Data Processing Agreement

1. Roles of the Parties

For Personal Data processed through the Platform:

• Customer acts as the Controller and determines the purposes and means of processing.
• Provider acts as the Processor and processes Personal Data solely on Customer's documented instructions as set out in the Terms and Conditions and this DPA. Nothing in this DPA prevents the Provider from acting as an independent Controller where required to operate the Platform, comply with legal obligations, provide customer support, maintain security, process payments, or improve the Services, unless the Provider is required to process that data under applicable European Union, Member State, or other local laws to which the Provider is subject; in such a case, the Provider shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

2. Scope of Processing

The Provider, acting as the Processor, processes the Customer's Personal Data for the purpose of providing the Services to the Customer and enabling the uploading, storage, organization, access, processing, management, security, and technical maintenance of data through the Platform, within the scope set forth in this DPA, the Terms, and the Customer's documented instructions.

The categories of Personal Data may include:

• Names and contact details
• Email addresses
• User account information
• Electronic signatures
• Contract, document, comment, and collaboration content
• Signatory and participant information
• IP addresses
• Device, browser, and technical usage information
• Geolocation information, where collected
• Special categories of Personal Data are processed only where such data have been provided or uploaded to the Platform by the Customer, and only to the extent that their processing is necessary for the provision of the Services.

The categories of Data Subjects may include:

• Customers
• Platform users
• Signatories
• Employees
• Contractors
• Consultants
• Suppliers
• Business counterparties
• Other individuals whose personal data is included in documents processed through the Platform

Processing continues for the duration of the Customer's use of the Platform. Following the deletion of the Personal Data, the Provider may retain properly anonymized data derived from content created or processed by the Customer through the Platform for statistical, analytical, and technical purposes, as well as for the development and improvement of the Platform, artificial intelligence systems, models, and services, provided that such data no longer constitutes Personal Data and cannot reasonably be linked to the Customer or any identifiable individual.

3. Customer Responsibilities

The Customer is responsible for:

• Ensuring a lawful basis for processing Personal Data, including, where necessary, obtaining the consent of the data subject, where the User uses the Platform on behalf of another person or organization pursuant to a power of attorney or by virtue of their position or other status within the organization.
• Providing any required notices to Data Subjects.
• Responding to Data Subject requests.
• Ensuring that Personal Data uploaded to the Platform complies with applicable data protection laws.

4. Provider Obligations

The Provider shall:

• Process Personal Data only for the purposes and within the scope specified in this DPA, the Terms, and the Customer's documented instructions;
• Implement technical and organizational measures required under applicable law and appropriate to the nature, scope, and risks of the processing to ensure the security of Personal Data and to prevent unauthorized or unlawful processing, loss, destruction, alteration, or access by third parties;
• Ensure that personnel with access to Personal Data are bound by confidentiality obligations and process Personal Data only within the scope of their employment or service-related duties and for the purposes arising from this Agreement;
• Assist the Customer with reasonable requests related to applicable data protection laws where required.

5. Security Measures

The Provider shall implement and maintain appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

Such measures may include:

• Encryption in transit and at rest where appropriate.
• Access controls and authentication measures.
• Logging and monitoring.
• Regular security reviews and updates.
• Backup and disaster recovery procedures.

Processor De-Identification Right: The Provider may de-identify data uploaded to, created, or processed on the Platform by the Customer and, following such de-identification, use such data for statistical, analytical, and technical purposes, as well as for the development and improvement of the Platform, artificial intelligence systems, models, and services.

De-identified data may be used only where the Customer or any Data Subject cannot be identified, directly or indirectly, by means of such data.

6. Personal Data Breaches

The Provider shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and shall provide available information necessary for the Customer to comply with its legal obligations.

7. Subprocessors

The Customer authorises the Provider to engage subprocessors for the provision of the Services, provided that the subprocessors process the data solely for the purposes and within the scope specified in this DPA. The Provider shall take reasonable measures when selecting subprocessors to ensure their compliance with applicable data protection and security requirements, as well as the implementation of appropriate technical and organizational measures.

The Provider shall:

• Maintain written agreements with subprocessors that provide appropriate data protection obligations.
• Remain responsible for the performance of its subprocessors.
• Make a current list of subprocessors available through the Platform or Privacy Policy.

The Provider will notify the Customer at least 14 days in advance of any changes or additions to its list of subprocessors. The Customer may object to a new subprocessor in writing within 14 days of receiving notice. If the Customer objects on legitimate data protection grounds and the parties cannot find a mutual solution, either party may terminate the affected Services without penalty.

8. Data Subject Requests

The Customer shall have the right to submit requests and applications to the Provider, including requests to obtain information concerning the processing of the Customer's Personal Data, as well as to request the correction, completion, or modification of such data.

The Provider shall, within the scope of the means and technical capabilities available to it, provide a response to such request or application, or provide the necessary assistance in carrying out the relevant modification or other requested action, as soon as reasonably practicable and within a reasonable period of time.

9. International Transfers

Taking into account the nature of the Services and their availability without territorial restrictions, Personal Data may be transferred to, or made accessible by, DoLegal, subprocessors, or other persons involved in the provision of the Services who are located or operate in other countries, where such transfer or access is necessary for the provision of the Services, the technical operation, maintenance, or security of the Platform, or the performance of other contractual purposes.

Any such transfer shall be carried out in accordance with the requirements of applicable law. Where applicable law requires the prior authorization of a competent authority or any other prior approval for the transfer of Personal Data to a particular country, DoLegal shall carry out such transfer only after obtaining the required authorization or approval.

10. Deletion and Return of Data

Upon termination of the Services and subject to applicable legal retention requirements, the Provider will delete or return Customer Personal Data within a reasonable period.

11. Audits

11.1. Review of Security Documentation

To demonstrate compliance with this DPA, the Provider will, upon written request (no more than once per calendar year), provide the Customer with its standard security documentation, certifications, or recent independent security audit summaries.

11.2. Formal Customer Audits

If the provided security documentation is insufficient to satisfy applicable data protection laws, the Customer may request a formal compliance audit or inspection, subject to the following rules:

• Prior Agreement: The Customer must contact info@dolegal.ai to request an audit. Both parties must discuss and agree in advance on a reasonable start date, duration, scope, and strict confidentiality controls.
• Auditor Restrictions: The Customer may appoint an independent third-party auditor, but the Provider reserves the right to object if the auditor is a direct competitor, unqualified, or otherwise manifestly unsuitable.
• Cost Allocation: The Customer bears all costs of their appointed auditor. Additionally, the Provider may charge a reasonable, cost-based fee for its internal administrative hours and resources used to facilitate the audit.

12. Order of Precedence

If there is a conflict between this DPA and the Terms and Conditions regarding the processing of Personal Data, this DPA shall prevail to the extent of that conflict. Where applicable to a Consumer, the provisions of this DPA and the Terms and Conditions shall be interpreted and applied in a manner that does not restrict or exclude any mandatory rights or remedies afforded to the Consumer under applicable law.

13. Applicability of the Data Processing Agreement

The Data Processing Agreement ("DPA") forms an integral part of these Terms and Conditions and shall apply concurrently with these Terms and Conditions.

Appendix 1: Details of Processing

A. List of Parties

• Data Exporter (Customer): The entity utilizing the Platform services, acting as the Data Controller under applicable data protection laws.
• Data Importer (Provider): DoLegal AI, located in Yerevan, Armenia, delivering cloud-based document lifecycle, electronic signature, and AI automation services, acting as the Data Processor.

B. Description of Transfer / Processing

• Categories of Data Subjects: Platform users, corporate employees, contractors, consultants, signatories, suppliers, and any other third-party individuals whose personal data is incidentally or intentionally included in documents uploaded to the platform.
• Categories of Personal Data: Names, professional titles, email addresses, contact details, user account configurations, digital signature metadata, contract text, comment and collaboration content, IP addresses, device information, and technical usage telemetry.
• Special Categories of Data (Sensitive Data): The Provider does not intentionally collect, track, or require sensitive personal data (such as health metrics, biometric data, political opinions, or religious beliefs). However, because users have complete freedom to upload custom legal text, any sensitive data processed remains strictly incidental and remains under the total control of the Customer.
• Frequency of Transfer: Continuous and automated, on an as-needed basis as users interact with the platform ecosystem.
• Nature and Purpose of Processing: Logical storage, cryptographic organization, electronic signature execution, and AI-assisted clause analysis of business legal documents.
• Duration of Processing: The duration of the Customer's active subscription use of the platform, extending until data is formally purged following account termination.

Appendix 2: Technical and Organisational Security Measures

The Provider implements and maintains the following technical, physical, and administrative safeguards to ensure a level of security appropriate to the risks of processing Customer Personal Data:

1. Data Encryption & Pseudonymisation

• In Transit: All data transmitted between user web browsers, API endpoints, and the platform infrastructure is strictly encrypted using secure transport layer security protocols (TLS 1.2 or higher).
• At Rest: Customer documents, database strings, and automated operational templates are encrypted at rest using advanced encryption standard architecture (AES-256).

2. Access Control & System Security

• Infrastructure Isolation: The platform infrastructure is hosted within logically isolated virtual networks using globally recognized cloud providers (such as AWS, Google Cloud, or Microsoft Azure).
• Privilege Principle: Access to production environments and central databases is strictly limited to authorized engineering personnel who require it for operational maintenance. Access workflows follow the principle of least privilege.
• Authentication: Administrative access to platform dashboards requires mandatory multi-factor authentication (MFA) combined with zero-trust network access verification protocols.

3. Business Continuity & Disaster Recovery

• Redundancy: Core databases and file storage units utilize real-time replication architectures across independent availability zones to eliminate single points of structural failure.
• Backups: Automated, encrypted system backups are generated daily and isolated in secure storage locations. Regular restoration tests are conducted to verify backup snapshot integrity.

4. Incident Detection & Operational Integrity

• Logging: Security event logs, access attempts, and internal configuration updates across all production systems are recorded continuously and archived securely.
• Vulnerability Control: System dependencies, software frameworks, and cloud security configurations are scanned for vulnerabilities routinely, with security patches deployed systematically.

5. Personnel Security

• Confidentiality Agreements: All developers, internal employees, and contractors execute legally binding non-disclosure agreements before being granted access to platform environments.
• Training: Core team members participate in routine security awareness and data privacy workshops to ensure consistent, safe handling of client data ecosystems.

Appendix 3: International Data Transfers

1. Applicability

This Appendix 3 applies solely where the Customer is located in the European Economic Area (EEA), Switzerland, or the United Kingdom, and the provision of Services results in a transfer of Customer Personal Data to the Provider in Armenia or any other jurisdiction outside the EEA/UK that is not recognized as providing an adequate level of data protection.

2. European Economic Area (EEA) Transfers

For transfers of Personal Data originating from the EEA, the parties hereby agree that the European Commission's Standard Contractual Clauses (approved by Decision (EU) 2021/914) are formally incorporated into this DPA by reference, operating specifically under Module Two (Controller-to-Processor).

• The text of Appendix 1 of this DPA satisfies the operational requirements of Annex I of the Standard Contractual Clauses.
• The text of Appendix 2 of this DPA satisfies the operational requirements of Annex II of the Standard Contractual Clauses.
• The docking clause (Clause 7) is deemed omitted.
• The governing law shall be the law of the EU Member State in which the Customer is formally established.

3. United Kingdom (UK) Transfers

For transfers of Personal Data originating from the United Kingdom, the parties agree that the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (issued by the UK Information Commissioner's Office under S119A(1) of the Data Protection Act 2018) is hereby incorporated into this DPA by reference. The tables and formatting required under the UK Addendum shall be deemed fully populated by the corresponding information set out in Appendix 1 and Appendix 2 of this DPA.