Data Processing Addendum

Introduction

This Data Processing Addendum (“DPA”) forms part of the agreement between Blueshoe Inc. (“Blueshoe,” “we,” or “us”) and the customer (“Customer,” “you”) governing your use of the Blueshoe technology platform and related services (the “Platform”) under our Terms of Use. It describes how Blueshoe processes personal data contained in the data you submit to the Platform, and supplements our Privacy Policy.

In the event of a conflict between this DPA and the main agreement with respect to the processing of personal data, this DPA governs.

Definitions

• User Data means the documents, information, and other content you upload to the Platform.
• Personal Data means any information relating to an identified or identifiable natural person that is contained within User Data.
• Processing means any operation performed on personal data, whether by automated means or otherwise.
• Sub-processor means a third party engaged by Blueshoe to process personal data in connection with the Platform.

Roles of the Parties

For User Data you submit to the Platform, you act as the controller and Blueshoe acts as the processor. Blueshoe processes User Data only on your documented instructions, including as set out in the Terms of Use and this DPA, unless required to do otherwise by applicable law.

Scope and Purpose of Processing

Blueshoe processes User Data solely to:

• Provide, maintain, secure, and improve the Platform;
• Make the Platform’s features available to you, including document management, case tracking, drafting assistance, research, communication, file storage, and workflow automation;
• Provide support and respond to your requests; and
• Comply with applicable law.

We do not sell User Data, and we do not use it to train models that are made available to other customers without your authorization. We may use anonymized and aggregated data that does not identify any individual to operate, improve, and secure the Platform.

Confidentiality

Blueshoe ensures that personnel authorized to process User Data are bound by appropriate confidentiality obligations and receive training relevant to their responsibilities. User Data is accessed only as needed to provide the Platform or to meet legal requirements.

Security Measures

Blueshoe maintains technical and organizational measures designed to protect User Data against unauthorized access, loss, or disclosure, consistent with our SOC 2 program. These include encryption in transit and at rest, role-based access controls, secure cloud infrastructure, logging and monitoring, and a documented incident response process.

Sub-processors

You authorize Blueshoe to engage sub-processors to support delivery of the Platform. Blueshoe imposes data protection obligations on each sub-processor that are no less protective than those in this DPA and remains responsible for their performance. A current list of sub-processors is available on request.

Data Subject Requests

Blueshoe will, to the extent legally permitted, promptly notify you if it receives a request from a data subject to exercise their rights. Taking into account the nature of the processing, Blueshoe will provide reasonable assistance to enable you to respond to such requests.

Data Breach Notification

Blueshoe will notify you without undue delay after becoming aware of a personal data breach affecting User Data and will provide information reasonably necessary for you to meet your own notification obligations.

International Transfers

Where Blueshoe transfers personal data across borders, it does so in accordance with applicable data protection law and using a lawful transfer mechanism.

Retention and Deletion

Blueshoe retains User Data for as long as necessary to provide the Platform and to comply with our legal obligations, resolve disputes, and enforce our agreements. When your subscription is cancelled, document context is retained for 90 days to facilitate reactivation. After that period, and subject to those obligations, Blueshoe will delete or return User Data on your request.

Contact

For questions about this DPA or our data processing practices, contact us at support@blueshoe.com.