Data Processing Addendum
1. Scope & parties.
This DPA applies where Analyzed Discovery ("Processor") processes personal data on behalf of an attorney or firm ("Controller") in providing the service. It is incorporated into and governed by the Terms of Use. "Personal data" has the meaning given under applicable data-protection law (e.g., GDPR, CCPA/CPRA).
2. Roles.
The Controller is the attorney or firm that determines the purposes and means of processing matter data; Analyzed Discovery acts as Processor, processing matter data only on documented instructions from the Controller and as necessary to provide the service.
3. Details of processing.
4. Zero retention & no training.
Matter data is processed solely to produce the Controller's work product and is permanently erased from Analyzed Discovery's systems on download. Matter data is not used to train any model, Analyzed Discovery's or any sub-processor's, and Analyzed Discovery requires contractual no-training terms from every system that touches matter data.
5. Sub-processors.
Analyzed Discovery engages processing providers under written terms imposing confidentiality and the no-training and security obligations no less protective than this DPA. The Controller grants general authorization to Analyzed Discovery's sub-processors as listed; the current list is provided to engaged customers under NDA. Analyzed Discovery remains liable for sub-processor performance consistent with applicable law. Analyzed Discovery will notify the Controller of intended sub-processor changes and the Controller may object on reasonable data-protection grounds.
6. Security measures.
Analyzed Discovery implements technical and organizational measures appropriate to the risk, including: encryption in transit (TLS 1.2/1.3) and at rest (AES-256); per-matter scoping; role-based, least-privilege, multi-factor access with no engineering or operations access to matter content; per-matter isolation; logging and monitoring; and a defined incident-response process. [Confirm: hosting region, certification status (SOC 2 / ISO 27001 — in progress), and pen-test cadence.]
7. Data-subject rights assistance.
Taking into account the zero-retention model, Analyzed Discovery will reasonably assist the Controller in fulfilling its obligations to respond to data-subject requests (access, correction, deletion, objection), recognizing that matter data is erased on download and therefore generally no longer exists to correct or retrieve after that point.
8. Personal-data breach notification.
Analyzed Discovery will notify the Controller without undue delay of any personal-data breach affecting matter data of which Analyzed Discovery becomes aware, and will provide reasonable information and cooperation to meet the Controller's notification obligations. [Confirm notification timeline, e.g., without undue delay and in any event within 72 hours of awareness.]
9. Return & deletion.
On download or on request, Analyzed Discovery will erase matter data from its systems and direct its sub-processors to erase matter data consistent with their terms. Analyzed Discovery retains only account, billing, and security-metadata as described in the Privacy Policy.
10. International transfers.
To the extent matter data is processed outside the Controller's jurisdiction, transfers occur under appropriate safeguards. [Confirm transfer mechanism: EU Standard Contractual Clauses, UK International Data Transfer Addendum, or applicable derogation, and the list of third countries.]
11. Audit.
Analyzed Discovery will make available information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including reasonable independent assessments, subject to confidentiality and the security limits that protect other customers. [Confirm audit/assessment mechanism.]
12. Order of precedence & governing law.
In the event of conflict, this DPA prevails over the Terms of Use solely as to processing of personal data. This DPA is governed by the same law as the Terms of Use [the State of Nevada], except where GDPR or other mandatory data-protection law requires otherwise.
13. Contact.
Data-protection inquiries: [email protected].