Data Processing Addendum

1. Scope and roles

1.1 Types of data

The Services handle four types of data, each treated differently under this DPA:

Documents

files and case materials that Customer uploads, the content extracted from them, and references to them within the Services. Documents are never used to train any AI model.

Research Conversations

the research queries and general questions that Customer's Authorised Users ask the Services, and the responses generated. Research Conversations may be used, once anonymised, to train models that improve the customer experience and spam filtering, as set out in Section 4.

Work Product

drafts, notes, summaries and other content that Authorised Users create or generate in the Services, other than Research Conversations. Work Product is never used to train any AI model.

Court Data

publicly available court information, such as case status, cause lists, orders and judgments, that Bharat.Law collects from court and other public sources. Court Data is not specific to any customer.

Documents, Research Conversations and Work Product together are "Customer Data". Court Data is not Customer Data, but the list of matters Customer chooses to track is Customer's Confidential Information.

1.2 Bharat.Law as processor

For Customer Data, Customer is the controller and Bharat.Law is the processor (or the equivalent roles under applicable Data Protection Law). Bharat.Law processes Customer Data on Customer's behalf and on Customer's instructions, except as described in Section 1.3.

1.3 Bharat.Law as independent controller

Bharat.Law is an independent controller of Account Information, Usage Data and Court Data, and of Research Conversations to the extent it uses anonymised Research Conversations to train models under Section 4.2. This processing is described in Section 16 and the Privacy Policy.

1.4 Details of processing

Subject matter and purpose

providing, securing and supporting the Services for Customer, including storing Documents, running document processing, research and drafting tasks that Customer requests, and returning Outputs to Customer.

Categories of data

any personal data that Customer and its Authorised Users choose to upload or enter, which may include names, contact details, identification numbers, financial, property and litigation details, and any sensitive personal data contained in Customer Data.

Data subjects

Customer's Authorised Users, and the clients, counterparties, witnesses, employees and other individuals referred to in Customer Data.

Duration

the term of the Agreement and any post-termination period set out in Section 12.

2. How your data is handled

This section summarises, in plain language, how Bharat.Law handles your data. The sections that follow set out the binding commitments in full.

Your documents are never used to train AI

Documents you upload, and the content extracted from them, are never used to train, fine-tune or improve any AI model, whether ours or a third party's.

Your drafts and notes are never used to train AI

Drafts, notes, summaries and other work you create in the Services are never used for model training.

Anonymised research conversations help us improve

Your research queries and general questions, and the responses to them, may be used to train models that improve the customer experience and spam filtering. They are anonymised first, so they cannot identify you, your organisation or anyone else. Third-party AI providers never use them to train their own models.

AI providers do not keep your data for training

Our agentic processing uses several AI models. Each provider is engaged on enterprise terms under which your content is processed only to complete your task and is not retained to train the provider's models.

Only you decide who sees your documents

Your documents, and the information in them, are available only to you and to the people you choose to give access to within the application.

Storage is locked down by design

Documents are stored encrypted on Amazon Web Services (S3). Access is governed by narrowly scoped system permissions that allow only specific services to perform specific actions on specific resources, rather than by individual user accounts.

Staff access is restricted

Bharat.Law personnel do not browse or review customer documents. Only a small number of authorised personnel, bound by confidentiality obligations, have access to the processing infrastructure, and only to provide support, maintain the Services or respond to a security incident.

Deleted documents are gone for good

When you delete a document, it is held for up to 12 hours and then automatically and permanently deleted, together with references to it. Once deleted, it cannot be recovered, by you or by us. Drafts or research you created from the document stay in your account until you delete them, but their citations to the deleted document stop working.

Court data is shared reference data

Court information such as case status, cause lists and orders is public, is not specific to you, and is retained so that it can serve all users.

3. Processing on Customer's instructions

Bharat.Law will process Customer Data only on Customer's documented instructions, and for the purposes described in Sections 4 and 16. The Agreement, this DPA, and Customer's use and configuration of the Services are Customer's complete instructions. Bharat.Law will not sell Customer Data, and will not disclose Customer Data to any other customer.

Bharat.Law will tell Customer promptly if, in its opinion, an instruction infringes Data Protection Law, or if it can no longer meet its obligations under this DPA. If law requires Bharat.Law to process Customer Data other than on Customer's instructions, Bharat.Law will notify Customer before doing so, unless the law prohibits that notice.

4. Model training and improvement

4.1 Documents and Work Product

Bharat.Law will not use Documents (including content extracted from them) or Work Product to train, fine-tune or otherwise improve any artificial intelligence or machine-learning model, whether operated by Bharat.Law or by a third party.

4.2 Research Conversations

Bharat.Law may use Research Conversations to train and evaluate models that improve the customer experience and spam filtering. Before Research Conversations are used for training, Bharat.Law anonymises them by removing details that identify Customer, its Authorised Users or any other individual. Bharat.Law will not use Research Conversations in a way that discloses them, or identifies Customer, to any other customer.

4.3 Third-party AI providers

Bharat.Law engages AI model providers only on terms that prohibit them from using any Customer Data, including Documents and Research Conversations, to train or improve their own models or products.

4.4 Operational signals

Bharat.Law may use operational signals, such as processing errors, latency, task success rates and feedback that Customer chooses to submit, to improve the reliability and quality of the Services in general. Improvements made from these signals will not depend on, reproduce or disclose the content of Documents.

5. Confidentiality and access to Customer Data

Customer Data is Customer's Confidential Information under the Agreement. Within the Services, Customer Data and information derived from it are available only to Customer's Authorised Users and to anyone Customer chooses to share them with.

Bharat.Law will limit access to Customer Data to personnel who need it to provide support, maintain and secure the Services, anonymise Research Conversations under Section 4.2, or comply with law, and who are bound by written confidentiality obligations. Personnel do not access Documents for any other purpose. Access to production systems is granted on a least-privilege basis, reviewed periodically and revoked promptly when no longer needed.

6. Security

Bharat.Law will maintain technical and organisational measures appropriate to the risk of processing, designed to protect Customer Data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These include:

• encryption of Customer Data in transit and at rest;
• storage access controlled through narrowly scoped identity and access management (IAM) policies, which grant specific services permission to perform specific actions on specific resources;
• logical separation of each customer's data within the Services, with access governed by the permissions Customer configures;
• restricted, logged administrative access to production infrastructure;
• monitoring, vulnerability management and an incident response process; and
• confidentiality and security obligations for personnel and Subprocessors.

Bharat.Law may update these measures from time to time, provided the overall level of protection is not reduced.

7. Subprocessors

7.1 Authorisation

Customer gives general authorisation for Bharat.Law to engage the Subprocessors listed on the Subprocessor List at bharat.law/legal/subprocessors.

7.2 New Subprocessors

Bharat.Law will update the Subprocessor List and notify subscribed customers at least 3 days before a new Subprocessor begins processing Customer Data. Customer may object on reasonable data protection grounds by writing to privacy@bharat.law within 15 days of the notice. The parties will discuss the objection in good faith. If they cannot resolve it, Bharat.Law may offer an alternative, such as not using that Subprocessor for Customer's data; if no alternative is reasonably available, Customer may terminate the affected Services and receive a pro-rated refund of prepaid fees for the unused term.

7.3 Flow-down and responsibility

Bharat.Law will engage each Subprocessor under a written agreement that imposes data protection, confidentiality, security and no-training obligations no less protective than those in this DPA. Bharat.Law remains responsible to Customer for the performance of its Subprocessors.

7.4 Analytics and advertising vendors

Subprocessors do not receive analytics or product usage data. Bharat.Law's analytics and advertising vendors, listed on the Subprocessor List, receive only Usage Data and website interaction data, as described in the Privacy Policy and Cookie Policy. They do not receive Customer Data.

8. Personal data breach

Bharat.Law will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe, as far as is then known, the nature of the breach, the data and individuals affected, its likely consequences, and the steps taken or proposed to contain and remedy it. Bharat.Law will provide further information as it becomes available and reasonable assistance to help Customer meet any obligation to notify a supervisory authority or affected individuals.

9. Assistance to Customer

Taking into account the nature of the processing, Bharat.Law will provide reasonable assistance to Customer to:

• respond to requests from individuals exercising their rights under Data Protection Law, including access, correction, erasure and grievance redressal. If Bharat.Law receives such a request directly, it will refer the individual to Customer and will not respond without Customer's authorisation, unless required by law;
• carry out data protection impact assessments and consult supervisory authorities, where required; and
• demonstrate compliance with this DPA.

10. Requests from authorities

If a court, regulator or law-enforcement authority asks Bharat.Law to disclose Customer Data, Bharat.Law will try to redirect the request to Customer. If disclosure is legally required, Bharat.Law will give Customer prompt notice, unless prohibited by law, so that Customer can seek a protective order or other remedy, and will disclose only the minimum data necessary to comply.

11. Location of processing and international transfers

Customer Data is processed in India and the United States, as shown for each Subprocessor on the Subprocessor List. Where Data Protection Law restricts a transfer of personal data, Bharat.Law will put in place a transfer mechanism recognised by that law, and will not transfer Customer Data to any country to which such transfers are restricted under applicable law.

12. Retention and deletion

12.1 Documents

When Customer or an Authorised User deletes a Document, it is retained for up to 12 hours and then automatically and permanently deleted, together with the content extracted from it and references to it within the Services. During this period the Document is queued for permanent deletion and cannot be restored.

Work Product and Research Conversations created from a deleted Document, such as drafts or research, are not deleted with it and remain available until Customer deletes them. Citations in that content to the deleted Document will no longer function.

12.2 Research Conversations and Work Product

Research Conversations and Work Product are retained while Customer's account is active, so that Authorised Users can return to their research and drafts, until Customer deletes them or in accordance with Section 12.4. Anonymised data used for training under Section 4.2 no longer identifies Customer or any individual, is not Customer Data, and is not subject to deletion under this Section.

12.3 Court Data

Court Data is not specific to any customer and is retained independently of Customer's account. Deleting an account, or a tracked matter, removes the link between Customer and that matter but does not delete the underlying public court information.

12.4 On termination

On expiry or termination of the Agreement, Customer may export Customer Data for at least 30 days using the Services' standard export tools. Bharat.Law will then delete the remaining Customer Data within 30 days, unless Customer asks for earlier deletion or law requires Bharat.Law to retain it. On request, Bharat.Law will confirm deletion in writing.

12.5 Retention required by law

Where law requires Bharat.Law to retain any Customer Data, this DPA continues to apply to that data, and Bharat.Law will process it only for the purpose for which it is retained.

13. Information and audits

Bharat.Law will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including written responses to reasonable security and privacy questionnaires once in any 12-month period. Where that information is not sufficient, or where a supervisory authority requires it, Customer may audit Bharat.Law's compliance with this DPA on at least 30 days' written notice, during business hours, at Customer's cost, and subject to reasonable confidentiality and security conditions. Audit results are Bharat.Law's Confidential Information.

14. Customer's obligations

• Customer is responsible for having a lawful basis, and any notices and consents required, for the personal data it submits to the Services, including for the use of anonymised Research Conversations described in Section 4.2.
• Customer is responsible for configuring access and sharing within the Services appropriately, and for the actions of its Authorised Users.
• Customer should submit Documents only by uploading them to the Services, and should not send documents containing personal data by email or in support tickets unless Bharat.Law asks for them for a specific support request.

15. Service provider obligations

Where applicable Data Protection Law treats Bharat.Law as a service provider, contractor or equivalent in relation to Customer Data, Bharat.Law will not sell Customer Data, will not retain, use or disclose it except for the purposes set out in this DPA and as that law permits, and will not attempt to re-identify data that has been de-identified.

16. Bharat.Law as an independent controller

Bharat.Law processes Account Information, Usage Data and Court Data as an independent controller to manage accounts and billing, provide support, secure the Services, prevent abuse, analyse how the Services are used, market the Services, and operate court-tracking features. It uses Research Conversations as an independent controller for the purposes in Section 4.2. Usage Data does not include the content of Customer Data. This processing is described in the Privacy Policy, and Bharat.Law applies technical and organisational measures appropriate to the risk.

17. Term and changes

This DPA remains in effect for as long as Bharat.Law processes Customer Data. If a change in Data Protection Law requires changes to this DPA, the parties will negotiate in good faith to amend it. Bharat.Law may update this DPA to reflect changes in law or the Services; material changes that reduce Customer's protections will not apply during a current Subscription Term without Customer's agreement, unless required by law.

18. Definitions

"Account Information"

information about Customer and its Authorised Users needed to create and manage accounts, such as names, email addresses, roles and billing details.

"Anonymised"

processed so that the data no longer identifies, and cannot reasonably be linked to, Customer, its Authorised Users or any other individual.

"Court Data"

publicly available court information, including case status, cause lists, orders and judgments, collected by Bharat.Law from court and other public sources.

"Customer Data"

Documents, Research Conversations and Work Product, including any personal data they contain.

"Data Protection Law"

all data protection and privacy laws, regulations and rules that apply to the processing of Customer Data under the Agreement.

"Documents"

files, case materials and other documents uploaded to the Services by or on behalf of Customer, the text and other content extracted from them by the Services, and references to them within the Services.

"Personal data breach"

a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data.

"Research Conversations"

research queries and general questions that Authorised Users ask the Services, and the responses generated.

"Subprocessor"

a third party engaged by Bharat.Law that processes Customer Data on Bharat.Law's behalf in providing the Services.

"Usage Data"

information about how the Services are used and perform, such as feature usage, page views, error and latency logs, device and browser information, and feedback that Customer chooses to submit. Usage Data does not include the content of Customer Data.

"Work Product"

drafts, notes, summaries and other content that Authorised Users create or generate in the Services, other than Research Conversations.