Data Processing Agreement

Effective date: August 5, 2026

This Data Processing Agreement (“DPA”) forms part of the agreement (the “Agreement”) between the customer (the “Customer”) and AI LAWTECH sp. z o.o. (“Referent”) under which the Customer is licensed to use the Referent platform (the “Service”). It applies where, and to the extent that, Referent processes Customer Personal Data that is subject to the GDPR, the UK GDPR, or the Polish Act on the Protection of Personal Data. If there is a conflict between the Agreement and this DPA on the processing of Customer Personal Data, this DPA prevails.

1. Definitions

Terms not defined here have the meaning given in the Agreement or in Data Protection Law.

• “Data Protection Law” means the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR as defined in the Data Protection Act 2018, the Polish Act on the Protection of Personal Data, and all other applicable laws protecting personal data, as amended from time to time.
• “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing”, “Special Categories of Data” and “Supervisory Authority” have the meanings given in the GDPR.
• “Customer Personal Data” means Personal Data contained in the Content or otherwise processed by Referent on the Customer’s behalf in connection with the Service, as described in Annex 1.
• “Content” means the data, documents, communications and other materials the Customer or its users upload to, or generate in, the Service.
• “Sub-processor” means any processor engaged by Referent to process Customer Personal Data.
• “Standard Contractual Clauses” / “SCC” means the clauses annexed to Commission Implementing Decision (EU) 2021/914, Module Two (Controller-to-Processor) or, as applicable to a given transfer, Module Three (Processor-to-Processor).
• “UK Addendum” means the ICO International Data Transfer Addendum (template B.1.0) to the SCC.
• “EU-US DPF” means the EU-US Data Privacy Framework under Commission Implementing Decision (EU) 2023/1795.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

2. Roles and scope

2.1. The parties agree that, for Customer Personal Data, the Customer is the Controller and Referent is the Processor. Where the Customer is itself a processor for a third-party controller, the Customer warrants it has the authority to instruct Referent as a sub-processor on that controller’s behalf.

2.2. The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1.

2.3. Referent processes Customer Personal Data only to provide and support the Service and as further instructed by the Customer.

3. Processing on documented instructions

3.1. Referent will process Customer Personal Data only on the Customer’s documented instructions, including as to international transfers, unless required to do otherwise by law; in that case Referent will inform the Customer first, unless the law prohibits it. The Agreement and this DPA (together with the Customer’s use and configuration of the Service) constitute the Customer’s complete and final documented instructions.

3.2. Processing outside these instructions requires prior written agreement of the parties.

3.3. If the Customer or a user places into the Service Personal Data of a type or about a category of Data Subject not listed in Annex 1, the Customer is deemed to instruct Referent to process it on the terms of this DPA.

3.4. Referent will inform the Customer if, in its opinion, an instruction infringes Data Protection Law; Referent may suspend the affected processing until the instruction is confirmed or amended.

4. The Customer’s responsibilities

4.1. The Customer warrants that it has, and will maintain, a lawful basis and all necessary consents, authorisations and legal grounds to collect the Content and to have Referent process the Customer Personal Data under the Agreement, including any Special Categories of Data and data on criminal matters.

4.2. The Customer is solely responsible for the accuracy, quality and lawfulness of the Content and the means by which it acquired it. Referent does not review or monitor the Content and does not control what the Customer chooses to upload or collect through the Service.

4.3. The Customer is responsible for providing the Data Subjects whose Personal Data it processes through the Service with the information required by Articles 13-14 GDPR, including, where applicable, that their Personal Data may be processed using AI features and transferred as described in Annex 3 and Section 8. To support this, Referent makes available model information text and up-to-date Sub-processor details on request. Referent is not responsible for the content of the Customer’s own notices, or for the Customer’s failure to inform its Data Subjects.

4.4. The Service is not designed for Special Categories of Data. The Customer may nonetheless choose to include such data in the Content; if it does, it does so as Controller and remains responsible for satisfying the applicable Article 9 GDPR condition. Referent will apply the same protective measures regardless.

5. Confidentiality

5.1. Referent will treat Customer Personal Data as confidential and will ensure that persons authorised to process it are bound by a duty of confidentiality (contractual or statutory) and are made aware that the Content may be subject to professional legal secrecy.

5.2. Access by Referent personnel to Customer Personal Data is on a least-privilege, need-to-know basis, logged, and limited to what is necessary to provide, secure and support the Service. Referent does not use the Content for its own purposes and does not use it to train generative AI models (Section 14).

5.3. Referent authorises named individuals to process Customer Personal Data only where necessary, keeps a record of who is authorised, and ensures each is bound by written confidentiality obligations. Where required by the law of a Customer’s jurisdiction, personnel with access to Content are additionally placed under an obligation of professional secrecy (for example § 203 of the German Criminal Code).

6. Security

6.1. Referent will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. The measures in force are described in Annex 2.

6.2. Referent may update the measures from time to time provided the level of protection is not materially reduced.

6.3. Referent maintains a record of the categories of processing carried out on the Customer’s behalf, as required by Article 30(2) GDPR, and makes relevant extracts available to the Customer on request.

7. Sub-processing

7.1. The Customer gives general written authorisation for Referent to engage Sub-processors to process Customer Personal Data. The Sub-processors authorised at the date of this DPA are listed in Annex 3.

7.2. Referent will impose on each Sub-processor, by written contract, data-protection obligations at least equivalent to those in this DPA, and remains liable to the Customer for each Sub-processor’s performance as if it were Referent’s own.

7.3. Changes. Referent will inform the Customer of any intended addition or replacement of a Sub-processor by updating Annex 3 and notifying the Customer in advance, stating the Sub-processor’s name, location, function, transfer basis (if outside the EEA), relevant certifications (e.g. ISO 27001, SOC 2) and a summary of its safeguards.

7.4. The Customer may object to a new Sub-processor on reasonable, documented data-protection grounds within 14 days of notice. The parties will work in good faith to resolve the objection; if they cannot, and the change is necessary, either party may terminate the affected part of the Service or the Agreement on 30 days’ notice, with no additional charge for data export and migration. Absence of objection within the period is deemed acceptance. This right does not apply to the Sub-processors listed in Annex 3 at the date of this DPA, which are already authorised.

7.5. Urgent changes. Where an urgent change is required (for example a Sub-processor ceasing operations or losing a certification), Referent will inform the Customer within 48 hours, apply a temporary compliant safeguard, and run the notice procedure in parallel on a shortened timescale.

8. International transfers

8.1. Referent processes Customer Personal Data of customers established in the EEA or the UK within the EEA.

8.2. To the extent Referent transfers Customer Personal Data outside the EEA or the UK (including where a customer is established elsewhere, or through the Sub-processors in Annex 3), it will ensure an adequate level of protection through at least one of: (a) the SCC — Module Two (Controller-to-Processor), with the Customer as exporter and the recipient as importer (the Customer appoints Referent as its agent to enter into the SCC on its behalf), or, for a transfer from Referent to a Sub-processor, Module Three (Processor-to-Processor), with Referent as exporter and the Sub-processor as importer; (b) for UK data, the UK Addendum; (c) the EU-US DPF where the recipient is certified, as a supplementary mechanism; (d) a European Commission adequacy decision; or (e) another lawful transfer mechanism.

8.3. Referent carries out a transfer risk assessment for transfers to Sub-processors outside the EEA and applies supplementary measures where needed. On the Customer’s request, Referent will provide information about the safeguards and a copy of the relevant SCC.

9. Data Subject requests

9.1. Taking into account the nature of the processing, Referent will assist the Customer, by appropriate technical and organisational measures and insofar as possible, to respond to requests by Data Subjects exercising their rights under Data Protection Law.

9.2. If Referent receives a request directly from a Data Subject relating to Customer Personal Data, it will not respond substantively (except to confirm the Customer is responsible) and will forward the request to the Customer without undue delay.

10. Assistance to the Customer

Taking into account the nature of the processing and the information available to it, Referent will assist the Customer in ensuring compliance with its obligations under Articles 32-36 GDPR, including security, Personal Data Breach notification, data protection impact assessments and prior consultation with a Supervisory Authority, in each case in relation to the processing of Customer Personal Data.

11. Personal Data Breach

11.1. Referent will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

11.2. The notification will describe, to the extent known, the nature of the breach, the categories and approximate volume of data and Data Subjects affected, the likely consequences, and the measures taken or proposed. Referent will provide reasonable further information and cooperation to help the Customer meet its own notification obligations.

12. Audit and information

12.1. Referent will make available to the Customer information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA. On the Customer’s written request, this includes:

12.1.1. an extract of Referent’s record of processing relating to the Customer;

12.1.2. a description of the technical and organisational measures (Annex 2);

12.1.3. the current list of Sub-processors, with their processing locations and transfer mechanisms, including confirmation of any EU-US DPF certification; and

12.1.4. information on applicable retention periods.

12.2. Referent will respond within a reasonable period, not exceeding 7 business days. Where available, Referent will also provide relevant third-party audit reports and certifications (for example SOC 2 or ISO 27001).

12.3. Where such information is insufficient, Referent will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, provided the audit is: (a) on reasonable prior notice; (b) no more than once per year, unless required by a Supervisory Authority or following a Personal Data Breach; (c) during business hours; and (d) conducted so as to minimise disruption and to protect the confidentiality of other customers’ data.

13. Deletion and return of data

13.1. On termination of the Agreement, Referent will, at the Customer’s choice, delete or return the Customer Personal Data held in the Service’s own infrastructure and delete existing copies, unless retention is required by law.

13.2. Deletion from the live Service takes place without undue delay. Copies held in Referent’s encrypted backups are cycled out and overwritten within up to 60 days. On request, Referent will confirm deletion in writing.

13.3. For Customer Personal Data held by Sub-processors listed in Annex 3, deletion follows those providers’ enterprise-class retention policies, which Referent will enforce and which do not exceed the term of the Agreement.

14. Artificial intelligence

14.1. The Service includes AI features that assist users (for example drafting, summarisation, classification, transcription, text-to-speech, OCR and search). AI assists only; it does not make decisions producing legal or similarly significant effects on a solely automated basis. The Customer’s users review and decide.

14.2. To deliver these features, relevant Content may be processed by the AI Sub-processors in Annex 3. For customers in the EEA or the UK, this processing takes place within the EEA using EU-region enterprise deployments.

14.3. Referent contractually prohibits its AI Sub-processors from using Customer Personal Data or the Content to train or improve their general-purpose models, and does not itself use the Content to train models. Referent does not use AI model providers established in China.

14.4. Where transparency toward Data Subjects about AI use is required (including under Article 50 of the EU AI Act and Articles 13-14 GDPR), the Customer is responsible for providing it to its Data Subjects; Referent supports the Customer as set out in Section 4.3.

15. Liability

15.1. Referent is responsible for the acts and omissions of its personnel and of other persons it uses to process Customer Personal Data as for its own.

15.2. Referent is liable to the Customer for the acts and omissions of its Sub-processors in respect of Customer Personal Data as if they were its own (Article 28(4) GDPR). Referent may be released from this liability, in whole or in part, only if it shows that: (a) before engaging the Sub-processor it verified its data-protection guarantees, including certifications and transfer mechanisms; (b) it concluded with the Sub-processor a data-processing agreement (which may be the provider’s own DPA) imposing obligations at least equivalent to this DPA; (c) the breach resulted from circumstances it could not have foreseen or prevented with due care, in particular the Sub-processor’s unilateral action contrary to its contract; and (d) it notified the Customer promptly under Section 11 and cooperated to mitigate the breach.

15.3. Except for liability that cannot be limited by law, Referent’s aggregate liability for damage arising solely from the acts or omissions of the Sub-processors listed in Annex 3 is limited to the total fees paid by the Customer under the Agreement in the 12 months before the event giving rise to the claim. This limit does not apply to damage caused intentionally by Referent, nor to claims brought by Data Subjects directly under Article 82 GDPR.

15.4. Otherwise, each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits either party’s liability to a Data Subject under Article 82 GDPR or any liability that cannot be limited by law.

16. Term and termination

16.1. This DPA takes effect on acceptance of the Agreement and continues for as long as Referent processes Customer Personal Data. Termination of the Agreement terminates this DPA, subject to the survival of provisions that by their nature should survive (including Sections 13 and 15).

16.2. The Customer may terminate the Agreement, or the affected part of it, without further notice if Referent: (a) materially breaches this DPA or Data Protection Law and fails to cure the breach within 30 days of the Customer’s written notice; or (b) does not allow the Customer to exercise the audit rights under Section 12.

16.3. On termination, Section 13 (deletion and return) applies.

17. Governing law and jurisdiction

This DPA is governed by the laws of Poland, and the parties submit to the jurisdiction of the competent Polish courts, without prejudice to any mandatory rights of Data Subjects or the governing-law and jurisdiction terms of the SCC and the UK Addendum.

18. Order of precedence

In case of conflict on the processing of Customer Personal Data, the order of precedence is: (1) the SCC / UK Addendum; (2) this DPA; (3) the Agreement.

19. Notices

Notices under this DPA are given in writing (including by email) to: for Referent, privacy@referent.law; for the Customer, the administrator email associated with the Customer’s account or the address stated in the Agreement. Notices of Sub-processor changes are given as set out in Section 7.

20. Miscellaneous

20.1. If any provision of this DPA is held invalid or unenforceable, the rest continues in effect and the parties will replace the affected provision with a valid one of similar effect.

20.2. No failure or delay in exercising a right operates as a waiver of it.

20.3. The Customer may not assign this DPA without Referent’s consent, except to an affiliate or in connection with a transfer of its business; Referent may engage Sub-processors as set out in Section 7.

20.4. This DPA may be accepted electronically and, together with the Agreement and its Annexes, constitutes the entire agreement between the parties on the processing of Customer Personal Data. Amendments must be in writing; Referent may update Annex 3 under Section 7 and the measures in Annex 2 under Section 6.2.

1. Annex 1 - Details of the processing (Article 28(3) GDPR)

1. Annex 2 - Technical and organisational measures (Article 32 GDPR)

Referent maintains measures including, as applicable:

• encryption of data in transit (HTTPS/TLS) and at rest; application-level encryption of particularly sensitive credentials (e.g. email connection passwords);
• role-based access control, session tokens, and multi-factor / trusted-device authentication; IP/CORS restrictions;
• separation of production from development and testing environments; separation of key processing functions;
• least-privilege, logged and time-bound personnel access to Content, with default reliance on redacted traces and aggregated metrics;
• logging, monitoring and auditing of access to and operations on Personal Data;
• regular backups held within the EEA; automatic session clean-up and removal of temporary files;
• internal privacy and security policies, privacy-by-design and by-default, staff confidentiality obligations and security training;
• fraud- and abuse-detection mechanisms; a Personal Data Breach response procedure;
• selection and periodic review of Sub-processors against recognised standards.

1. Annex 3 - Approved Sub-processors

An up-to-date list is available at privacy@referent.law and the Customer is notified of material changes under Section 7.