Data Processing Addendum

This Data Processing Addendum ("Addendum") forms part of the Terms of Service between OmniMorph Private Limited ("OmniMorph") and each law firm that uses Jurisly (the "Firm"). It applies to personal data that the Firm, or people acting for it, put into Jurisly ("Firm Data"), such as information about the Firm's clients, opposing parties, witnesses and staff. It applies automatically when the Firm accepts the Terms of Service.

1. Roles

1.1 For Firm Data, the Firm is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and, where the GDPR or UK GDPR applies, the controller. OmniMorph is the Firm's Data Processor, or processor.

1.2 The Firm is responsible for having a lawful basis for the Firm Data, including giving any notice and obtaining any consent its clients and others are entitled to.

2. Processing only on the Firm's instructions

2.1 OmniMorph processes Firm Data only to provide Jurisly to the Firm, as described in the Terms of Service and the Privacy Policy, and otherwise on the Firm's documented instructions. The Firm's use and configuration of Jurisly are its instructions.

2.2 OmniMorph will not use Firm Data for any other purpose, sell it, or use it for advertising or to train AI models. If the law requires OmniMorph to process Firm Data in another way, OmniMorph will tell the Firm first, unless the law forbids it.

3. Confidentiality

OmniMorph's personnel who can access Firm Data are bound by confidentiality obligations. Through OmniMorph's administration tools, staff can see account, firm and billing details but not the contents of case files or AI conversations. Staff access Firm Data only where the Firm asks for support, where needed to investigate a security incident or misuse, or where the law requires.

4. Security

OmniMorph maintains reasonable security safeguards for Firm Data, including:

• encryption of data in transit (TLS);
• encryption of stored access tokens and API keys;
• access controls that limit each member to the cases the Firm allows;
• restricted internal access to production systems; and
• logging of access and actions, kept for one year.

5. Sub-processors

5.1 The Firm authorises OmniMorph to use the service providers listed in section 3 of the Privacy Policy as sub-processors. OmniMorph uses each sub-processor under terms that require it to protect the data it receives.

5.2 OmniMorph will give at least 30 days' notice, by email or in the app, before adding a sub-processor that will receive Firm Data. If the Firm objects on reasonable data protection grounds and the parties cannot resolve the objection, the Firm may end its plan and receive a refund of the unused part of the term.

5.3 AI features send content to AI providers, which process it under their own terms, as described in the Privacy Policy. A Firm that adds its own API key chooses the provider, and the Firm's agreement with that provider governs that processing.

6. Requests from individuals

If OmniMorph receives a request from a person about Firm Data, such as a request to access or erase it, OmniMorph will pass it to the Firm and will not answer it except on the Firm's instructions. OmniMorph will help the Firm respond, taking into account the nature of the processing.

7. Personal data breaches

7.1 OmniMorph will notify the Firm without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Firm Data.

7.2 The notice will describe the breach, the data and people likely to be affected, the likely consequences, and the measures taken or proposed. Where information is not yet available, OmniMorph will provide it as it becomes available.

7.3 OmniMorph will cooperate with the Firm so that the Firm can meet its own obligations to inform the Data Protection Board of India, any supervisory authority and affected people.

8. Deletion

8.1 Firm Data is deleted when the Firm deletes it in Jurisly, or when the Firm's workspace is deleted.

8.2 If the Firm's plan lapses, OmniMorph may delete the Firm Data 90 days after the lapse. Before then, the Firm can renew its plan or retrieve its files.

8.3 Deleted data can remain in database backups until those backups expire or are deleted. OmniMorph may keep data it must keep by law, such as payment and tax records.

9. Information and audits

OmniMorph will provide information reasonably needed to show that it complies with this Addendum, on request and not more than once a year unless a breach or a regulator requires otherwise.

10. Transfers outside India and the EEA

10.1 Firm Data is hosted in India. Some sub-processors process data in other countries, as set out in the Privacy Policy.

10.2 Where the GDPR or UK GDPR applies to Firm Data and a transfer requires it, the European Commission's standard contractual clauses (module two, controller to processor, and module three, processor to processor) and the UK addendum to them are incorporated into this Addendum by reference.

11. General

11.1 This Addendum continues for as long as OmniMorph processes Firm Data.

11.2 If this Addendum conflicts with the Terms of Service on the processing of Firm Data, this Addendum prevails.

11.3 Liability under this Addendum is subject to the limits in the Terms of Service, except where the law does not allow it.

12. Contact

Megha Ojha, Director and Grievance Officer, OmniMorph Private Limited Email: ojhamegha5@omnimorph.org WhatsApp: +91 70291 55079