Data Processing Agreement

This Data Processing Agreement applies to every ITKDocuments customer whose use of the service involves processing personal data. It is part of the ITKDocuments Terms of Use and requires no signature. Customers who need a countersigned copy can request one at support@d-revolution.com.

This Data Processing Agreement ("DPA") is entered into between:

1. Customer: the entity identified in the Order Form or account sign-up ("Customer"); and

2. Digital Revolution, LLC, a Texas limited liability company with its principal office at 13714 Leon Springs Ln, Cypress, TX 77429, which provides ITKDocuments ("Processor" or "ITKDocuments").

The DPA forms part of the ITKDocuments Terms of Use or other written agreement between the parties (the "Agreement"). If the DPA and the Agreement conflict on the processing of Personal Data, this DPA controls.

This DPA takes effect automatically when Customer accepts the Agreement or first uploads Customer Data, whichever is earlier. A countersigned copy, if requested, has the same effect and does not change these terms unless the parties agree otherwise in writing.

Customer uses ITKDocuments to upload, analyze, search and track contracts and related documents. Those documents may contain Personal Data. The parties enter this DPA to set out how Processor handles that data in line with Data Protection Laws.

Capitalized terms not defined here have the meaning given in the Agreement.

• Data Protection Laws: all privacy and data protection laws that apply to the processing of Personal Data under the Agreement, which may include the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA ("CCPA"), the Texas Data Privacy and Security Act, and other US state privacy laws.

• Personal Data: any information relating to an identified or identifiable natural person that Processor processes on Customer's behalf through ITKDocuments.

• Customer Data: all documents, files and content Customer or its users upload to or create in ITKDocuments, and all data extracted from them, including obligations, SLAs, dates, parties, values and risk analyses.

• Controller, Processor, Data Subject, Processing, Supervisory Authority: have the meanings given in the GDPR. "Controller" includes "business" and "Processor" includes "service provider" or "processor" under the CCPA and other US state laws.

• Subprocessor: any third party Processor engages to process Personal Data.

• AI Provider: a Subprocessor that supplies large language models or other AI services used to analyze Customer Data.

• Security Incident: a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

• Standard Contractual Clauses (SCCs): the clauses adopted by European Commission Implementing Decision (EU) 2021/914, and the UK International Data Transfer Addendum where the UK GDPR applies.

2.1 Roles. For Customer Data, Customer is the Controller and Processor is the Processor. Where Customer is itself a processor for a third party, Processor acts as Customer's subprocessor.

2.2 Processor as controller. Processor is a separate controller for account, billing, support and service usage data it collects to run its business. That processing is governed by the ITKDocuments Privacy Policy, not this DPA.

2.3 Details of processing. The subject matter, duration, nature, purpose, data categories and data subjects are set out in Annex 1.

2.4 Customer responsibilities. Customer is responsible for the lawfulness of the Personal Data it uploads, for having a lawful basis and any required notices or consents, and for not uploading special categories of data unless needed for its contract management purposes.

2.5 CCPA. Processor will not sell or share Personal Data, retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than providing ITKDocuments, or combine it with personal data from other sources except as the CCPA permits. Processor certifies that it understands these restrictions.

3.1 Instructions. Processor will process Personal Data only on Customer's documented instructions. The Agreement, this DPA and Customer's use and configuration of ITKDocuments are Customer's complete instructions. Processor will tell Customer if it believes an instruction breaks Data Protection Laws, unless the law prohibits this.

3.2 Legal requirements. If law requires Processor to process Personal Data other than on Customer's instructions, Processor will notify Customer first, unless the law prohibits notice.

3.3 Confidentiality. Processor will ensure that employees, contractors and Subprocessors authorized to process Personal Data are bound by written confidentiality obligations and access it only as needed to provide the service.

3.4 Security. Processor will maintain the technical and organizational measures in Annex 2, taking into account the state of the art, cost, and the nature, scope, context and purposes of the processing. Processor may update those measures if the overall level of protection is not reduced.

3.5 Data location. Processor stores Customer Data in the United States unless otherwise agreed in writing.

4.1 Purpose. ITKDocuments uses AI Providers to extract obligations, metadata, SLAs, dates, parties, values and risks from Customer Data, to answer questions about it (AskITK) and to support authoring, negotiation and playbook features. AI processing occurs only to deliver features Customer or its users request.

4.2 No training. Neither Processor nor its AI Providers will use Customer Data to train, fine-tune or improve general-purpose AI models.

4.3 Retention by AI Providers. Processor will configure AI Providers for zero data retention where that option is available and contractually supported. Where it is not, Processor will require the AI Provider to retain Customer Data only for the minimum period needed for abuse monitoring or as required by law, and to delete it after that period. Annex 3 identifies which applies to each AI Provider.

4.4 Accuracy. AI outputs are generated automatically, link back to their source clauses, and may contain errors. Customer remains responsible for reviewing outputs before relying on them for legal or commercial decisions. ITKDocuments does not make decisions with legal or similarly significant effects on Data Subjects.

4.5 Model updates. Processor may move to new or updated models from the AI Providers listed in Annex 3 as they become available, without notice to Customer. A model change from an existing AI Provider is not a new Subprocessor. Adding a new AI Provider follows section 5.3. Sections 4.2 and 4.3 apply to every model used.

5.1 General authorization. Customer authorizes Processor to engage the Subprocessors listed in Annex 3 and on the ITKDocuments subprocessor page at itkdocuments.com/subprocessors (the "Subprocessor Page") for hosting, storage, communications, payments and AI processing.

5.2 Subprocessor terms. Processor will enter a written agreement with each Subprocessor imposing data protection obligations no less protective than this DPA. Processor remains liable for each Subprocessor's performance.

5.3 Changes. Processor will give Customer at least 30 days' notice before adding or replacing a Subprocessor, by updating the Subprocessor Page and emailing customers who have subscribed to updates there. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected service and receive a pro-rata refund of prepaid fees for the remaining term.

5.4 Emergency replacement. Where a Subprocessor must be replaced urgently for security or continuity reasons, Processor may do so immediately and will notify Customer as soon as practicable, with the same objection right.

6.1 Data subject requests. If Processor receives a request from a Data Subject about Customer Data, it will redirect the Data Subject to Customer and will not respond directly except to confirm the redirect. Taking into account the nature of processing, Processor will reasonably assist Customer to access, correct, export, restrict or delete Personal Data, including through ITKDocuments' self-service features.

6.2 Security Incidents. Processor will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting Customer Data. The notice will describe, as far as then known, the nature of the incident, the data and Data Subjects affected, likely consequences, and the measures taken or proposed. Processor will provide further information as it becomes available and take reasonable steps to contain and remediate the incident.

6.3 No admission. Notice of a Security Incident is not an admission of fault or liability.

6.4 Assessments and authorities. Processor will provide reasonable information Customer needs for data protection impact assessments and prior consultations with Supervisory Authorities, to the extent Customer cannot obtain it from documentation Processor makes available.

6.5 Contact. Notices and requests under this DPA go to support@d-revolution.com, or to the Customer contact listed in the account or Order Form.

7.1 Transfer mechanism. Where Customer Data subject to the GDPR, UK GDPR or Swiss law is transferred to Processor in the United States, the parties agree to the SCCs, which are incorporated by reference:

• Module 2 (controller to processor) applies where Customer is a controller; Module 3 (processor to processor) applies where Customer is a processor.

• Clause 7 (docking clause) applies.

• Clause 9: Option 2 (general authorization), with the notice period in section 5.3.

• Clause 11: the optional redress language does not apply.

• Clauses 17 and 18: the law and courts of Ireland.

• Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA.

• For UK transfers, the UK International Data Transfer Addendum applies, and either party may end it as permitted by its Table 4. For Swiss transfers, references to the GDPR mean the Swiss FADP and the competent authority is the Swiss FDPIC.

7.2 Data Privacy Framework. If Processor self-certifies to the EU-US Data Privacy Framework and its UK and Swiss extensions, transfers will rely on that certification first, with the SCCs as a fallback.

7.3 Onward transfers. Processor will ensure that any Subprocessor transfer outside the United States is covered by an adequate transfer mechanism.

8.1 Audits. Processor will make available information reasonably needed to show compliance with this DPA, including completed security questionnaires and policy summaries. Processor's security program is aligned to SOC 2 principles; this is not a completed SOC 2 attestation. If that information is not enough, or a Supervisory Authority requires it, Customer may audit once per 12 months on at least 30 days' written notice, during business hours, at Customer's cost, through an independent auditor bound by confidentiality.

8.2 Return and deletion. On termination of the Agreement, Customer may export Customer Data for 30 days. Processor will then delete Customer Data from production systems within 30 days and from backups within 90 days as backup cycles expire, unless law requires retention. Processor will confirm deletion in writing on request.

8.3 Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws or the SCCs do not allow those limits.

8.4 Term. This DPA takes effect on the Agreement's effective date and continues for as long as Processor processes Customer Data.

8.5 Governing law. This DPA is governed by the law and courts specified in the Agreement or, if none, the laws of the State of Texas and the state and federal courts in Harris County, Texas, except where the SCCs require otherwise.

8.6 Changes in law. Processor may update this DPA to reflect changes in Data Protection Laws, by posting an updated version on this page with a new "Last updated" date and notifying Customer by email, provided the update does not materially reduce Customer's protections.

Countersigned copies

No signature is needed for this DPA to apply. The signature block below is used only when a customer requests a countersigned copy.

• Encryption: data encrypted in transit using TLS and at rest; OAuth tokens and integration credentials stored encrypted and never shown again after entry.

• Tenant isolation: database row-level controls so each customer's records are reachable only by that customer's account.

• File access: files stored privately and served through time-limited signed links.

• Access control: role-based access and least privilege for internal personnel; sensitive operations require authenticated, server-side authorization.

• Logging and monitoring: administrative activity logging and service monitoring.

• Resilience: backups, vulnerability management and a documented incident response process.

• AI safeguards: no training on Customer Data; zero data retention configured with AI Providers where available.

• Program: security program aligned to SOC 2 principles, with no completed SOC 2 attestation at the date of this DPA.

• Personnel: confidentiality obligations for all staff and contractors with access to Customer Data.

• Terms of Use

• Privacy Policy

• Security

• Subprocessors