Data Protection Policy

1. Status and meanings

1.1This Data Protection Policy (the "Policy") applies when Scriptum AI Limited, company number NI740697, of 4 Ballybarnes Meadow, Killarn, Northern Ireland, BT23 4GZ ("Scriptum") processes personal data for a customer under our Terms of Service or another signed agreement (the "Agreement"). Capitalised terms not defined here have the meanings in the Terms.

1.2"Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in Data Protection Law.

1.3"Data Protection Law" means the UK GDPR and the Data Protection Act 2018 and, where it applies to the processing, the EU GDPR, together with any other law on the protection of personal data that applies to a party.

1.4"Customer Personal Data" means personal data in Customer Data that Scriptum processes for the Customer.

2. Roles

2.1The Customer is the controller of Customer Personal Data, or a processor acting for its own client, and Scriptum is its processor or sub-processor.

2.2Scriptum is an independent controller of the limited data described in our Privacy Policy, such as account administration, billing, security and usage data.

2.3Each party will comply with the Data Protection Law that applies to it.

2.4The Customer is responsible for having a lawful basis for the personal data it puts into the Service, including any special category or criminal offence data, and for giving any notices required, including to people it invites to a matter.

3. Details of the processing

4. Scriptum's obligations

Scriptum will:

• process Customer Personal Data only on the Customer's documented instructions, which include the Agreement and the Customer's use of the Service, unless the law requires otherwise, in which case Scriptum will tell the Customer first if the law allows;
• tell the Customer if it believes an instruction breaks Data Protection Law;
• make sure everyone authorised to handle the data is bound by a duty of confidence;
• keep in place the security measures in Annex 1;
• assist the Customer, taking into account the nature of the processing, with data subject requests, security, breach notifications, impact assessments and consultation with regulators;
• pass on without undue delay any request it receives from a data subject about Customer Personal Data, and not respond itself except on the Customer's instructions or as the law requires; and
• not sell Customer Personal Data, or use it for its own purposes except as this Policy allows.

Scriptum may charge its reasonable costs for assistance that goes beyond what the Service and this Policy ordinarily provide, having told the Customer of the cost beforehand.

5. AI processing

5.1Scriptum will not use Customer Data to train any AI model, and will engage AI providers only on terms that do not permit them to train their models on it. Those terms may allow a provider to hold inputs for a limited period to detect misuse.

5.2AI output is a proposal. It takes effect in a document only when an Authorised User approves it.

5.3Cross-firm benchmarks are off by default. They apply only if the Customer opts in, and use only de-identified data presented so that no firm, matter or client can be reconstructed from it.

6. Firm separation

6.1Each customer's data is logically separated from every other customer's at the database.

6.2Both sides of a transaction may be Scriptum customers. Scriptum will not disclose one customer's data to another, except what a customer itself chooses to release to a shared matter.

7. Sub-processors

7.1The Customer authorises Scriptum to use the sub-processors in Annex 2.

7.2Scriptum will give at least 30 days' notice before adding or replacing a sub-processor. If the Customer objects on reasonable data protection grounds within that period, the parties will discuss the objection in good faith. If it cannot be resolved, the Customer may end the affected part of the Service by written notice and receive a pro rata refund of prepaid fees for it.

7.3Scriptum will bind each sub-processor to data protection obligations that are in substance no less protective than this Policy, and remains responsible for its sub-processors' performance.

8. Storage location and transfers

8.1Scriptum stores all Customer Data in the European Union (Frankfurt, Germany), and does not keep it in a database or document store anywhere else.

8.2The Customer authorises the transfers shown in Annex 2. These include sending the relevant text from matter content to AI providers in the United States for processing when an AI feature runs.

8.3Scriptum will make sure that each restricted transfer is covered by a valid mechanism under Data Protection Law, such as adequacy regulations, the UK-US data bridge, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

9. Personal data breaches

9.1Scriptum will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

9.2The notice will give, as far as they are known at the time, the nature of the breach, the data and people affected, its likely consequences and what is being done about it. Scriptum will provide further information as it becomes available, so that the Customer can meet its own reporting duties.

10. Return and deletion

10.1For 30 days after the Agreement ends, Scriptum will make Customer Data available for export in the formats the Service supports.

10.2Scriptum will then delete Customer Personal Data from production systems within a further 60 days, and from backups in the ordinary course of rotation, unless the law requires it to be kept. Scriptum will confirm deletion in writing on request.

11. Information and audit

11.1Scriptum will make available the information reasonably needed to show compliance with this Policy, starting with written answers to the Customer's security and data protection questions.

11.2Where that is not enough, or a regulator requires it, the Customer may audit Scriptum's compliance. An audit requires 30 days' written notice (unless a regulator or a personal data breach requires sooner), may take place no more than once in any 12 months unless a breach or a regulator requires otherwise, must take place in business hours under a duty of confidence, and may not extend to other customers' data. Each party bears its own costs.

12. Liability

Liability under this Policy is subject to the exclusions and limits in the Agreement. Nothing in this Policy limits a party's direct liability to data subjects or regulators under Data Protection Law.

Annex 1: Security measures

• Encryption. Data is encrypted in transit using TLS and at rest using our infrastructure provider's storage encryption.
• Firm separation. Row-level security rules in the database separate each firm's data from every other firm's.
• Access control. Authenticated accounts with role-based permissions for users, firm administrators and partners, including senior approval before a change is released.
• Staff access. Internal access to production systems is restricted to those who need it, bound by confidentiality, and any access to a customer account through support tools is logged.
• Audit trail. Approvals, releases and matter activity are recorded.
• Provider selection. We carry out due diligence on sub-processors and put written data processing terms in place with them.
• Incident response. We investigate suspected incidents and notify customers under section 9.

Annex 2: Sub-processors

At 4 November 2026: