firstcase Data Processing Addendum

1. Introduction and Scope

This Data Processing Addendum ("DPA") forms part of the Terms of Service between LexTone Communications LLC d/b/a firstcase ("Processor," "firstcase") and the subscribing law firm ("Controller," "Client"). It governs Processor's processing of Personal Data on the Client's behalf in connection with the Platform.

This DPA is intended to satisfy applicable data protection laws, including the EU GDPR, the UK GDPR, the CCPA as amended by the CPRA, and other applicable U.S. state privacy laws. In a conflict between this DPA and the Terms of Service, this DPA prevails on data-protection matters.

2. Definitions

"Personal Data" means information relating to an identified or identifiable natural person processed through the Platform, including caller name, phone number, matter details, and other information captured during intake. "Processing," "Controller," "Processor," "Data Subject," and "Sub-processor" have the meanings given under applicable law and the Terms. "Security Incident" means a confirmed unauthorized access to, disclosure of, alteration of, or destruction of Personal Data.

3. Roles and Responsibilities

The Client is the Controller and determines the purposes and means of processing. firstcase is the Processor and processes Personal Data only on the Client's documented instructions. Each party is responsible for its own compliance with applicable data protection law. The Client is responsible for having a lawful basis to collect caller Personal Data, providing required disclosures about AI-assisted and recorded call handling, and responding to Data Subject requests it receives directly.

4. Nature and Purpose of Processing

Categories of Personal Data: caller identification data (name, phone, email if provided); legal-matter information (area of law, nature of dispute, urgency); call data (recordings, transcripts, duration, timestamps); AI-generated data (summaries, assessments, classifications); scheduling data.

Categories of Data Subjects: prospective clients who call the firm's firstcase-powered number; existing clients calling for updates or scheduling; third parties referenced during intake.

Purposes: providing AI-powered call answering and intake; generating transcripts, recordings, and summaries for the Client; routing calls and delivering notifications; enabling the Client to manage, search, and export records; integrating with the Client's calendar and CRM at the Client's direction.

Duration: for the term of the subscription and up to 90 days after termination, during which data may be exported, after which Personal Data is deleted except where retention is required by law.

5. Processor Obligations

5.1 Instructions Only

firstcase processes Personal Data only on the Client's documented instructions, including the Terms, this DPA, and the Client's configuration. If law requires other processing, firstcase will inform the Client first unless prohibited by law.

5.2 Confidentiality

Personnel authorized to process Personal Data are bound by confidentiality obligations, and access is limited to those who need it to provide the Platform.

5.3 No AI Training on Personal Data

firstcase does not use identifiable Personal Data, including call transcripts and recordings, to train, fine-tune, or develop foundation or general-purpose AI or machine-learning models, whether operated by firstcase or a Sub-processor. firstcase may use aggregated and de-identified data that does not identify any Data Subject, Client, or call to operate, secure, and improve the Platform, and will not use identifiable Personal Data for any other purpose without the Client's separate written consent.

5.4 Data Subject Rights Assistance

firstcase will assist the Client in responding to Data Subject requests (access, correction, deletion, portability, restriction, objection) by providing export and deletion tools, executing deletion of specific records on the Client's written instruction, and responding to Client requests within 5 business days. If a Data Subject contacts firstcase directly, firstcase will promptly forward the request to the Client.

5.5 DPIA Assistance

firstcase will provide reasonable assistance with Data Protection Impact Assessments where required, including documentation of processing, security measures, and Sub-processor arrangements.

5.6 Records of Processing

firstcase maintains records of processing carried out on the Client's behalf as required by Article 30(2) GDPR, available to the Client on request.

6. Security Measures

firstcase implements and maintains technical and organizational measures designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction, including:

• TLS 1.2+ encryption in transit
• AES-256 encryption at rest provided by its infrastructure providers
• Calendar and CRM connection credentials stored encrypted by integration providers, not held in plaintext
• Logical multi-tenant data isolation with row-level security
• Role-based access controls
• Access logging
• Periodic review of security practices

firstcase reviews its security measures periodically and following any significant change to the Platform or threat landscape. No security measures can guarantee absolute security.

7. Sub-processors

7.1 Authorized Sub-processors

The Client provides general authorization for firstcase to engage the Sub-processors below. Each is governed by a data processing agreement imposing obligations at least equivalent to this DPA.

7.2 Changes

firstcase will give at least 30 days' notice before adding or replacing a Sub-processor that processes Personal Data, by email to the Client's registered address. The Client may object on reasonable data-protection grounds within 14 days. If the parties cannot resolve the objection, the Client may terminate the affected subscription without penalty.

7.3 Liability

firstcase remains liable to the Client for the performance of its Sub-processors' data-protection obligations under this DPA.

8. International Data Transfers

The Sub-processors above are located in the United States. Where Personal Data of EU or UK Data Subjects is transferred to the United States, firstcase relies on Standard Contractual Clauses approved by the European Commission, UK International Data Transfer Agreements or Addenda, and adequacy decisions where applicable, each incorporated by reference into agreements with relevant Sub-processors. A copy of applicable SCCs is available on written request to legal@firstcase.ai.

9. Security Incidents and Breach Notification

9.1 Timeline

firstcase will notify the Client without undue delay and in any event within 72 hours of becoming aware of a Security Incident affecting the Client's Personal Data, by email to the registered address, even if full details are not yet available. A written incident report will follow within 14 days.

9.2 Report Contents

To the extent known: the nature of the incident; categories and approximate number of Data Subjects affected; categories and approximate volume of records affected; likely consequences; and measures taken or proposed.

9.3 Cooperation

firstcase will cooperate with the Client in managing the incident, including providing information the Client needs to meet its own notification obligations.

10. Audit Rights

On at least 30 days' notice and no more than once per calendar year, the Client may audit firstcase's processing to verify compliance, through the Client or a mutually agreed independent auditor under reasonable confidentiality terms. In lieu of an on-site audit, firstcase may satisfy a request by providing a current third-party audit report (such as SOC 2 Type II, when available), written responses to a reasonable security questionnaire, or documentary evidence of its measures. The Client bears audit costs unless the audit reveals a material breach of this DPA, in which case firstcase bears the reasonable costs.

11. CCPA / CPRA

To the extent the CCPA/CPRA applies, firstcase is a "Service Provider" processing Personal Data on the Client's behalf for the business purposes in this DPA. firstcase is prohibited from selling or sharing Personal Data; from retaining, using, or disclosing it for any purpose other than providing the Platform; and from combining it with data from other sources except as permitted by law. firstcase will notify the Client if it determines it can no longer meet these obligations, and the Client may take reasonable steps to ensure firstcase's processing is consistent with the Client's obligations.

12. Data Retention and Deletion

12.1 Schedule

Call recordings, transcripts, AI summaries, and caller metadata (name, phone, matter type): subscription term plus 90 days, unless the Client requests earlier deletion. Call recordings are available in the Client's dashboard for 6 months on the Essential plan and 2 years on the Growth plan. Account and configuration data: subscription term plus 90 days. Billing records: 7 years as required by law.

12.2 Client-Initiated Deletion

The Client may request deletion of specific records, transcripts, or recordings at any time via the dashboard or by written request to legal@firstcase.ai. firstcase will complete deletion within 30 days and confirm in writing.

12.3 Post-Termination Deletion

After the 90-day post-termination period, firstcase will permanently delete all Personal Data processed on the Client's behalf, including copies held by Sub-processors, except as required by law. Written confirmation is available on request.

12.4 Legal Hold

firstcase may retain Personal Data beyond the stated periods where required by law, court order, or regulator, and will notify the Client to the extent permitted.

13. Governing Law

This DPA is governed by the same law as the Terms of Service (State of New Mexico). For EU and UK Data Subjects, this DPA is also interpreted in accordance with applicable EU and UK data protection law to the extent required.

14. Order of Precedence

In a conflict between this DPA and the Terms of Service, this DPA prevails on data-protection matters. In a conflict between this DPA and the Standard Contractual Clauses, the SCCs prevail on international transfers.

15. Contact and Execution

This DPA is incorporated into and forms part of the Terms of Service. By accepting the Terms of Service, the Client agrees to this DPA.