Data Processing Agreement

1.1 In respect of the personal data in Your Content, the practice is the controller (or, where it acts for its own client, a processor acting for that client), and we are the processor (or sub-processor). We act only for the practice and only to provide the service.

1.2 We act as an independent controller for a narrow set of information about the people who use the service, such as account details, sign-in records and billing contact, which we need to run the service and keep it secure. The Privacy Policy describes that processing. This DPA does not apply to it.

1.3 This DPA forms part of the Terms of Service. If there is a conflict between this DPA and the Terms of Service about the processing of personal data, this DPA prevails. If there is a conflict between this DPA and standard contractual clauses that apply under clause 9, the standard contractual clauses prevail.

1.4 The annexes form part of this DPA: Annex I (description of the processing), Annex II (security measures), Annex III (sub-processors) and Annex IV (transfer terms).

In this DPA, the following words have these meanings. Other words that are defined in the Terms of Service have the same meaning here.

• "Applicable Data Protection Laws" means the laws on the protection of personal data that apply to the processing, including the Data Protection Act, 2024 of Botswana.
• "Personal Data", "Process", "Controller", "Processor", "Data Subject" and "Supervisory Authority" have the meanings the Applicable Data Protection Laws give them.
• "Personal Data Breach" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data in Your Content that we process.
• "Restricted Transfer" means a transfer of Personal Data to a country or recipient that the Applicable Data Protection Laws restrict unless a lawful transfer mechanism is in place.
• "Sub-processor" means a third party that we engage to process Personal Data in Your Content on behalf of the practice.
• "Standard Contractual Clauses" means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914, and, for the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner.
• "Your Content" has the meaning given in the Terms of Service.

3.1 The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are set out in Annex I.

3.2 We process Personal Data for as long as the practice uses the service, and afterwards only as clause 14 allows.

4.1 We process Personal Data only on the practice's documented instructions. The practice's instructions are this DPA, the Terms of Service, the settings and features the practice chooses in the service, and any further written instruction that is consistent with these. A person with authority at the practice, such as its administrator, may give instructions.

4.2 Where the law requires us to process Personal Data in another way, we will tell the practice before we do so, unless the law prohibits us from telling it.

4.3 If we believe an instruction would breach the Applicable Data Protection Laws, we will tell the practice without undue delay and we may suspend carrying out that instruction until it is confirmed or changed.

4.4 We will not sell Personal Data in Your Content, share it for advertising, or use it to build a profile for any purpose other than providing the service to the practice. We will not combine it with personal data from another source except as the practice instructs.

4.5 We do not use Your Content to train shared AI models, and we do not authorise an AI model provider to use it to train its models. Where the practice uses an assistant feature, the text needed to answer the request is sent to the model provider listed in Annex III for that purpose only.

4.6 We may process aggregated, de-identified operational data about how the service performs, such as error counts and response times, to run and secure the service. That data does not identify the practice's clients or contain the content of its matters.

5.1 The practice is responsible for having a lawful basis for the processing it instructs and for giving the notices and obtaining the consents the Applicable Data Protection Laws require, including those that concern its own clients and the other people named in its matters.

5.2 The practice is responsible for the accuracy and lawfulness of the instructions it gives and for deciding what Personal Data to put into the service. It should put in only what it needs for the purpose, and it should take particular care with special categories of personal data and information about criminal matters.

5.3 The practice decides who at the practice may use the service, what role each person has, and which clients, guests and signers it invites. It is responsible for removing access when a person leaves.

5.4 The practice decides, as controller, whether a transfer of its clients' information outside Botswana is permitted, and it must not instruct us to make a transfer that the Applicable Data Protection Laws do not allow.

6.1 We keep Personal Data in Your Content confidential. We allow our personnel to access it only where they need to for a purpose permitted by this DPA, such as providing support the practice has asked for or keeping the service secure and available.

6.2 We ensure that people we authorise to access Personal Data in Your Content are subject to a duty of confidentiality.

6.3 We understand that much of Your Content is subject to legal professional privilege or a duty of confidence owed by the practice to its clients. Our processing does not waive any privilege, and we will treat that content as confidential in every case.

7.1 We implement and maintain technical and organisational measures appropriate to the risk, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing. The measures in place at the date of this DPA are described in Annex II and in more detail in the Security measures document.

7.2 We may change the measures from time to time, provided the change does not materially reduce the protection of Personal Data in Your Content.

7.3 We help the practice meet its own security obligations by giving it the information it reasonably needs to assess the measures, and by providing the features that let it control access, such as roles, approvals and the audit trail.

8.1 The practice gives us general authorisation to engage the Sub-processors listed in Annex III for the purposes and locations stated there.

8.2 We have a written contract with each Sub-processor that imposes data protection duties no less protective than those in this DPA, including confidentiality, security and the transfer safeguards in clause 9. We remain responsible to the practice for each Sub-processor's performance of those duties.

8.3 We will give the practice at least 30 days' notice before we add or replace a Sub-processor that handles Personal Data in Your Content. We give the notice by updating the Sub-processors page and, where the practice has asked to be told, by email.

8.4 The practice may object to the change on reasonable data protection grounds by writing to us within that period. We will work with the practice in good faith to resolve the objection, for example by offering a different way to use the service or by not using the new Sub-processor for the practice's content. If we cannot resolve it, the practice may end the part of the service affected, and we will refund the prepaid fees for it for the period after it ends.

8.5 We may replace a Sub-processor without notice where an urgent change is needed to keep the service secure or available. In that case we will tell the practice as soon as we reasonably can, and the practice's right to object continues to apply.

9.1 Our primary hosting is in Ireland. We process Personal Data in Your Content in other countries only where the Sub-processors listed in Annex III do so, and only where a lawful transfer mechanism applies.

9.2 Transfers of personal data out of Botswana are restricted by the Data Protection Act, 2024 unless the destination provides adequate protection and any further conditions of the Act are met, which may include keeping a copy of the information in Botswana. The practice, as controller, decides whether a transfer of its clients' information is permitted. We make transfers only on its instructions and as the Act allows.

9.3 Where the GDPR or the UK GDPR applies to a Restricted Transfer under this DPA, the Standard Contractual Clauses are incorporated into this DPA on the terms of Annex IV, and the parties are treated as having signed them.

9.4 Before a Restricted Transfer, we assess whether the laws and practices of the destination country allow the importer to comply with the safeguards that apply, and we will give the practice a summary of that assessment on request.

9.5 If a public authority asks us for Personal Data in Your Content, we will, unless the law prevents us, tell the practice promptly, redirect the authority to the practice where we can, and disclose only what we are legally required to disclose.

10.1 We will tell the practice without undue delay if we receive a request from a Data Subject to exercise a right in respect of Personal Data in Your Content, such as access, correction, deletion or objection. We will not respond to the request except to tell the person that we have passed it to the practice, unless the practice instructs us otherwise or the law requires.

10.2 Taking into account the nature of the processing, we help the practice to respond to such requests by providing the features that let it search for, export, correct and delete the information in its own practice, and by giving reasonable further help on request.

10.3 If a Supervisory Authority contacts us about the processing we carry out for the practice, we will tell the practice unless the law prevents us, and we will cooperate with it.

11.1 We will give the practice the help it reasonably needs, taking into account the nature of the processing and the information we hold, to meet its obligations on security, notification of breaches, data protection impact assessments and prior consultation with a Supervisory Authority.

11.2 Where the help goes beyond what we provide in the ordinary course, we may charge a reasonable fee based on the time and cost involved, and we will tell the practice before we incur it.

12.1 We will notify the practice without undue delay after we become aware of a Personal Data Breach, and we will send the notice to the practice's administrator at the email address on the account.

12.2 The notice will describe, as far as we know it at the time: the nature of the breach, including the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures we have taken or propose to take to address it and to reduce its effects; and a contact from whom more information can be had. Where we cannot give all the information at once, we will give it in stages as we learn it.

12.3 We will take reasonable steps to contain and investigate the breach, to prevent it from recurring, and to help the practice meet its own duty to notify a Supervisory Authority and Data Subjects.

12.4 Our notice of a breach, or our steps in response, is not an admission of fault or liability.

13.1 We will make available to the practice the information it reasonably needs to show that we comply with this DPA, including the documents referred to in Annex II and the Sub-processors page.

13.2 Where that information is not enough to satisfy the practice or a Supervisory Authority, the practice may carry out an audit of our compliance with this DPA, or appoint an independent auditor bound by confidentiality to do so, on these terms: the practice gives at least 30 days' written notice and a scope and plan we agree, acting reasonably; the audit takes place during business hours, does not unreasonably disrupt our business and does not give access to the information of other customers or to our systems and information that are not relevant to the practice; the practice does not audit more than once in any 12 months, unless a Supervisory Authority requires it or there has been a Personal Data Breach affecting the practice's data; and the practice bears the cost of the audit, and of our reasonable time.

13.3 The information the practice learns in an audit is our confidential information and may be used only to assess our compliance with this DPA.

14.1 The practice can export Your Content at any time while its account is active, and for 30 days after the account ends.

14.2 After that period we delete Personal Data in Your Content from our live systems within the time the Data retention schedule sets out. Copies held in backups of our database provider are overwritten in the ordinary cycle of that provider and are not used for any other purpose in the meantime.

14.3 We may keep Personal Data after the end of the service to the extent that the law requires us to, and only for as long as it does. The audit trail of actions in the practice's account is kept as the Data retention schedule says, because its value depends on its not being altered.

14.4 On written request after deletion, we will confirm to the practice in writing that we have deleted the Personal Data in Your Content.

The limits and exclusions of liability in the Terms of Service apply to this DPA. Nothing in this DPA limits any liability that cannot be limited by law, or a Data Subject's rights under the Standard Contractual Clauses.

16.1 This DPA starts when the practice first uses the service and continues for as long as we process Personal Data in Your Content.

16.2 We may update this DPA where the change is needed to comply with the Applicable Data Protection Laws, or to reflect a change in the service that does not reduce the protection of Personal Data. We will give notice of a material change, and the practice may end the service under the Terms of Service if it does not accept it.

16.3 If a law changes so that a provision of this DPA is no longer sufficient, the parties will work together in good faith to agree the changes needed.

17.1 This DPA is governed by the laws of the Republic of Botswana, and disputes are dealt with as the Terms of Service provide, except that the Standard Contractual Clauses are governed by the law stated in Annex IV.

17.2 Questions about this DPA, requests under it and notices of objection to a Sub-processor go to privacy@olympuspay.co. Notices of a Personal Data Breach by the practice to us, and any security concern, go to security@olympuspay.co.

A. Parties. The controller (or processor) is the practice that uses the service. The processor (or sub-processor) is Olympus Group Holdings, Inc., 1111B S Governors Ave, STE 25834, Dover, DE 19904, USA.

B. Subject matter. The provision of the THEMIS practice management and legal intelligence service to the practice.

C. Duration. For as long as the practice uses the service, and then as clause 14 provides.

D. Nature and purpose of the processing. Hosting, storing, retrieving, searching and displaying the practice's matters, documents and records; creating and editing documents; sending documents for signature and delivering the emails the practice triggers; running the client portal and guest access; producing assistant responses when a person uses an AI feature; recording billing and trust accounting; performing identity and business verification where the practice turns it on; keeping the audit trail; providing support the practice asks for; and keeping the service secure.

E. Categories of Data Subjects:

• the practice's clients, and prospective clients, whether individuals or the representatives of companies;
• counterparties, their lawyers and other parties to the practice's matters;
• the practice's own staff, and other people the practice invites to use the service, including guests and signers;
• witnesses, beneficiaries, directors, shareholders, trustees and other individuals named in documents the practice puts into the service;
• people whose identity the practice verifies through the service.

F. Categories of Personal Data. The practice decides what to put into the service. In the ordinary use of the service it includes:

• identity and contact details: names, addresses, email addresses, telephone numbers, identity and registration numbers, dates of birth, nationality and marital status;
• professional and employment details;
• financial information: bank details, payment instructions, trust account entries, invoices and amounts owed;
• identity verification data, where the practice turns verification on: images of identity documents, a face image and liveness check, and the results of the check;
• the content of matters and documents, which may contain any personal data that the matter concerns;
• records of use: sign-in times, the actions taken in the account, and the audit trail.

G. Special categories and criminal matters. The service is not designed to collect special categories of personal data, such as health, religion or biometric data for identification, except identity verification data where the practice turns it on. The practice may nonetheless put such data into a matter where the matter requires it, and it is then responsible for having a lawful basis and for the care that the data needs. The same applies to information about criminal convictions and offences.

H. Frequency. Continuous, for as long as the service is used.

I. Retention. As the Data retention schedule sets out and as clause 14 provides.

J. Sub-processors. The Sub-processors in Annex III process the data for the purposes and in the locations stated there.

The measures we maintain are described in full in the Security measures document, which forms part of this Annex and which we keep current. In summary, at the date of this DPA:

• each practice's data is separated from every other practice's at the database level;
• access inside a practice is limited by role, and sensitive acts such as releasing money from trust need a second person;
• information is encrypted in transit, and is stored by providers that encrypt data at rest;
• sign-in uses hashed passwords with a minimum length, throttling of repeated failures and expiring sessions;
• actions are recorded in a tamper-evident audit trail that cannot be edited;
• access for programs uses keys that are stored only as hashes, carry named permissions and can expire, be limited by address and be revoked;
• assistant features can only propose, and certain acts are reserved to people;
• we do not hold ISO 27001 or SOC 2 certification, and the Security measures document says what we do and do not claim.

The Sub-processors we use, their purpose, the categories of data they process, their location and their legal entity are listed on the Sub-processors page, which forms part of this Annex. Our primary hosting is in Ireland. We give 30 days' notice of changes as clause 8 provides.

Where clause 9.3 applies, the parties agree these elections to the Standard Contractual Clauses:

• Module. Module Two (controller to processor) applies where the practice is a controller. Module Three (processor to processor) applies where the practice acts for its own client as processor.
• Clause 7 (docking). The optional docking clause does not apply.
• Clause 9(a) (sub-processors). Option 2, general written authorisation, applies, with the notice period in clause 8.3 of this DPA.
• Clause 11(a) (redress). The optional language does not apply.
• Clause 13 and Annex I.C. The competent Supervisory Authority is the one that has jurisdiction over the exporter or, for exporters outside the EEA, the authority of the Member State stated in Annex I.C.
• Clause 17 (governing law). Option 1 applies, and the law is that of Ireland.
• Clause 18 (forum). The courts of Ireland.
• Annexes. Annex I of the Standard Contractual Clauses is completed by Annex I of this DPA. Annex II is completed by Annex II of this DPA. Annex III is completed by Annex III of this DPA.
• United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum applies, with the information in its tables taken from this DPA.

Botswana. Where the Data Protection Act, 2024 of Botswana governs a transfer, the parties will apply the safeguards and conditions that the Act and any directions under it require, in addition to this DPA.