Legal · data processing addendum
Data processing.
Draft — subject to counsel review before first engagement
1. Roles
Where client-submitted materials contain personal data, the client is the controller and Bench (BizLegal AI / DOR INNOVATIONS, operating from Israel) acts as processor, processing only on the client's documented instructions to deliver the measurement services. Clients are asked to minimise personal data in submitted outputs; evaluation does not require identified individuals, and redaction before submission is the recommended default.
2. Subprocessors
Bench uses a small, listed set of subprocessors: cloud hosting and database infrastructure (Vercel; Supabase), transactional email (Resend), and the vetted independent experts who perform evaluation work under written confidentiality and data-protection obligations. The current register is available on request; we give notice of additions, with a right to object on reasonable data-protection grounds.
3. International transfers
Israel benefits from an EU adequacy decision (reaffirmed 2024) and UK adequacy regulations. Where a transfer requires additional safeguards — including onward transfers to experts outside adequate jurisdictions — the parties rely on the applicable standard contractual clauses (EU SCCs, or the UK IDTA/Addendum for UK-origin data), executed as part of this addendum.
4. Security
Access to client materials is limited to personnel and experts who need it for the engagement; expert access is scoped to assigned evaluation items, not client identity, wherever the workflow permits. Data is encrypted in transit and at rest by the infrastructure providers listed above; access is credentialed and logged.
5. Retention and deletion
Client Inputs and Client Model Outputs are retained for twelve (12) months from Report delivery, then deleted; earlier deletion is honoured within thirty (30) days of a written request. Bench Evaluation Materials (rubric applications, error classifications, gold-standard answers) are retained by Bench in accordance with the service terms, with any embedded client-confidential content removed or anonymized.
6. Incidents and assistance
Bench notifies the client without undue delay after becoming aware of a personal data breach affecting client materials, and provides reasonable assistance with data-subject requests, security questionnaires, and impact assessments relating to the Services.
Contact for data matters: team@bizlegal-ai.com · Service terms: /legal/terms