Data Processing Agreement

Parties and how to sign

This Data Processing Agreement ("DPA") is between the business customer identified in the signature block ("Controller") and BizLegal AI, registered in Israel, Diamonds Exchange, Tuval 23, Ramat Gan, Israel ("Processor"). It forms part of the terms of use and any order for Bench services.

To sign: print or save this page, complete the Controller details below, sign, and send it to privacy@bizlegal-ai.com. We countersign and return a copy. Signing is not needed for the DPA to apply where the law makes it part of the contract automatically.

1. Roles and scope

1.1 The Controller decides why and how personal data in its content is processed; the Processor processes it only to provide the services ordered. 1.2 Where the Processor uses personal data for its own account (billing, security, its own marketing), it is a separate controller and its privacy policy applies.

2. Processor obligations

• Process personal data only on the Controller's documented instructions (these terms and the Controller's use of the service), unless the law requires otherwise; tell the Controller if an instruction appears to break data protection law.
• Ensure everyone authorised to process the data is bound by confidentiality.
• Apply the security measures in section 4.
• Assist the Controller, taking into account the nature of processing, in answering data-subject requests and with security, breach notification, impact assessments and prior consultation.
• Make available the information needed to show compliance with this DPA, and allow audits as in section 8.

3. Subprocessors

The Controller gives general authorisation for the subprocessors below. The Processor will give notice of any intended addition or replacement by updating this page and emailing customers who ask for notices at privacy@bizlegal-ai.com, at least 14 days before the change; the Controller may object on reasonable data-protection grounds and, if no solution is found, end the affected service with a pro-rata refund. The Processor imposes data-protection obligations on each subprocessor no less protective than this DPA and remains responsible for them.

4. Security measures

• Encryption of data in transit (TLS) and the encryption at rest provided by the hosting and database providers.
• Access restricted to personnel and systems that need it, with separate credentials and secrets kept out of source code.
• Server-side input validation, rate limiting and bot protection on public endpoints.
• Personal data redacted before storage where a feature does not need it.
• Backups and recovery through the database providers.
• Review of these measures when the service changes.

5. Personal-data breaches

The Processor will notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting the Controller's data, with the information the Controller needs to meet its own obligations, and will take reasonable steps to contain it.

6. International transfers

Where processing involves a transfer of personal data out of the EEA, the UK or Switzerland to a country without an adequacy decision, the parties rely on the European Commission's adequacy decision for Israel and, for providers in other countries, the EU Standard Contractual Clauses, which are incorporated by reference.

7. Data-subject requests

The Processor will pass on any request it receives from a data subject about the Controller's data and will not answer it except on the Controller's instructions.

8. Audits

On reasonable written notice, no more than once a year unless a breach or a regulator requires it, the Processor will answer the Controller's written questions and provide relevant documentation. On-site audits are at the Controller's cost and subject to confidentiality.

9. Deletion on termination

When the services end, the Processor deletes the Controller's personal data within 30 days, or returns it first if the Controller asks before then, unless the law requires it to be kept. Backup copies are overwritten in the normal backup cycle.

10. Liability and precedence

Liability under this DPA is subject to the limitation of liability in the terms of use. If this DPA conflicts with the terms on the processing of personal data, this DPA prevails. Governing law and venue follow the terms (the laws of the State of Israel; the competent courts of Tel Aviv-Jaffa, Israel).

Signatures

Effective date of this version: 2 October 2026.