Data Processing Addendum

Applicable Privacy Laws means all data protection and privacy laws and regulations applicable to the Personal Information processed by the Services pursuant to the Agreement, including, where applicable, the New Zealand Privacy Act 2020, the UK Data Protection Law, the EU Data Protection Law, the Australian Privacy Act 1988 (Cth), and the CCPA.

CCPA means the California Consumer Privacy Act 2018, as amended by the California Privacy Rights Act and its implementing regulations. The following terms have the definitions given to them in the CCPA: “Business,” “Sale,” “Share,” “Service Provider,” and “Third Party.”

Controller means the entity that determines the purposes and means of processing Personal Information. “Controller” includes equivalent terms in Applicable Privacy Laws, such as the CCPA-defined term “Business”, or “Third Party,” as context requires.

Customer means the entity identified in the Agreement.

Customer Personal Information means any Personal Information processed by LawVu on behalf of the Customer pursuant to the Agreement, including Personal Information contained in any User Data (as defined in the Agreement).

EU Data Protection Laws means all data protection and privacy laws applicable in the European Union to the Personal Information processed by the Services pursuant to Agreement, including the General Data Protection Regulation (EU) 2016/679 (“EU GDPR”).

Personal Information has the meaning given to the phrase “personal information” and “personal data” as provided in Applicable Privacy Laws.

Personal Information Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Information processed by LawVu pursuant to the Agreement.

Processor means an entity that processes Personal Information on behalf of another entity. “Processor” includes equivalent terms in Applicable Privacy Laws, such as the CCPA-defined term “Service Provider,” as context requires.

Regulatory Bodies means those government departments and regulatory, statutory and other bodies, entities and committees which, whether under statute, rule, regulation, code of practice or otherwise, are entitled to regulate, investigate or influence the matters relating to the security of data, Personal Information, privacy protection or other laws connected to the Agreement.

Services means the services provided by LawVu to the Customer as set out in the Agreement.

Standard Contractual Clauses means the standard contractual clauses approved by the European Commission in Commission Decision 2021/914 dated 4 June 2021, for Transfers of Personal Information to Third Countries not otherwise recognized as offering an adequate level of protection for Personal Information by the European Commission (as amended and updated from time to time).

Subprocessor means any Processor engaged by LawVu to process the Customer Personal Information to provide the Services.

Transfer means making Customer Personal Information accessible to any person other than the data subject, including, but not limited to the active transfer of the data, permitting access, also remotely, storing, sharing and publishing.

Third Country means a country or territory that is not: (a) where the UK GDPR applies, subject to an adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018; or (b) where the EU GDPR applies, subject to an adequacy determination by the European Commission.

UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued under section 119A of the UK Data Protection Act 2018 (as amended and updated from time to time).

UK Data Protection Law means all data protection and privacy laws applicable in the United Kingdom to the Personal Information processed by the Services pursuant to Agreement, including the EU GDPR as it forms part of UK law by virtue of section 3 of the UK Data Protection Act 2018 (the “UK GDPR”).

1. references to “data subject”, “processing” and “special category Personal Information” shall have the same meanings ascribed to them by the Applicable Privacy Laws;
2. reference to a party shall include that party's executors, administrators, successors and assigns;
3. reference to a statute or regulation shall include all amendments and re-enactments thereof;
4. writing includes electronic communications (including email) and written has a corresponding meaning; and
5. terms not otherwise defined in this Addendum will have the meaning set out in the Agreement.

1. no contractual obligations prohibit the processing of the Customer Personal Information as described in the Agreement (including this Addendum); and
2. the production, collection, and processing of Customer Personal Information has been and will continue to be carried out in accordance with the Applicable Privacy Laws.

1. LawVu is prohibited from: (i) Selling or Sharing Personal Information; (ii) retaining, using, or disclosing Personal Information for any purpose other than for the specific business purpose of performing Customer’s documented instructions for the business purposes defined in clause 3.2.1 and as described in more detail in the Agreement, including retaining, using, or disclosing the Personal Information for a commercial purpose other than performing Customer’s instructions; or (iii) retaining, using, or disclosing the Personal Information outside of the direct business relationship between the parties as defined in this Agreement, unless expressly permitted by the CCPA.
2. LawVu is prohibited from combining the Personal Information that it receives from, or on behalf of, the Customer with Personal Information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that LawVu may combine Personal Information to perform a business purpose as defined in the CCPA (except for providing marketing and advertising services).
3. LawVu must comply with all applicable sections of the CCPA, including, with respect to the Personal Information it collects pursuant to the Agreement, providing the level of privacy protection that is required of Businesses by the CCPA.
4. LawVu will notify the Customer if it makes a determination that it can no longer meet its obligations under the CCPA.
5. LawVu will grant the Customer the right, upon notice, to take reasonable and appropriate steps to stop and remediate LawVu’s unauthorized use of Personal Information.

1. LawVu shall only process Personal Information for the limited and specific purposes for which the Personal Information is made available by the Customer to LawVu and according to the written instructions of Customer
2. LawVu will comply with all applicable sections of the CCPA, including by providing the same level of privacy protections as required of Businesses under the CCPA.
3. LawVu will grant the Customer the right, with respect to Personal Information that the Customer makes available to LawVu, to take reasonable and appropriate steps to: (i) ensure that LawVu uses the Personal Information in a manner consistent with the Customer’s obligations under the CCPA; and (ii) stop and remediate unauthorized use of Personal Information made available to LawVu by the Customer.
4. LawVu will notify the Customer if it makes a determination that it can no longer meet its obligations under the CCPA.

1. in the event of an investigation or other control measures or by any Regulatory Body to the extent that such investigation relates to Customer Personal Information;
2. in the event of the exercise of any claims by data subjects or third parties related to the processing of Customer Personal Information under this Addendum or the Agreement;
3. complying with the rights of data subjects, including the right to obtain transparent information, the right to access, rectify, and erase their Personal Information, restrict, or object to, the processing of their Personal Information, exercise their right to data portability;
4. in notifying, consulting with and obtaining approvals from Regulatory Bodies where required; and
5. in performing data protection impact assessments.

1. LawVu shall promptly comply with any request from the Customer requiring LawVu to access, amend, obtain a copy or delete any Customer Personal Information, in a manner consistent with the functionality of the Services and LawVu’s role as a Processor,
2. For the avoidance of doubt, Customer is responsible for responding to requests from data subjects to exercise rights under Applicable Privacy Laws. LawVu must inform the Customer promptly, in accordance with the notification requirements under Applicable Privacy Laws, following LawVu’s receipt of any inquiry from a data subject with respect to Customer Personal Information.
3. Provided that the Customer acts in accordance with Applicable Privacy Laws, LawVu shall not respond to any such request referred to in clause 4.2(b) unless expressly authorised to do so by the Customer.

1. any legally binding request addressed to LawVu or any of its Subprocessors for the disclosure of Customer Personal Information by a Regulatory Body, unless otherwise prohibited by the applicable law; and
2. any monitoring activities and measures undertaken by the Regulatory Body, including where a Regulatory Body investigates LawVu for a possible breach of Applicable Privacy Laws.

1. notify the Customer, taking into account the notification duty requirements imposed on the Customer under Applicable Privacy Laws;
2. investigate the Personal Information Breach and provide the Customer with the information set out in clause 5.b; and
3. take all the necessary measures to remedy or mitigate the Personal Information Breach and to prevent further similar Personal Information Breaches.

1. LawVu maintains a list of the names and locations of all Subprocessors engaged at the effective date of the Agreement, which is available at https://lawvu.com/trust-center/privacy/subprocessors/
2. in its contracts with the Subprocessors LawVu includes terms which provide substantially the same protections to the Customer Personal Information as those set out in this Addendum;
3. LawVu will assume liabilities for the acts and omissions of its Subprocessors in relation to the Services provided to the Customer.
4. LawVu notifies Customer of the appointment of any new Subprocessors with thirty (30) days prior notice. Customer agrees that such notice may be provided by means of a publicly-accessible webpage where LawVu provides details of all of its Subprocessors, including proposed Subprocessor appointments. Subject to clause 7.2, the new Subprocessor will start processing Customer Personal Information at the end of the thirty (30) days prior notice.