Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between the firm identified in the AnoLawg order form or subscription record (the "Customer" or "Controller") and AnoLawg, LLC, a Ohio limited liability company ("AnoLawg" or "Processor").

In respect of personal data processed under the AnoLawg Terms of Service, the Customer is the controller and AnoLawg is the processor as those terms are defined in Article 4 of the EU General Data Protection Regulation 2016/679 ("GDPR") and equivalent terms under the UK GDPR and applicable US state privacy laws (CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, and successors).

This DPA is effective when the Customer first accepts the Terms of Service and remains in force for the duration of the subscription, including any wind-down period.

Subject matter:AnoLawg processes the Customer's legal practice management data — matters, contacts, calendar events, tasks, billable time, expenses, invoices, trust-ledger entries, provider-import files, matter-document pointers, generated files, and communications — and operates the Client Portal through which the Customer's clients exchange messages and files with the firm. Matter-document file bytes are generally stored in the Customer's connected Microsoft or Google drive rather than in AnoLawg.

Nature and purpose: Storage, retrieval, display, indexing, transmission, backup, and deletion of personal data, in each case strictly as instructed by the Customer through the AnoLawg product and API.

Duration: For the term of the subscription plus the deletion window in §11.

Categories of data subjects: firm users (attorneys, paralegals, staff), the firm's clients, opposing parties, witnesses, and other third parties referenced in matter records, and any other natural persons whose personal data the Customer uploads.

Categories of personal data: names, contact details, professional credentials, matter facts (which may include sensitive categories such as health, financial, or criminal-justice information), billing records, provider-import raw CSV contents, generated invoice PDFs and export archives, matter document metadata and provider pointers, communications, authentication identifiers, session metadata, and service telemetry.

Special categories: AnoLawg does not require the upload of special-category data but acknowledges that legal matters frequently include it. The Customer warrants that it has a lawful basis under Art. 9(2) GDPR (or equivalent) for any such processing and remains solely responsible for matter content.

Where personal data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a third country that has not received an adequacy decision, the parties incorporate by reference the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller to Processor), as if set out in full. For transfers from the UK, the parties additionally incorporate the UK International Data Transfer Addendum (Version B1.0). For transfers from Switzerland, the SCCs apply with Swiss-specific adjustments per FADP.

Docking clause: third parties may accede to the SCCs incorporated here in accordance with Clause 7 of the SCCs.

AnoLawg maintains a transfer impact assessment (TIA) for each subprocessor in a third country and will provide it to the Customer on reasonable request.

AnoLawg will notify the Customer without undue delay, and in any event within 72 hoursof becoming aware of a confirmed personal-data breach affecting the Customer's personal data. The notification will describe, to the extent then known: the nature of the breach and categories / approximate numbers of data subjects and records concerned, likely consequences, measures taken or proposed, and a named point of contact.

AnoLawg will cooperate with the Customer in investigation, remediation, and any required regulator or data-subject notices. AnoLawg's notification is not an acknowledgement of fault and does not supersede the Customer's independent breach-notification obligations.

Taking into account the nature of the processing, AnoLawg will assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to data-subject requests under Chapter III of the GDPR (access, rectification, erasure, restriction, portability, objection). Self-service export, edit, and delete tools are provided where available in-product; where an export or deletion workflow is not self-service, AnoLawg will route the written request through support and respond within 30 days.

AnoLawg will provide reasonable assistance with data-protection impact assessments and prior consultations with supervisory authorities under Arts. 35–36 GDPR, including by supplying the documentation referenced in §§5–7.

AnoLawg will make available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR. On reasonable written notice (at least 30 days), the Customer — or a mutually-agreed independent auditor bound by confidentiality — may conduct an audit no more than once per year, during business hours, without disrupting service to other customers. AnoLawg may satisfy this obligation by providing copies of its most recent independent third-party audit reports and penetration-test summary letter.

The Customer bears its own costs for audits; AnoLawg bears its own costs for producing standard reports.

On termination or expiry of the subscription, the Customer may export all firm-operating data via in-product export tools. At the Customer's written election within 30 days of termination, AnoLawg will either (a) return the remaining personal data in a structured, commonly-used format, or (b) begin dependency-safe deletion or anonymization.

Deletion and anonymization are subject to legal holds, firm instructions, tax and audit retention, active disputes, dependency mapping, provider-controlled storage, and backup cycles. Underlying matter documents in the Customer's connected Microsoft or Google drive remain under the Customer's control and are not deleted by AnoLawg.

Liability under this DPA is subject to the limitations in the Terms of Service (as modified for data-protection matters by the non-excludable provisions of applicable law).

This DPA is governed by the law specified in the Terms of Service, except where Art. 28 GDPR or the SCCs require otherwise; in those cases, EU Member State law or UK law applies to the affected provisions.

Once this draft is counsel-approved and the page switches to effective YYYY-MM-DD, the DPA is automatically in force for every Customer that has accepted the Terms of Service — no separate signature is required for US customers processing only US personal data.

EU/UK/Swiss customers, or customers whose own compliance programme requires a counter-signed copy, may email privacy@anolawg.com with their legal-entity details and we will return a counter-signed PDF referencing the version stamp on this page.