DATA PROCESSING ADDENDUM

Part 1: Processing Details

Complete the following information to establish the data processing terms between your organization and LawyerDesk Advocacy Pvt Ltd.

Part 2: Data Processing Terms

(Version dated August 18, 2025)

This Data Processing Addendum, comprising Part 1 (Processing Details) and Part 2 (Data Processing Terms) (together, the "DPA") supplements and, from the date on which Customer signs or otherwise agrees to this DPA, forms part of the agreement entered into between the Customer and LawyerDesk Advocacy Pvt Ltd ("Counsel Crest") on the terms set out at https://counselcrest.com/terms (the "Agreement") in relation to the transfer and processing of Covered Data in connection with the performance of the Services.

1. DEFINITIONS

1.1 Capitalized terms used but not defined within this DPA will have the meaning set forth in the Agreement. The following capitalized terms used in this DPA will be defined as follows:

"Applicable Data Protection Laws" means all applicable laws, rules, regulations, and governmental requirements relating to the privacy, confidentiality, or security of Personal Data, as they may be amended or otherwise updated from time to time, including (without limitation): the GDPR, Swiss Data Protection Laws, the US Data Protection Laws, and Indian Data Protection Laws.

"CCPA" means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended, including its implementing regulations and the California Privacy Rights Act of 2020.

"Controller Purposes" means: (a) aggregating and anonymizing information for the purpose of undertaking internal research and development to monitor, test, improve and alter the functionality of the Services; (b) monitoring the Customer's and Authorized Users' use of the Services for billing purposes, ensuring the security of the Services and identify fraudulent or malicious use of the Services; (c) administering the Customer's relationship with CounselCrest under the Agreement; and (d) providing AI-powered legal research and analysis services.

"Covered Data" means: (a) Personal Data that is provided by or on behalf of Customer to CounselCrest in connection with Customer's use of the Services, as further described in Part 1 (Processing Details) of this DPA; (b) contact information and access credentials relating to, and support requests submitted by, Authorized Users; (c) legal case data, client information, and related professional data processed through the Services; and (d) any other Personal Data that is otherwise collected, generated or Processed by CounselCrest in connection with the provision of the Services.

"Data Subject" means a natural person whose Personal Data is Processed.

"GDPR" means Regulation (EU) 2016/679 (the "EU GDPR") or, where applicable, the "UK GDPR", as defined in section 3 of the Data Protection Act 2018.

"Indian Data Protection Laws" means the Digital Personal Data Protection Act, 2023 and any related regulations, rules, or guidelines issued thereunder, as amended from time to time.

"Personal Data" means any data or information that: (a) is linked or reasonably linkable to an identified or identifiable natural person; or (b) is otherwise "personal data," "personal information," "personally identifiable information," or similarly defined data or information under Applicable Data Protection Laws.

"Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, including AI analysis, legal research, document processing, and case management operations. "Process", "Processes" and "Processed" will be interpreted accordingly.

"Security Incident" means an actual or suspected breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to (including unauthorized internal access to), Covered Data.

"Standard Contractual Clauses" or "SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.

"Sub-processor" means, with respect to any Processing performed by CounselCrest as a processor service provider, an entity appointed by CounselCrest to Process Covered Data on its behalf.

"US Data Protection Laws" means all applicable federal and state laws rules, regulations, and governmental requirements relating to data protection, the Processing of Personal Data, privacy and/or data protection in force from time to time in the United States, including (without limitation): the CCPA, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Utah Consumer Privacy Act, Connecticut Senate Bill 6, and other state privacy laws.

1.2 The terms "controller", "processor", "business" and "service provider" have the meanings given to them in the Applicable Data Protection Laws.

2. INTERACTION WITH THE AGREEMENT

2.1 This DPA is incorporated into and forms an integral part of the Agreement. This DPA supplements and (in case of contradictions) supersedes the Agreement with respect to any Processing of Covered Data.

3. ROLE OF THE PARTIES

The Parties acknowledge and agree that:

(a) save as set out in clause 3(b) or clause 3(c), CounselCrest acts as a processor or service provider in the performance of its obligations under the Agreement and this DPA and Customer acts as a controller or business;

(b) to the extent that Customer acts as a processor in respect of Covered Data on behalf of Customer's Controller, CounselCrest acts as a subprocessor in the performance of its obligations under the Agreement and this DPA;

(c) for the purposes of the GDPR, CounselCrest acts as a controller with respect to the Processing of Usage Data for the Controller Purposes, including AI model training and legal research enhancement;

(d) CounselCrest acts as a controller for anonymous usage analytics and service improvement purposes.

4. DETAILS OF DATA PROCESSING

4.1 The details of the Processing of Personal Data under the Agreement and this DPA (including subject matter, nature and purpose of the Processing, categories of Personal Data and Data Subjects) are described in the Agreement and in Part 1 (Processing Details) to this DPA.

4.2 CounselCrest shall comply with its obligations under Applicable Data Protection Laws. Save with respect to any Processing of Usage Data for the Controller Purposes, CounselCrest shall only Process Covered Data on behalf of and under the instructions of Customer and in accordance with Applicable Data Protection Laws. The Agreement and this DPA shall constitute Customer's instructions for the Processing of Covered Data.

4.3 CounselCrest will provide Customer with information to enable Customer to conduct and document any data protection assessments required under Applicable Data Protection Laws.

5. COMPLIANCE

5.1 Customer shall comply with its obligations under Applicable Data Protection Laws, including providing appropriate notices to Data Subjects and obtaining necessary consents for Processing, particularly for legal case data and client information.

6. CONFIDENTIALITY AND DISCLOSURE

6.1 CounselCrest shall limit access to Covered Data to personnel who have a business need to have access to such Covered Data and ensure that such personnel are subject to appropriate confidentiality obligations, including attorney-client privilege where applicable.

7. SUB-PROCESSORS

7.1 CounselCrest may Process Covered Data anywhere that CounselCrest or its Sub-processors maintain facilities, subject to the remainder of this clause 7.

7.2 Customer grants CounselCrest general authorization to engage any of the Sub-processors listed in Schedule 3, as amended in accordance with clause 7.3 (the "Authorized Sub-processors"), to Process Covered Data.

7.3 CounselCrest shall provide Customer with at least thirty (30) days' notice of any proposed changes to the Authorized Sub-processors.

8. DATA SUBJECT RIGHTS REQUESTS

8.1 CounselCrest will promptly notify Customer of any request received from a Data Subject to assert their rights in relation to Covered Data under Applicable Data Protection Laws.

8.2 CounselCrest will provide Customer with reasonable assistance as necessary for Customer to fulfill its obligations under Applicable Data Protection Laws to respond to Data Subject Requests.

9. SECURITY

9.1 CounselCrest will implement and maintain appropriate technical and organizational data protection and security measures designed to ensure security of Covered Data, including protection against unauthorized or unlawful Processing and against accidental loss, destruction, or damage.

9.2 CounselCrest will implement and maintain as a minimum standard the measures set out in Schedule 1.

10. SECURITY INCIDENTS

10.1 CounselCrest shall notify Customer in writing without undue delay, and in any event within seventy-two (72) hours, after becoming aware of any Security Incident.

10.2 CounselCrest shall take reasonable steps to contain, investigate, and mitigate any Security Incident.

11. TERM, DELETION AND RETURN

11.1 This DPA shall commence on the Effective Date and will remain in effect until CounselCrest's deletion of all Covered Data as described in this DPA.

11.2 Upon termination of the Agreement, CounselCrest shall, at Customer's option, delete or return all Covered Data, except where retention is required by applicable law or professional obligations.

12. STANDARD CONTRACTUAL CLAUSES

12.1 The Standard Contractual Clauses shall apply to the transfer of any Covered Data from Customer to CounselCrest where required by Applicable Data Protection Laws.

13. GENERAL

13.1 The Parties agree to negotiate in good faith any amendments to this DPA as may be required in connection with changes in Applicable Data Protection Laws.

13.2 All notices to be provided by Counsel Crest to Customer under this DPA shall be sent to {COMPANY_CONFIG.contact.privacy.email} unless the Parties agree otherwise in writing.