Data Processing Addendum
This summary is provided for information only and must be reviewed and signed by qualified counsel before it is executed by either party.
1. Roles
The firm acts as the data controller for personal data it uploads to OMRAN. LEXPATH AI acts as the data processor and processes personal data only on documented instructions from the firm.
2. Subject matter and duration
Processing covers matter records, client and party data, documents, communications, and telemetry, for the duration of the firm's subscription plus a limited post-termination export window.
3. Nature and purpose
Personal data is processed to provide matter management, drafting, research, translation, redaction, and workflow features requested by the firm.
4. Sub-processors
LEXPATH AI engages vetted sub-processors including cloud infrastructure, storage, email, and AI providers. A current list is available on request. The firm is notified of material changes and may object on reasonable grounds.
5. Security measures
Technical and organisational measures include encryption in transit and at rest, strict role-based access control, row-level security per firm, isolated tenant contexts, audit logging, and regular access reviews.
6. International transfers
Where personal data is transferred outside the firm's country, appropriate safeguards apply, including standard contractual clauses and data-region controls where offered.
7. Data subject requests
LEXPATH AI assists the firm in responding to data-subject requests through in-product export, correction, and deletion tools and by responding to written requests within a reasonable time.
8. Incident notification
LEXPATH AI notifies the firm without undue delay upon becoming aware of a personal-data breach affecting the firm's data, together with information reasonably required to meet the firm's own notification obligations.
9. Deletion and return
On termination, and subject to any legal retention requirements, personal data is deleted or returned within the timeframes described in the retention policy.
10. Contact
Requests to execute a DPA or questions about this summary can be sent to support@legalfriend.ai.