Data Processing Agreement
B2B DPA for law firm clients, processor obligations
# DOCUMENT 05: Data Processing Agreement (DPA)
1. Introduction
This Data Processing Agreement ('DPA') is entered into between Yugality Consultancy Services Private Limited ('Processor' / 'Yugality') and the subscribing law firm, corporate legal team, or legal professional ('Controller') who has agreed to Yugality's Product Terms of Use. This DPA forms part of the overall contract between the parties and governs the processing of personal data by Yugality on behalf of the Controller.
2. Definitions
- 'Personal Data': Any data relating to an identified or identifiable natural person, as defined under the DPDP Act 2023.
- 'Processing': Any operation performed on personal data including collection, storage, analysis, retrieval, and deletion.
- 'Data Principal': The individual whose personal data is being processed.
- 'Sub-Processor': Any third party engaged by Yugality to process personal data on behalf of the Controller.
3. Scope and Nature of Processing
- Subject matter: AI-assisted legal research, document review, drafting, and analysis.
- Duration: For the term of the subscription and data retention periods specified herein.
- Nature of processing: Automated AI analysis, storage, retrieval, and deletion.
- Types of personal data: As described in Product Privacy Policy (Document 04).
- Categories of Data Principals: Clients, counterparties, and other individuals whose data appears in uploaded legal documents.
4. Processor Obligations
Yugality agrees to:
- Process personal data only on documented instructions from the Controller.
- Ensure persons authorised to process data are bound by confidentiality obligations.
- Implement appropriate technical and organisational security measures per Document 06.
- Not engage sub-processors without prior written notification to the Controller.
- Assist the Controller in fulfilling Data Principal rights requests.
- Delete or return all personal data upon termination of the subscription, at the Controller's choice, within 30 days.
- Make available all information necessary to demonstrate compliance and allow audits.
5. Sub-Processors
Yugality currently uses sub-processors for AI model inference and cloud infrastructure. Yugality will notify Controllers of any intended changes to sub-processors at least 30 days in advance. Controllers may object to a new sub-processor in writing within 15 days of notification. All sub-processors are bound by data protection obligations equivalent to this DPA.
6. Data Breach Notification
In the event of a personal data breach, Yugality shall notify the Controller within 72 hours of becoming aware of the breach. The notification will include: nature of the breach, categories and approximate number of Data Principals affected, likely consequences, and measures taken or proposed to address the breach.
7. Security
See Document 06 (Technical and Organisational Security Measures) which is incorporated by reference.
8. Liability Allocation
Each party shall be liable for damage caused by processing that violates applicable data protection law to the extent it is responsible for such damage. If both parties are responsible, liability shall be apportioned according to each party's degree of responsibility.