The terms under which Lexora processes personal data on behalf of a firm.The terms under which Lexora processes personal data on behalf of a firm, including the technical and organisational measures.
1. Roles
The firm is the controller. Lexora is the processor and acts only on the firm’s documented instructions.The firm is the controller. Lexora is the processor and acts only on the firm’s documented instructions, which include the configuration the firm sets in the product.
2. Scope of processing
Matter documents, questions, plans, answers, findings and log entries; names, work emails and roles of workspace members.Matter documents, questions, plans, answers, findings and log entries; names, work emails and roles of workspace members. Processing is limited to providing the service described in the terms.
3. Security measures
Encryption at rest and in transit; region pinning on Firm and Enterprise; SSO enforced per workspace; ethical walls; append only audit log; retention controls with verified deletion; annual third party penetration testing.Encryption at rest and in transit; region pinning on Firm and Enterprise; SSO enforced per workspace; ethical walls and matter screening; append only audit log; retention controls with verified deletion; annual third party penetration testing.
4. Subprocessors
Listed on the subprocessors page. Lexora gives 30 days notice of changes, during which the firm may object.Listed on the subprocessors page. Lexora remains responsible for their performance and gives 30 days notice of changes, during which the firm may object.
5. Assistance and audit
Lexora assists with data subject requests and impact assessments, and makes audit reports available under NDA.Lexora assists with data subject requests and impact assessments, and makes audit reports and the security questionnaire available under NDA once a year or after a material change.
6. International transfers
Data stays in the region the firm selects. Support transfers are covered by standard contractual clauses.Data stays in the region the firm selects. Where a transfer is required for support, it is covered by standard contractual clauses.
7. Deletion and return
Within 30 days of termination, all personal data is returned in an export and then deleted.Within 30 days of termination, all personal data is returned in an export and then deleted, with a certificate of deletion on request.