Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between your law firm ("Controller") and Judicialx ("Processor") when you use the service for client matter data.

Roles

• Controller: your firm determines purposes and means of processing client and staff personal data in cases.
• Processor: Judicialx processes data only on documented instructions from the Controller via use of the product and these terms.

Processor obligations

• Process personal data only to provide and secure the service.
• Maintain appropriate technical and organizational security measures.
• Assist with data subject requests (export/delete) via product features and support.
• Notify the Controller without undue delay after becoming aware of a personal data breach.
• Delete or return data on termination, subject to legal retention requirements.

Subprocessors

The Controller authorizes Judicialx to engage subprocessors listed below. We will update this list before adding a new subprocessor that processes personal data.

Security measures

• Encryption in transit (TLS) and at rest (provider-managed SSE).
• Row-level security on case-scoped database tables.
• Role-based access within organizations and per-case membership.
• Audit logging of domain mutations and AI call metadata (no prompt storage).

International transfers

Where personal data is transferred outside Nigeria, Processor relies on appropriate safeguards including standard contractual clauses or equivalent mechanisms required by applicable law. Confirm specifics with counsel before external launch.

Term

This DPA applies for the duration of the subscription and survives termination until client data is deleted or returned per the Privacy Policy retention schedule.

Execution

For a countersigned copy or firm-specific amendments, contact legal@judicialx.com.