Data processing addendum.

1.Definitions

The following terms have the meanings given under GDPR Article 4 and applicable UK data protection law. In the event of conflict, the definitions in the applicable regulation prevail:

• "Controller": the Customer, as the natural or legal person which determines the purposes and means of processing personal data contained in Firm Data.
• "Processor": Xycora Technology Limited, processing personal data on behalf of the Controller only on documented instructions.
• "Sub-processor": any sub-contractor engaged by Xycora to process personal data on the Controller's behalf in connection with delivering the platform.
• "Personal Data": any information relating to an identified or identifiable natural person within Firm Data.
• "Processing": any operation or set of operations performed on Personal Data, whether or not by automated means.
• "Firm Data": all content, documents, and data submitted by the Customer to the platform, as further defined in the Privacy Policy.

2.Subject matter and duration

This DPA governs Xycora's processing of Personal Data contained in Firm Data for the purpose of delivering the Xycora platform services under the main subscription agreement. The DPA takes effect on the date the subscription agreement is entered into and remains in force for the duration of that agreement, including any renewal terms.

3.Nature and purpose of processing

Xycora processes Personal Data for the following purposes, in each case only to the extent necessary to provide the contracted service:

• AI-assisted analysis, classification, and summarisation of legal documents submitted by the Customer.
• Document processing including OCR, indexing, discrepancy detection, and clause analysis.
• AI-assisted drafting of work product based on matter documents and firm precedents.
• Maintenance of audit logs recording sign-ins, uploads, sharing, AI requests, and other platform activity.
• Platform security monitoring and incident response.
• Preparing private drafts for an authorised user from a record of their own actions within the platform.

4.Type of personal data

The Personal Data processed under this DPA may include: names; email addresses; professional roles and firm identifiers; records of authorised users' own actions within the platform, with the kind of matter and a few words from its title and description; and personal data of any category contained within matter documents uploaded by the Customer, which may include financial information, medical information, communications, and other personal data depending on the nature of the Customer's legal practice.

5.Categories of data subjects

Personal Data processed under this DPA may relate to the following categories of data subjects: the Customer's firm personnel; the Customer's clients; and third parties (including opposing parties, witnesses, and other individuals) referenced in documents uploaded to the platform.

6.Processor obligations (Article 28(3))

Xycora commits to the following obligations as Processor:

• Instructions: Xycora will process Personal Data only on the documented instructions of the Controller. Where Xycora is required by applicable law to process Personal Data for other purposes, it will notify the Controller before such processing unless legally prohibited from doing so.
• Confidentiality: Xycora will ensure that all persons authorised to process the Personal Data are subject to binding confidentiality obligations.
• Security: Xycora will implement and maintain the technical and organisational security measures set out in Annex A of this DPA.
• Sub-processors: Xycora will not engage Sub-processors without the prior authorisation of the Controller, either specific or general. General authorisation is provided by the Customer's acceptance of this DPA, subject to the sub-processor change process in section 7 of this DPA.
• Data subject rights: Xycora will provide reasonable assistance to the Controller in responding to data subject access and other rights requests, taking into account the nature of processing and information available to Xycora.
• Breach notification: Xycora will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of an actual or reasonably suspected personal data breach affecting Firm Data, and will provide further information about the breach as it becomes available.
• DPIA assistance: Xycora will provide reasonable assistance to the Controller in connection with any data protection impact assessment required by Article 35 GDPR.
• Deletion and return: Upon termination of the subscription agreement, Xycora will make Firm Data available for export for 30 days and will permanently delete Firm Data from its systems, including earlier versions of stored files, within 60 days of the termination date, unless a longer retention period is required by applicable law. Copies held in database backups expire no later than 35 days after deletion.
• Audit assistance: Xycora will make available to the Controller all information necessary to demonstrate compliance with this DPA and will allow for, and contribute to, audits and inspections as provided in section 10 of this DPA.

7.Sub-processors (Annex B)

The Customer provides general authorisation for Xycora to engage the following Sub-processors to process Firm Data in connection with providing the platform:

Xycora will notify the Customer at least 30 days before engaging any new Sub-processor that will process Firm Data, providing details of the processing to be carried out. The Customer may object to a new Sub-processor within 14 days of such notice on reasonable data-protection grounds. If the parties cannot resolve the objection, either party may terminate the subscription agreement on 30 days' written notice.

8.Security measures (Annex A)

Xycora implements and maintains the following technical and organisational measures to protect Personal Data:

1. Encryption in transit between the Controller's browser and Xycora and between Xycora and its providers, and encryption at rest for every document and record.
2. A separate encryption key for each firm, held in a managed key service. Xycora staff cannot read a firm's protected data with it.
3. Pseudonymisation of documents and AI requests: names, addresses and identifiers in a document are found by an automated detection step that sends the document's text to OpenAI, a Sub-processor listed in Annex B, and are then replaced by placeholders specific to the firm before any AI engine answers questions about, analyses or drafts from the document; the same step runs on the text of every AI request from a firm with the anonymiser on, before it reaches the engines that answer; the mapping is encrypted under the firm's key; one original and one protected copy are kept for each document uploaded once the anonymiser is on (the anonymiser).
4. Role-based access control (owner, admin, lawyer, paralegal, viewer) and per-matter permissions, enforced on the server, with strict separation between firms.
5. Password-based sign-in with passwords stored only in hashed form; two-step sign-in available to every person and enforceable by the firm; sessions that expire and can be revoked.
6. An append-only audit trail of sign-ins, access, sharing, role changes and AI actions.
7. Document sealing to named recipients and electronic signing of PDFs with a key held per person in the managed key service, available to every firm.
8. Continuous backups and deletion protection on all stored data.
9. Automated dependency, code and secret scanning on every change before deployment.
10. Incident response: notification to the Controller without undue delay, as set out in section 6.

9.International transfers

Where Personal Data is transferred from the EEA, UK, or Switzerland to Xycora or its Sub-processors located in countries without an adequacy decision, such transfers are governed by:

• The EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (Controller to Processor), for transfers from the EEA.
• The UK International Data Transfer Addendum (IDTA) to the EU SCCs, for transfers from the UK.
• The Swiss-US Data Privacy Framework and/or Swiss SCCs, as applicable, for transfers from Switzerland.

Executed copies of the applicable SCCs and the IDTA are incorporated into this DPA by reference and are available to the Customer on request by contacting [email protected].

10.Audit rights

Upon at least 30 days' written notice, the Customer may conduct (or instruct a suitably qualified third party to conduct) an audit of Xycora's data processing activities and technical and organisational measures to verify compliance with this DPA, no more than once per 12-month period and subject to reasonable confidentiality obligations.

11.DPA term

This DPA is coterminous with the main subscription agreement between the parties. Obligations relating to the deletion and return of Personal Data, and obligations of confidentiality, survive termination of the main agreement.