective than this DPA, including a prohibition on using Customer Personal Data to train AI models;
• remain responsible for each subprocessor’s performance of those obligations;
• give the Customer a current list of subprocessors on request to privacy@lexatta.com; and
• notify the Customer at least 30 days before adding or replacing a subprocessor.

The Customer may object to a new subprocessor on reasonable data-protection grounds within that notice period. The parties will then discuss a solution in good faith. If none is found, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remainder of the term.

If Lexatta receives a request from an individual about Customer Personal Data, it will refer the individual to the Customer and will not respond directly except to confirm the referral. Taking into account the nature of the processing, Lexatta will reasonably help the Customer respond to requests to access, correct, delete or obtain a copy of personal information.

Lexatta will also give reasonable assistance, using information available to it, with the Customer’s risk assessments and consultations with regulators that relate to the Service.

Lexatta will notify the Customer without undue delay, and in any event within 72 hours after becoming aware, of any breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data (a “Security Incident”).

The notice will describe, as far as then known, the nature of the incident, the categories and approximate volume of data and individuals affected, likely consequences, and the steps taken or proposed. Lexatta will update it as more becomes known, take reasonable steps to contain and remedy the incident, and reasonably cooperate with the Customer’s own notification obligations. Notifying the Customer is not an admission of fault.

For 30 days after the Agreement ends, Lexatta will provide an export of Customer Data on request in a commonly used, machine-readable format. Lexatta will delete Customer Personal Data from active systems within 90 days after the Agreement ends, or sooner on the Customer’s written request. Copies in backups are deleted as the backups expire, and remain protected by this DPA until then. Lexatta may retain data the law requires it to keep, and security logs, under the same protections.

On written request, no more than once a year unless a Security Incident or a regulator requires it, Lexatta will give the Customer the information reasonably needed to show compliance with this DPA. This includes answering a reasonable security questionnaire and sharing any independent audit reports Lexatta holds. If that information is insufficient, the parties will agree in good faith on the scope, timing and cost of any further review, which must be conducted under confidentiality obligations.

Lexatta stores Customer Personal Data in the United States. The AI model provider in Annex 3 may process uploaded templates outside the United States when a workflow is created; it does not store them beyond the retention described in the Data Use Policy. Lexatta will not transfer Customer Personal Data to another country for storage without notifying the Customer in advance as provided in Section 5.

Each party’s liability under this DPA is subject to the limitations in the Agreement. If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA controls. This DPA lasts as long as Lexatta processes Customer Personal Data.

• Encryption: TLS in transit (TLS 1.2 or higher on Lexatta’s public domains); AES-256 encryption at rest for stored data.
• Tenant isolation: every record is scoped to a single firm, and each request is authorized against the firm in the signed-in user’s session.
• Access control: role-based permissions within each firm; personnel access is restricted to authorized staff and logged; support sessions that view a firm’s account require a stated reason and are read-only and time-limited.
• Authentication: enforced password complexity; short-lived session tokens that can be revoked; secure, HTTP-only cookies.
• Logging: audit logging of privileged and personnel access, with masking of credentials in logs.
• Resilience: managed cloud infrastructure; point-in-time recovery for databases; versioned storage for templates and generated documents.
• Abuse protection: rate limiting on public upload and contact endpoints.
• Data minimization: automatic expiry of drafts, verification codes, temporary uploads and sessions.
• Vendor management: subprocessors bound by written data-protection terms.