Data Processing Agreement

Introduction

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Motion Ready, LLC (“Processor”) and you (“Controller”) and governs the processing of personal data in connection with our Services.

Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person.
• “Processing” means any operation performed on Personal Data, including collection, storage, use, and disclosure.
• “Data Subject” means the individual to whom Personal Data relates.
• “Sub-processor” means any third party engaged by the Processor to process Personal Data.

Scope and Purpose

The Processor will process Personal Data only for the purpose of providing the Services as described in our Terms of Service and as instructed by the Controller. The types of Personal Data processed include:

• Contact information (name, email, phone number, address)
• Professional information (bar number, firm name)
• Case information submitted with orders
• Documents and files uploaded to our platform
• Communications and messages
• Payment information

Data Protection Obligations

Processor Obligations

The Processor agrees to:

• Process Personal Data only on documented instructions from the Controller
• Ensure personnel authorized to process Personal Data are bound by confidentiality
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to Data Subject requests
• Delete or return Personal Data upon termination of Services
• Make available information necessary to demonstrate compliance

Controller Obligations

The Controller agrees to:

• Ensure lawful basis for processing Personal Data
• Provide necessary information for Data Subject requests
• Comply with applicable data protection laws
• Notify Processor of any changes to processing instructions

Security Measures

The Processor implements the following security measures:

• Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
• Access Controls: Role-based access, multi-factor authentication
• Infrastructure: SOC 2 Type II compliant cloud infrastructure
• Monitoring: 24/7 security monitoring and alerting
• Backups: Daily encrypted backups with 30-day retention
• Testing: Regular security assessments and penetration testing

Sub-processors

The Controller authorizes the Processor to engage the following Sub-processors:

The current list of authorized Sub-processors is maintained at motion-ready.com/sub-processors. That page is updated whenever Sub-processors are added or materially changed, with no fewer than 30 days' advance notice before any new Sub-processor begins processing Controller data.

The Processor will notify the Controller of any intended changes to Sub-processors, allowing 30 days to object. Controllers who object to a new Sub-processor may terminate the Services in accordance with the Terms of Service.

Controllers may also request the complete sub-processor list by contacting support@motion-ready.com.

Data Subject Rights

The Processor will assist the Controller in responding to Data Subject requests, including:

• Access to Personal Data
• Rectification of inaccurate data
• Erasure of Personal Data
• Restriction of processing
• Data portability
• Objection to processing

Data Breach Notification

In the event of a Personal Data breach, the Processor will:

• Notify the Controller within 72 hours of becoming aware
• Provide details of the breach and affected data
• Describe measures taken to mitigate the breach
• Cooperate with the Controller in any required notifications

Data Retention and Deletion

Personal Data will be retained in accordance with our Privacy Policy:

• Account data: Duration of account plus 3 years
• Case materials: 365 days after order completion
• Billing records: 7 years (tax and financial regulations)
• AI processing logs: Zero retention — deleted immediately after generation
• Communications: 3 years after last activity

Upon termination, the Processor will delete or return Personal Data within 90 days, unless retention is required by law.

International Transfers

Personal Data may be transferred to the United States. The Processor ensures appropriate safeguards for such transfers, including:

• Standard Contractual Clauses (where applicable)
• Sub-processors with adequate data protection commitments
• Technical measures to protect data during transfer

AI Processing Addendum

In addition to the above, the following applies to AI processing:

• Purpose Limitation: AI systems process data only to provide the requested drafting services
• No Training: Your data is not used to train AI models
• Human Review: All AI outputs are reviewed by qualified legal professionals before delivery
• Data Minimization: Only necessary data is sent to AI systems
• Logging: AI processing logs are deleted immediately after generation — zero retention
• Zero Data Retention: AI model providers process matter data under zero data retention commitments — your data is not persisted by the model provider and exists only transiently in memory during the generation request.

Audit Rights

Upon reasonable notice, the Controller may audit the Processor's compliance with this DPA. The Processor will:

• Provide access to relevant documentation
• Permit on-site inspections (with reasonable notice)
• Make personnel available for questions

Alternatively, the Processor may provide third-party audit reports (SOC 2, ISO 27001) as evidence of compliance.

Liability

Each party's liability under this DPA is subject to the limitations set forth in the Terms of Service. The Processor will not be liable for damages arising from the Controller's failure to comply with data protection laws.

Term and Termination

This DPA is effective for the duration of the Services. It will automatically terminate when the Services end. Provisions relating to data deletion, liability, and confidentiality survive termination.

Governing Law

This DPA is governed by the laws of the State of Texas, without regard to its conflict of law provisions. Any disputes arising under this DPA shall be resolved in accordance with the dispute resolution provisions set forth in the Terms of Service.

Government and Law Enforcement Requests

Upon receipt of any subpoena, court order, warrant, or other compulsory legal process relating to Customer Data, Motion Ready will: (a) evaluate whether the demand is legally valid and narrowly tailored; (b) provide Customer with written notice no fewer than ten (10) business days before the date of required compliance, except where prohibited by law; and (c) cooperate with Customer's reasonable efforts to oppose the demand.

Motion Ready acknowledges that Customer Data may contain information protected by the attorney-client privilege and the work product doctrine. Motion Ready will not voluntarily waive any such privilege and will affirmatively raise privilege as a threshold objection where applicable.

Contact

For questions about this DPA or to exercise your rights, or to request a custom DPA for enterprise needs, contact our team: