Data Processing Agreement

1. Definitions and scope

1.1 In this DPA:

• Data Protection Law means the GDPR, the UK GDPR, Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and any other data protection law that applies to the processing.
• Workspace Content means the documents, files, message content and step titles and descriptions a Member uploads to or sends through the Workspace of a Mandate, and the personal data in them.
• Personal Data, controller, processor, data subject, processing and personal data breach have the meanings given in Data Protection Law.
• Sub-processor means a third party engaged by Juris Cross to process Workspace Content.

1.2 This DPA applies only to Workspace Content that the Member uploads or sends. It does not apply to data for which Juris Cross is controller, including account and profile data, billing data, security logs, ratings and the Mandate Record, which are governed by the Privacy Policy.

1.3 The details of the processing are set out in Annex 1.

2. Roles and instructions

2.1 For Workspace Content, the uploading Member is the controller and Juris Cross is its processor. The receiving Member is a separate controller for the copy it receives and is not a party to the processing described here.

2.2 Juris Cross processes Workspace Content only on the Member's documented instructions. The Terms, this DPA and the Member's use of the Workspace (uploading, sending, downloading, deleting and choosing the retention period) are the Member's complete instructions. Juris Cross may process Workspace Content otherwise only where the law requires it, and will inform the Member before doing so unless the law prohibits it.

2.3 Juris Cross will tell the Member if it believes an instruction infringes Data Protection Law.

2.4 Juris Cross does not use Workspace Content for its own purposes, including product analytics, advertising or training of any model.

3. Our obligations as processor

3.1 Confidentiality. Juris Cross ensures that everyone authorised to access Workspace Content is bound by confidentiality. Access is limited as described in clause 12.3 of the Terms: only where the law or a binding order requires it, or to investigate a serious security incident or serious breach of the Terms; each access needs a recorded reason, is logged and triggers an alert to a co-founder.

3.2 Security. Juris Cross implements the technical and organisational measures in Annex 3 and keeps them appropriate to the risk, taking into account that Workspace Content may include privileged material and special categories of data. Juris Cross may update the measures provided the overall level of protection is not reduced.

3.3 Data subject requests. If Juris Cross receives a request from a data subject about Workspace Content, it will pass it to the Member without undue delay and will not answer it itself unless the Member authorises it. Juris Cross will help the Member answer such requests, mainly through the export and deletion features of the platform.

3.4 Other assistance. Taking into account the information available to it, Juris Cross will reasonably help the Member meet its obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority.

3.5 Records. Juris Cross keeps a record of its processing activities as a processor where Data Protection Law requires it.

4. Sub-processors

4.1 The Member gives Juris Cross general authorisation to engage Sub-processors. The current Sub-processors are listed in Annex 2.

4.2 Juris Cross will notify the Member by e-mail at least 30 days before adding or replacing a Sub-processor. The Member may object on reasonable data protection grounds by writing to support@juriscross.com within that period. If the parties cannot resolve the objection, the Member may terminate its subscription with effect from the change and receive a refund of any unused prepaid fees.

4.3 Juris Cross imposes on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and remains liable to the Member for each Sub-processor's performance.

5. International transfers

5.1 Juris Cross is established in Türkiye. Its Sub-processors process Workspace Content in the United States (Annex 2).

5.2 Members in the EU or EEA. Because Türkiye has no EU adequacy decision, the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) (the SCCs), are incorporated into this DPA for transfers of Workspace Content from the Member to Juris Cross. For the SCCs: the Member is the data exporter and Juris Cross the data importer; clause 7 (docking) does not apply; under clause 9 Option 2 (general authorisation) applies with the 30-day notice in clause 4.2; the optional wording in clause 11 does not apply; the competent supervisory authority under clause 13 is that of the Member's establishment; the law under clause 17 and the courts under clause 18 are those of Ireland; and Annexes 1 to 3 of this DPA complete Annexes I to III of the SCCs.

5.3 Members in the United Kingdom. The International Data Transfer Addendum issued by the UK Information Commissioner applies to the SCCs, with the information in this DPA completing its tables. Neither party may end the Addendum when it changes.

5.4 Members in Türkiye and onward transfers. For transfers of Workspace Content to Sub-processors outside Türkiye, Juris Cross relies on the standard contract (processor to sub-processor) published by the Personal Data Protection Board under article 9 KVKK, notified to the Personal Data Protection Authority within five business days of signature, or on another mechanism permitted by article 9.

5.5 For Members in other countries, Juris Cross will cooperate in putting in place any additional transfer mechanism that their Data Protection Law requires.

5.6 Disclosure of Workspace Content by one Member to another Member is a transfer by the uploading Member as controller and is outside this clause (Terms, clause 6.1).

6. Personal data breaches

6.1 Juris Cross will notify the Member without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Member's Workspace Content.

6.2 The notice will describe, as far as then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point. Information that is not yet available will be provided in phases without undue delay.

6.3 Juris Cross will take reasonable steps to contain the breach and limit its effects, and will help the Member meet its obligations to notify supervisory authorities and data subjects. The Member decides whether to make those notifications for its own Workspace Content.

6.4 A notice under this clause is not an acknowledgement of fault or liability.

7. Deletion and return

7.1 Workspace Content is retained for the period the Originator chose under clause 7 of the Terms and is then permanently deleted. The Member may download or export its Workspace Content at any time before deletion; this is the means of return.

7.2 Juris Cross does not keep backups of Workspace Content beyond its live systems. If it introduces backups, it will delete Workspace Content from them within 30 days of deletion from the live systems and will update this clause.

7.3 Juris Cross may keep Workspace Content longer only where the law requires it, and then only for that purpose. The Mandate Record, which contains no Workspace Content, is kept by Juris Cross as controller under the Terms and the Privacy Policy.

8. Audits and information

8.1 Juris Cross will make available to the Member the information reasonably necessary to demonstrate compliance with this DPA, including on request a written description of its security measures and Sub-processor contracts (commercial terms redacted).

8.2 If that information is not sufficient, or a supervisory authority requires it, the Member may audit Juris Cross's compliance once a year, by itself or through an independent auditor bound by confidentiality, on at least 30 days' written notice, during business hours and without disrupting the platform or accessing other members' data. Each party bears its own costs.

8.3 Juris Cross will rely on its Sub-processors' independent audit reports and certifications for their facilities.

9. Member obligations

9.1 The Member is responsible for: having a lawful basis for uploading and sharing Workspace Content, including any special categories of data and international transfers; informing its clients and other data subjects; complying with its professional duties of confidentiality and privilege; and sharing only what the receiving member needs.

9.2 The Member's instructions must comply with Data Protection Law.

10. Liability

10.1 Each party's liability under this DPA is subject to clause 15 of the Terms, except where Data Protection Law or the SCCs do not allow liability to be limited.

10.2 Nothing in this DPA limits either party's liability to data subjects under Data Protection Law.

11. Term and precedence

11.1 This DPA applies for as long as Juris Cross processes the Member's Workspace Content and ends automatically when all of it has been deleted.

11.2 If there is a conflict, the SCCs and the UK Addendum prevail over this DPA, and this DPA prevails over the Terms on matters of data protection.

11.3 Except as required by the SCCs, this DPA is governed by the law and dispute resolution clause of the Terms (clause 20).

11.4 Juris Cross may update this DPA in line with clause 19 of the Terms. Changes that reduce the protection of Workspace Content are material changes.

Annex 1 – Description of the processing

Annex 2 – Sub-processors

Sum and Substance Ltd (Sumsub), PayTR and İşnet (NetteFatura) process account and billing data for which Juris Cross is controller, not Workspace Content, and are therefore not listed here (see the Privacy Policy).

Upstash, Inc., Cloudflare, Inc. and browser push services do not process Workspace Content and are also listed in the Privacy Policy. Video calls run under our 8x8, Inc. account. They are not stored or recorded, so they are not Workspace Content under this DPA and are outside its retention and export provisions.

Annex 3 – Technical and organisational measures