This Data Protection Addendum (the "Addendum") forms part of the Terms of Service and of each agreement under which Redwood Meridian LLC, doing business as My Legal Academy ("MLA"), provides services to a client (the "Firm"), including every order, statement of work and set of service terms incorporated into it (each, an "Agreement"). It applies from the date the Firm accepts an Agreement that incorporates it, and MLA and the Firm are each a "Party."

1. Definitions

(a) "Applicable Data Protection Law" means each U.S. federal and state law on the privacy, security or processing of personal information that applies to a Party's processing of Firm Data, including, where it applies, the California Consumer Privacy Act of 2018, as amended, and its regulations (the "CCPA").

(b) "Firm Data" means personal information that the Firm, its clients, prospective clients or leads provide to MLA, or that MLA collects on the Firm's behalf, in delivering the Services, including call recordings, transcripts and lead records.

(d) "Security Incident" means a breach of security that leads to the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, Firm Data held by MLA or a Subprocessor.

(e) "Subprocessor" means a third party MLA engages that processes Firm Data in delivering the Services.

(f) Other terms defined in Applicable Data Protection Law, including "service provider," "sell" and "share," have the meanings given there.

2. Roles and Instructions

(a) Service Provider. MLA processes Firm Data on the Firm's behalf as its service provider, only on the Firm's instructions in the Agreement, this Addendum and the Firm's written directions consistent with the Agreement, and only for the purposes described for each category of Service in Annex C, to meet MLA's legal obligations and to establish or defend a legal claim (the "Permitted Purposes").

(b) Restrictions. MLA shall not (i) sell or share Firm Data; (ii) retain, use or disclose Firm Data for any purpose other than the Permitted Purposes, including any commercial purpose of its own or any purpose outside the direct business relationship between the Parties; or (iii) combine Firm Data with personal information MLA receives from or on behalf of another person, or collects from its own interactions with an individual, except as Applicable Data Protection Law permits a service provider to do.

(c) Compliance. MLA shall comply with the obligations the CCPA places on it as a service provider and provide the same level of privacy protection as the CCPA requires of businesses, and shall notify the Firm in writing if it determines it can no longer do so. The Firm may then, or where it reasonably believes MLA is processing Firm Data in a way this Addendum does not permit, direct MLA in writing to stop the processing concerned, and the Parties shall work in good faith to remediate it. Section 10 is the means by which the Firm verifies that MLA uses Firm Data consistently with the Firm's obligations.

(d) De-identified Data. Where an Agreement permits MLA to create aggregated or de-identified data from Firm Data, MLA shall take reasonable measures to ensure it cannot be associated with the Firm, an individual or a matter, shall not attempt to re-identify it, and shall contractually require any recipient of it to do the same.

(e) Instructions. MLA is not required to follow an instruction it reasonably believes the law does not permit, and shall tell the Firm when it declines one.

(f) The Firm's Responsibilities. The Firm is responsible for the lawfulness of the Firm Data it provides to MLA or directs MLA to collect, including every notice, consent and opt-out the law requires before Firm Data is provided to MLA or collected on the Firm's behalf, and for the lawfulness of its instructions.

3. Personnel

MLA shall limit access to Firm Data to the personnel and contractors who need it to deliver the Services, grant each only the access their role requires, bind each by written confidentiality obligations before granting access, and revoke access promptly when it is no longer needed.

4. Security

MLA shall implement and maintain reasonable administrative, technical and physical safeguards appropriate to the nature of Firm Data, including the procedures described in Annex A. MLA may update its safeguards from time to time, provided that an update does not materially reduce the overall protection of Firm Data.

5. Subprocessors

(a) The Firm authorizes MLA to engage Subprocessors to deliver the Services. MLA shall bind each by written terms that protect Firm Data in substance no less than this Addendum, and remains responsible to the Firm for each Subprocessor's performance of them.

(b) MLA shall provide its current list of Subprocessors on the Firm's written request, and shall give the Firm at least ten (10) business days' written notice before a new Subprocessor begins processing Firm Data, or notice promptly after the change where it is needed urgently to protect Firm Data or keep the Services running. Notice is given by e-mail to the Firm's notice address and may be a single notice to all MLA clients. The Firm may object in writing on reasonable data-protection grounds within the notice period, and the Parties shall discuss the objection in good faith.

6. Artificial-Intelligence Providers

Where the Services use an artificial-intelligence provider to process Firm Data, MLA shall use it under terms or settings under which submitted content is not used to train the provider's models, where the provider offers them, and shall treat the provider as a Subprocessor. Except for data de-identified under Section 2(d), MLA shall not use Firm Data to train a model that serves anyone other than the Firm.

7. Security Incidents

(a) MLA shall notify the Firm in writing without undue delay, and in any event within seventy-two (72) hours after MLA confirms a Security Incident affecting Firm Data, describing, to the extent then known, its nature, the categories of Firm Data and individuals affected, the steps taken and a contact, and shall supplement the notice as information becomes available.

(b) MLA shall take reasonable steps to contain and remediate the Security Incident and cooperate with the Firm's reasonable requests, including for information the Firm needs for its own notifications. The Firm controls notifications to its clients, leads and regulators, and MLA shall not make one on the Firm's behalf without its consent, except as the law requires. MLA's notice or cooperation is not an acknowledgment of fault or liability.

8. Requests from Individuals and Third Parties

MLA shall forward to the Firm, without undue delay after recognizing it, any request from an individual to exercise a privacy right concerning Firm Data, respond only as the Firm directs or the law requires, and give the Firm reasonable assistance, at the Firm's cost beyond the ordinary operation of the Services. Unless the law prohibits it, MLA shall notify the Firm, where reasonably practicable, of a third-party subpoena or order compelling disclosure of Firm Data before producing it. Nothing in this Addendum restricts MLA's use of Firm Data to establish or defend a claim or requires deletion of Firm Data kept under Section 9(b).

9. Retention, Return and Deletion

(a) MLA shall retain Firm Data for the periods the Agreement states for each Service (as summarized in Annex B). When a Service ends, MLA shall make Firm Data available to the Firm for the period the Agreement states and then delete it and instruct its Subprocessors to do the same, except Firm Data the Agreement says MLA keeps for a longer period, which MLA deletes at the end of that period. Where the Agreement states no period, MLA shall return or delete the Firm Data, at the Firm's election, within thirty (30) days after the Service ends. Copies in encrypted backups are deleted as the backups expire and remain subject to this Addendum until then.

(b) MLA suspends deletion and keeps Firm Data where it receives a claim, demand, preservation notice or notice of an investigation touching it, until the matter is resolved; where the law requires retention; and to the extent MLA reasonably needs it to establish or defend a legal claim or evidence its compliance with the law. Firm Data so kept remains subject to this Addendum and is used only for that purpose.

(c) On the Firm's written request, MLA shall confirm in writing that deletion under this Section 9 has been carried out, other than of backup copies and Firm Data kept under Section 9(b) or for a longer stated period.

10. Audit

(a) Once in any twelve-month period, on thirty (30) days' written notice, the Firm may send MLA a reasonable written questionnaire about MLA's processing of Firm Data and its compliance with this Addendum, and MLA shall answer it within thirty (30) days, or a longer period the Parties agree for a questionnaire of unusual length. Answers describe MLA's procedures as of their date, are not warranties and are MLA's confidential information. A records audit under an Agreement and a questionnaire under this Section 10 together count once in any twelve-month period, and this Section 10 does not otherwise limit a records-audit right an Agreement grants for a specific Service.

(b) An on-site audit takes place only where a regulator with authority over the Firm requires one in writing, on at least thirty (30) days' written notice or the shorter period the regulator requires, during business hours and at the Firm's cost, by the regulator, or by a representative of the Firm who is not a competitor of MLA and signs MLA's confidentiality undertaking. It is limited to MLA's records and systems that process Firm Data, excluding Subprocessors' facilities, and excludes MLA's pricing, personnel records and material relating to another client.

11. Health Information

The Parties do not intend MLA to receive protected health information as a business associate, and MLA does not enter into business associate agreements. The Firm determines whether HIPAA or any other health-information law applies to it and its Firm Data, and shall tell MLA in writing, before providing Firm Data and before any change, whether (i) it represents or acts for a health-care provider or health plan in matters whose data it provides, (ii) it asks MLA to contract with or serve a health-care provider or health plan directly, or (iii) MLA would process Firm Data on behalf of one. Where any of these applies, MLA may decline to process the data concerned, or suspend the Services concerned, until the Parties agree in writing how to proceed.

12. General

(a) Precedence. If this Addendum and the Agreement for the Service concerned conflict on the processing of Firm Data, this Addendum governs, except that a Service-specific provision of that Agreement on retention periods, access to records or records audit continues to apply.

(b) Liability. MLA's liability arising out of or relating to this Addendum, however arising, is subject to the limitations and exclusions of liability in the Agreement for the Service concerned and counts toward any limit stated there. Where that Agreement states no limit, MLA's aggregate liability under this Addendum does not exceed the fees the Firm paid for that Service in the twelve (12) months before the event giving rise to the claim.

(c) Term and Other Terms. This Addendum continues for as long as MLA processes Firm Data under an Agreement, and its obligations survive for as long as MLA or a Subprocessor holds Firm Data. If a change in Applicable Data Protection Law requires a change to this Addendum, the Parties shall negotiate it in good faith. Governing law, dispute resolution and notices follow the Agreement for the Service concerned. MLA may update this Addendum by posting a new version on this page and notifying the Firm by e-mail; an update takes effect thirty (30) days after notice and does not reduce the protection of Firm Data. A Firm that wants a countersigned copy may request one at privacy@mylegalacademy.com.

ANNEX A: SECURITY PROCEDURES

MLA shall maintain written procedures for Firm Data that provide for the following, and may change a procedure under Section 4.

1. Access control. Individual accounts for each person with access; multi-factor authentication on accounts that can access Firm Data, where the system supports it; access limited to what each role requires; periodic review of who holds access; and prompt removal of access on a change of role or departure.

2. Encryption. Encryption of Firm Data in transit over public networks and at rest, including in backups, using industry-standard methods, in the systems MLA controls or selects.

3. Logging. Logging of administrative access to systems that store Firm Data, where the system supports it, and review of those logs when a Security Incident is suspected.

4. Personnel. Written confidentiality undertakings before access is granted, training on the handling of confidential information, and written acknowledgement of that training.

5. Subprocessors. A security and privacy review of a Subprocessor before it is engaged, and written terms under Section 5.

6. Incident response. A written incident-response procedure with assigned roles, escalation steps and the Firm notification steps in Section 7.

7. Collection and deletion. Collection limited to what the Services and the Firm's instructions require, and deletion under Section 9.

ANNEX B: RETENTION PERIODS BY SERVICE

Summarized from the Agreement for each Service, which governs if the two differ.

1. Intake services. Call audio and transcripts: ninety (90) days from the call, and the telephony provider's copy is deleted earlier, once MLA's own copy is stored. Consent and disclosure log, and call metadata and quality records with no call content: four (4) years. Recordings the Firm provides to prepare intakers, and their transcripts: while the Service is active, and deleted thirty (30) days after it ends.

2. Marketing and growth services. Firm Data in the Firm's own accounts stays there under the Firm's control. MLA's working copies are deleted within thirty (30) days after the Service ends.

3. AI implementation services. Firm Data stays in the Firm's systems. MLA's working copies are deleted within thirty (30) days after the Service ends.

ANNEX C: PROCESSING DESCRIPTION

Firm Data and Permitted Purposes for each category of Service the Firm buys.

1. Intake services. Lead names, contact details and what leads say on calls, texts and forms; call recordings and transcripts; consent, disclosure and do-not-contact records; qualification and appointment records. Purposes: answering and calling the Firm's leads, recording calls, qualifying leads under the Firm's criteria, booking consultations, sending the Firm's engagement documents where the Firm elects it, quality sampling and reporting to the Firm.

2. Marketing and growth services. Contact details and engagement records of the Firm's leads and clients in the systems MLA operates for the Firm. Purposes: building, running and reporting on the Firm's marketing campaigns, follow-up sequences and lead management.

3. AI implementation services. Personal information in the Firm's systems, documents and workflows that MLA accesses to deliver the work. Purposes: designing, configuring, testing and supporting the Firm's AI tools and workflows, and training the Firm's personnel on them.