Data Processing Agreement

1.0 Parties and scope

This Data Processing Agreement (“DPA”) is entered into between the customer organization identified in the applicable customer agreement (“Customer”) and SOVRINT Inc. (“SOVRINT”). It forms part of the Terms of Service and any order form or master subscription agreement between the parties (together, the “Agreement”), and applies wherever SOVRINT processes Personal Data contained in Customer Content on Customer’s behalf.

This DPA is incorporated into the Agreement by reference and takes effect on the date the Agreement starts. Customers who require a countersigned copy, or who need to attach their own controller details, may request one from privacy@sovrint.com.

2.0 Definitions

• Customer Content means the data that Customer and its authorized users add to or generate within their SOVRINT workspace, including watchlists, cases, claims, notes, briefs, uploaded files and preserved copies of source material.
• Data Protection Laws means all laws that apply to the processing of Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (“CCPA”) and other US state privacy laws.
• Personal Data, Controller, Processor, Data Subject, Processing and Personal Data Breach have the meanings given in the GDPR. Business, Service Provider, Sell and Share have the meanings given in the CCPA.
• Sub-processor means a third party engaged by SOVRINT to process Personal Data on Customer’s behalf.
• Standard Contractual Clauses or SCCs means the clauses approved by European Commission Decision 2021/914, and UK Addendum means the International Data Transfer Addendum issued by the UK Information Commissioner.

3.0 Roles of the parties

For Personal Data in Customer Content, Customer is the Controller (or a Processor acting for its own controllers) and SOVRINT is the Processor. Under the CCPA, Customer is the Business and SOVRINT is the Service Provider.

SOVRINT is an independent Controller of account data for Customer’s authorized users, business contact details and the operational records described in the Privacy Policy. That data is outside this DPA.

4.0 Customer instructions and responsibilities

SOVRINT will process Personal Data in Customer Content only on Customer’s documented instructions, which consist of the Agreement, the use of platform features by Customer’s users, and any further written instructions Customer gives, unless required to do otherwise by law, in which case SOVRINT will inform Customer before processing unless the law prohibits it. SOVRINT will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

Customer is responsible for:

• having a lawful basis, and giving any notices required, for the Personal Data it adds to the platform and for the publicly available material it directs the platform to collect, preserve and analyse;
• ensuring its investigations and its users comply with the Acceptable Use Policy and the laws that apply to Customer;
• configuring retention, access and user permissions in its workspace appropriately, and keeping its account credentials secure;
• not directing SOVRINT to process special categories of data, or data about children, except where such data appears incidentally in public sources within the lawful scope of an investigation.

5.0 Confidentiality

SOVRINT ensures that personnel authorized to process Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, receive data protection and security training, and access Personal Data only to the extent needed to provide the services, support Customer or comply with law.

6.0 Security

SOVRINT will implement and maintain the technical and organizational measures described in Annex II, which are designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. SOVRINT may update those measures from time to time, provided the updates do not materially reduce the overall level of protection.

7.0 Sub-processors

Customer gives general authorization for SOVRINT to engage the Sub-processors listed in Annex III. SOVRINT will give Customer at least 30 days’ written notice, by email to the account administrator or by updating this page and notifying Customer, before adding or replacing a Sub-processor. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection in good faith, Customer may terminate the affected services and receive a pro-rata refund of prepaid fees for the remaining term.

SOVRINT will impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains liable to Customer for the performance of its Sub-processors.

8.0 Data subject requests

If SOVRINT receives a request from a Data Subject relating to Personal Data in Customer Content, it will notify Customer without undue delay and will not respond to the request except to acknowledge it and refer the Data Subject to Customer, unless the law requires otherwise. Taking into account the nature of the processing, SOVRINT will assist Customer with appropriate technical and organizational measures, including workspace search, export and deletion features, to enable Customer to meet its obligations to respond to Data Subject requests.

9.0 Personal Data Breach

SOVRINT will notify Customer without undue delay, and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Customer Content. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact. Information may be provided in phases as it becomes available. SOVRINT will cooperate with Customer and take reasonable steps to contain and remediate the breach. Notification is not an admission of fault or liability.

10.0 Assistance and audits

SOVRINT will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities where they relate to the services, taking into account the nature of the processing and the information available to SOVRINT.

SOVRINT will make available the information reasonably necessary to demonstrate compliance with this DPA, including security documentation and summaries of any independent assessments it holds. Where that information is not sufficient to satisfy a legal requirement of Customer, Customer or an independent auditor bound by confidentiality may audit SOVRINT’s relevant controls once in any twelve-month period on at least 30 days’ written notice, during normal business hours, in a manner that does not disrupt SOVRINT’s operations or compromise other customers. Customer bears the cost of the audit unless it reveals a material breach of this DPA.

11.0 International transfers

SOVRINT and its Sub-processors are located in the United States. Where Customer Content includes Personal Data protected by the GDPR, the UK GDPR or Swiss law and is transferred to a country without an adequacy decision, the parties agree that:

• the SCCs, Module Two (controller to processor) or Module Three (processor to processor) as applicable, are incorporated into this DPA, with Customer as data exporter and SOVRINT as data importer, the optional docking clause included, option 2 of clause 9 selected with the notice period in section 7.0, the governing law and forum of clause 17 and 18 being those of Ireland, and Annexes I to III of this DPA serving as the annexes to the SCCs;
• for transfers subject to the UK GDPR, the UK Addendum applies with the SCCs and the parties’ details are those in the Agreement and Annex I;
• for transfers subject to Swiss law, references to the GDPR are read as references to the Swiss Federal Act on Data Protection and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

If a transfer mechanism relied on is invalidated or replaced, the parties will work together in good faith to put an alternative lawful mechanism in place.

12.0 US state privacy laws

To the extent the CCPA or another US state privacy law applies, SOVRINT will not sell or share Personal Data; will not retain, use or disclose it for any purpose other than the business purposes specified in the Agreement or outside the direct business relationship with Customer; will not combine it with Personal Data received from other sources except as permitted by law; and will comply with the obligations that apply to Service Providers and contractors. SOVRINT certifies that it understands these restrictions, will notify Customer if it can no longer meet them, and will allow Customer to take reasonable steps to stop and remediate unauthorized use.

13.0 Return and deletion

During the term, Customer can export and delete Customer Content through the platform. Within 30 days after the Agreement ends, Customer may request an export of its Customer Content in a standard format. After that period, or sooner at Customer’s written request, SOVRINT will delete Customer Content and existing copies within 90 days, except where retention is required by law or a legal hold, in which case SOVRINT will continue to protect the data and process it only for that purpose. Data in backups is overwritten in the ordinary backup cycle. SOVRINT will confirm deletion in writing on request.

14.0 Liability, term and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement, and the parties’ combined liability under this DPA and the Agreement is a single aggregate amount. This DPA lasts for as long as SOVRINT processes Personal Data on Customer’s behalf. In the event of conflict, this DPA prevails over the Agreement on data protection matters, and the SCCs prevail over this DPA. SOVRINT may update this DPA to reflect changes in Data Protection Laws or the services with notice to Customer, provided the update does not materially reduce Customer’s protections.

Annex I: Details of processing

Annex II: Technical and organizational measures

• Encryption. All traffic is encrypted in transit and pinned to HTTPS with strict transport security. Data is encrypted at rest by the storage and database providers.
• Access control. Each customer workspace is separated by tenant identifier and every query is scoped to the caller’s tenant. Access within a workspace is controlled by role. Passwords are stored only as salted hashes, and sign-in attempts are rate limited.
• Accountability. Administrative and content actions are recorded in a per-workspace audit log that identifies the actor, action, record and time.
• Application security. Public endpoints are rate limited, validated and protected against automated submission. Responses carry a content security policy, frame denial and related browser protections. Vulnerabilities are handled under the Security Disclosure policy.
• Personnel. Access to production systems is limited to staff who need it to operate the service, is granted individually, and is removed when no longer required. Personnel are bound by confidentiality obligations.
• Resilience and deletion. Infrastructure providers maintain redundancy and backups. Deletion requests are carried out as described in section 13.0.
• Incident management. Security events are investigated and Customer is notified of Personal Data Breaches as described in section 9.0.

Annex III: Sub-processors

Customers can ask privacy@sovrint.com to be notified by email of changes to this list.