Data Processing Agreement

UK GDPR Art. 28(3) controller-processor agreement for Avantwerk Legal AI. Authorised managed sub-processors and direct BYOK compatibility are described in Annex A; processing details are in Annex B; the PII taxonomy is in Annex C.

Sign this agreement electronically: the person signing for the firm enters their name and email and signs; Bennovate then countersigns. Both parties receive the signed document by email.

Parties

(1) The subscribing solicitor or SRA-authorised law firm practising in England and Wales identified in the Order Form or subscription confirmation (the "Controller", "Customer", "you").

(2) Bennovate spółka z ograniczoną odpowiedzialnością, a company incorporated in the Republic of Poland, KRS 0000597272, NIP 7272799328, REGON 363700466, with its registered office at ul. Christiana Andersena 25, 94-118 Łódź, Poland, operating the Avantwerk Legal AI service (the "Processor", "Bennovate", "we").

Background

A. The Controller is a solicitor or SRA-authorised law firm practising in England and Wales and using the Avantwerk Legal AI service under Starter Access or a paid subscription governed by the Terms of Service.

B. In the course of providing the Service, Bennovate processes certain personal data on behalf of the Controller. The parties set out their respective data-protection obligations in accordance with UK GDPR Art. 28.

C. The Controller remains the controller (UK GDPR Art. 4(7)). Bennovate processes that data only as processor (UK GDPR Art. 4(8)).

D. Scope. This DPA covers Personal Data processed by Bennovate on the Controller's documented instructions, including deliberately selected Matter Content used for a managed AI request, customer-directed support or migration involving selected data, and any transient relay where BYOK applies. It does not cover the canonical case record held in the Customer-Controlled Vault. Provider-side BYOK processing is governed by the Controller's direct contract with its chosen AI Provider, while Bennovate's relay remains within this DPA. Bennovate's own sales, account, contracting, billing, security, fraud-prevention and legal-compliance processing is carried out as controller and described in the Privacy Notice.

This DPA forms part of the Agreement. Capitalised terms not defined here have the meanings given in the Terms.

1. Definitions

2. Subject matter, nature, purpose and duration

2.1 Subject matter

This DPA covers processing carried out on the Controller's documented instructions, including selected Matter Content used for a managed AI request, customer-directed support or migration involving selected data, and any transient relay performed by Bennovate where the Controller uses BYOK. Bennovate's own sales, account, contracting, billing, security and legal-compliance purposes are outside this DPA and are described in the Privacy Notice. The canonical case record remains in the Customer-Controlled Vault.

2.2 Nature and purpose of processing

Account registration, user-account administration, contracting, e-signature, billing, account security, fraud prevention and Bennovate's own legal compliance are controller-side activities described in the Privacy Notice. They are not converted into Customer-instructed processing by appearing in the same service, and suppliers used only for those activities are not Customer sub-processors under this DPA.

2.3 Included and excluded Matter Content processing

The scope depends on the processing route:

1. Customer-Controlled Vault. The canonical case record is held in the encrypted vault: on the solicitor's computer in Solo, on a firm-controlled host reached over authenticated HTTPS on the firm's LAN or VPN in Practice, or on dedicated customer-controlled infrastructure in Enterprise. The browser is a replaceable interface and disposable cache.
2. Managed requests. Starter and Practice use the managed route unless the firm has configured its own supported provider credential. Selected prompts and Matter Content extracts are within this DPA, and the authorised managed providers are Bennovate sub-processors.
3. BYOK requests. Enterprise and any other eligible firm with a configured supported provider credential appoint their chosen AI Provider directly. Bennovate remains processor only for any transient relay it performs.
4. Release boundary. Practice and Enterprise availability is subject to a supported release and Order Form. Enterprise is currently single-node; active-passive operation and point-in-time recovery are not included.

2.4 Categories of data subjects

For Customer-directed support and managed AI requests: the Controller's personnel and authorised users; clients and prospective clients; counterparties; witnesses; victims; suspects, defendants and offenders; children and vulnerable persons; employees and former employees; experts; counsel; court, tribunal and regulator personnel; beneficiaries, family members and dependants; and any other person identified in material supplied on the Controller's instructions.

2.5 Categories of personal data

For Customer-directed support and managed AI requests: any personal data contained in the material, prompt or Matter Content extract supplied on the Controller's instructions, including names, contact and identity information, financial and employment information, family and relationship information, correspondence, allegations, evidence, legal advice and litigation material. Depending on the matter, this may include special-category data under Art. 9 UK GDPR and criminal-conviction, offence or allegation data under Art. 10 UK GDPR.

Bennovate processes Art. 9 or Art. 10 data only where included in a documented request submitted by an authorised user and only to provide the requested Service. Bennovate does not select the Controller's Art. 9 condition or Art. 10/DPA 2018 authority.

2.6 Duration

Processing continues for the duration of the subscription (including any Trial period) and for such further period as is required by applicable law or as set out in the retention table in the Privacy Notice. On termination, Clause 9 governs deletion and return.

3. Controller's instructions and compliance

3.1 Documented instructions. Bennovate shall process personal data only on documented instructions from the Controller. The Controller's instructions are set out in this DPA and in the Terms. Any additional instructions must be given in writing and signed by an authorised representative of the Controller. If domestic law requires Bennovate to process Personal Data otherwise than on the Controller's documented instructions, Bennovate shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.2 Notification of unlawful instructions. If Bennovate considers that any instruction infringes the UK GDPR or other applicable data-protection law, Bennovate shall immediately notify the Controller in writing. Bennovate shall not be obliged to follow any instruction that it reasonably considers to be unlawful.

3.3 Controller's obligations. The Controller warrants that it: (a) is the controller of the personal data and has all necessary rights, consents and lawful bases; (b) has complied with its own transparency obligations; (c) has assessed and is satisfied that the processing is compatible with its own GDPR compliance; (d) will promptly notify Bennovate of any changes in applicable law materially affecting this DPA.

4. Confidentiality: UK GDPR Art. 28(3)(b)

Bennovate shall ensure that persons authorised to process personal data under this DPA are bound by appropriate obligations of confidentiality (whether statutory, contractual or otherwise) and that they process personal data only as necessary for the performance of the Service.

5. Security: UK GDPR Art. 28(3)(c) and Art. 32

5.1 General obligation

Bennovate shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, having regard to: (a) the state of the art; (b) the cost of implementation; (c) the nature, scope, context and purposes of processing; (d) the risk of varying likelihood and severity to the rights and freedoms of natural persons.

5.2 Minimum security measures

1. TLS 1.2 or higher encryption for all data in transit between the Controller's browser and Bennovate's servers;
2. configured provider credentials are encrypted in the supported customer-controlled credential store; where a configured route uses Bennovate infrastructure, the credential is encrypted in transit, used only to relay the request to the selected provider and not intentionally retained after relay;
3. server-side access controls and role-based restrictions on account data;
4. infrastructure access logging and tamper-evident records for covered application events successfully written through the registered paths; this is not a promise that every access or AI invocation is captured, and firm-keyed exports are not independently verifiable without the firm-held key;
5. fail2ban or equivalent brute-force protection on authenticated endpoints;
6. regular vulnerability scanning and dependency auditing;
7. a documented incident-response procedure consistent with the timelines in Clause 7.

5.3 Security review

Bennovate does not currently offer a current pre-packaged Security Review Package for reliance. The existing C17 draft is expressly marked stale and “do not send or rely” and is not evidence of current security acceptance. For UK GDPR Art. 28(3)(h), Bennovate shall instead provide the current information reasonably necessary to demonstrate compliance and support the audit procedure in Clause 10. Bennovate is not ISO 27001 certified and does not hold a SOC 2 Type II report.

6. Sub-processors: UK GDPR Art. 28(3)(d) and Art. 28(2)

6.1 General authorisation. The Controller provides general written authorisation for Bennovate to engage the sub-processors listed in Annex A. Bennovate shall impose data-protection obligations on each sub-processor no less protective than those in this DPA, by written contract.

6.2 Changes to sub-processors. Bennovate shall give the Controller not less than 30 days' written notice before engaging a new sub-processor or materially changing the scope of an existing engagement. Notice shall be given by email to the billing contact address and by a prominent notice within the Service.

6.3 Controller's right to object. Within 14 days of receiving notice under Clause 6.2, the Controller may object in writing, stating the data-protection grounds. If the parties cannot resolve the objection within the notice period, the Controller may terminate the Agreement with immediate effect, with a pro-rated refund of prepaid fees for the unexpired subscription period. If the Controller does not object within 14 days, the Controller is deemed to have accepted the change.

6.4 Liability for sub-processors. Bennovate remains liable to the Controller for the performance of sub-processors' obligations under this DPA to the same extent as if Bennovate were performing those obligations directly.

6.5 AI Provider: managed-key and BYOK positions.

6.5.1 Managed route. Where a managed route is cleared and activated, Bennovate selects and contracts with the managed AI Provider, provisions and controls the service credential and pays the provider's usage charges. The evidenced provider entity then processes selected requests on Bennovate's behalf and on the Controller's documented instructions and is Bennovate's sub-processor. The code contains managed Anthropic and Amazon Bedrock adapter paths, but adapter availability does not prove an active provider entity, DPA, retention/training terms, actual region or transfer chain. Neither candidate is cleared by this DPA for production Customer Personal Data until that active-account evidence is recorded and made available to the Controller. OpenAI API is not an implemented managed route. Changes to the evidenced managed sub-processor set are governed by Clauses 6.2 and 6.3.

6.5.1.1 Distinct, request-applicable pre-egress controls. Before a registered AI request reaches the AI Provider, the controls applicable to that request run. Privilege and pseudonymisation answer different duties and neither substitutes for the other; the exact set is not universal:

1. The privilege gate: an egress control evaluated on the registered AI routes before the call is made, against the classification of the material and the destination:
   • To the AI Provider, in England & Wales: a warn-and-log control with the Controller's override. Material classified as privileged, and material not yet classified, raises a blocking prompt naming the destination and the effect; the call proceeds only if the Controller's fee-earner confirms it, and that confirmation is written to the matter's audit record. That product confirmation records who overrode the warning; it does not itself waive the client's legal professional privilege, prove that the fee-earner has the client's authority or instructions to waive it, or establish that disclosure satisfies the separate duty of confidentiality. Before overriding, the Controller must determine and document the proper basis for disclosure. Privilege belongs to the client and may be waived only with the client's authority. Separately, paragraph 6.3 of the SRA Code requires current and former client affairs to remain confidential unless disclosure is required or permitted by law or the client consents.
   This addresses legal professional privilege and its equivalents. Privilege attaches to the communication and to the substance of the advice; a document remains privileged with every name removed, so no form of identifier stripping answers this duty and none is offered as doing so.
2. Client-side pseudonymisation: on covered structured-text requests, identifiers recognised by Bennovate's published taxonomy are replaced with stable tokens in the Controller's browser before egress. Image-only/scanned content and the names or vocabulary intentionally supplied to AI-assisted dictation are documented exceptions. Verbatim dictation sends no content to an AI Provider. This addresses data minimisation under UK GDPR Art. 5(1)(c) within the stated coverage.

6.5.1.2 Pseudonymisation, not anonymisation. For values actually replaced under Clause 6.5.1.1(b), the substitution is reversible: the token-to-value mapping is generated in the Controller's browser, is used there to restore the real values in the returned draft, and is not transmitted with the tokenised request. The material is therefore pseudonymised within the meaning of UK GDPR Art. 4(5). It remains personal data, stays within UK GDPR and requires a lawful basis. It is not anonymised.

6.5.1.3 Stated limits. The pseudonymisation pass is a text function. It does not act on content inside an image, screenshot or scanned page, on special-category facts written as prose that carry no recognised identifier pattern, or on names/vocabulary intentionally supplied for AI-assisted dictation. Bennovate publishes the current class list and stated gaps at Annex C: PII taxonomy register. The Controller must not treat either control as a substitute for its own professional judgment on what may be sent.

6.5.2 Enterprise or configured firm key (BYOK). The Controller supplies and controls its own provider credential, contracts directly with its selected AI Provider and pays that provider's usage charges. The selected provider is the Controller's own processor and is not Bennovate's sub-processor for provider-side processing. Where the request is routed through Bennovate infrastructure, Bennovate remains the Controller's processor for the transient relay of the credential, request and response.

7. Data subject rights assistance: UK GDPR Art. 28(3)(e)

Bennovate shall, taking into account the nature of processing, assist the Controller by appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights under UK GDPR Chapter III (Arts. 15–22: access, rectification, erasure, restriction, portability, objection, automated decision-making).

Specifically:

1. Bennovate shall notify the Controller within 5 working days of receiving a data-subject rights request directed to Bennovate that relates to data processed under this DPA;
2. Bennovate shall provide the Controller with information it reasonably requires to respond, within 15 working days of the Controller's written request;
3. Bennovate shall not respond substantively to a data-subject rights request on the Controller's behalf without the Controller's prior written instruction, except where required to do so by law.

8. Assistance with Art. 32–36 obligations: UK GDPR Art. 28(3)(f)

Bennovate shall assist the Controller in ensuring compliance with:

1. Art. 32: security obligations, by maintaining the measures in Clause 5 and providing the Controller with relevant technical information on request;
2. Art. 33: Personal Data Breach notification: Bennovate shall notify the Controller without undue delay and in any event within 48 hours of becoming aware of a Personal Data Breach affecting data processed under this DPA. Notification shall include the information reasonably available for the Controller to assess notification to the Information Commission within the statutory period;
3. Art. 34: communication of a breach to affected data subjects, by providing the Controller with information needed to assess whether notification is required and to draft it;
4. Art. 35: DPIA: Bennovate shall, on request, provide relevant technical information to assist the Controller in completing a DPIA in respect of the processing described in this DPA;
5. Art. 36: prior consultation: where a DPIA indicates a high residual risk that requires prior consultation with the Information Commission, Bennovate shall cooperate with the Controller to the extent the consultation relates to Bennovate's processing.

9. Deletion and return of data: UK GDPR Art. 28(3)(g)

9.1 On termination. On expiry or termination of the Agreement for any reason, Bennovate shall, at the Controller's election:

1. delete all personal data processed under this DPA within 30 days of the termination date; or
2. return all personal data to the Controller in a structured, commonly used and machine-readable format within 30 days, after which Bennovate shall delete all copies.

9.2 Legal retention exceptions. Bennovate may retain personal data beyond the period in Clause 9.1 to the extent retention is required by applicable law (including accounting and tax obligations). In such cases Bennovate shall: (a) notify the Controller of the data retained and the legal basis; (b) cease all processing for any purpose other than compliance; (c) delete the data as soon as the legal obligation ceases.

9.3 Customer-Controlled Vault and selected processing. The Controller retains control of its Customer-Controlled Vault and is responsible for its independently verified backup. Bennovate deletes or returns only the Personal Data actually held in its own processing chain or by an authorised sub-processor, subject to Clauses 9.1 and 9.2.

9.4 Current operational boundary. Clause 9.1 is Bennovate's contractual duty for Personal Data actually held in Bennovate's processing chain; it is not a representation that the current product provides an automated matter-delete function for the Controller's vault. The installed vault currently refuses product-side removeMatter. The Controller therefore retains and disposes of its vault through its own approved process. Product-enforced legal holds, deletion receipts and backup non-resurrection are not yet available and must not be claimed as implemented.

10. Audit rights: UK GDPR Art. 28(3)(h)

10.1 Bennovate's obligation. Bennovate shall make available to the Controller all information necessary to demonstrate compliance with UK GDPR Art. 28 and shall allow for and contribute to audits and inspections conducted by the Controller or a third-party auditor mandated by the Controller.

10.2 Practical audit procedure.

1. The Controller shall give Bennovate at least 30 days' written notice of an audit request, specifying scope and proposed dates.
2. Audits shall be conducted during normal business hours and shall not unreasonably disrupt Bennovate's operations.
3. The Controller may inspect: documentation of Bennovate's security policies and procedures; sub-processor list; DPA and security review documents; and relevant logs: subject to Bennovate redacting third-party confidential information.
4. The Controller shall not audit more than once per 12-month period unless: (i) a Personal Data Breach has occurred; (ii) the Information Commission requires it; or (iii) the Controller has reasonable grounds to suspect a material breach of this DPA.
5. The Controller shall bear its own costs of any audit. Bennovate may charge a reasonable fee for management time beyond one day.
6. Where a recent third-party audit report is available (e.g. ISO 27001 certification), Bennovate may satisfy the audit obligation by making that report available, subject to confidentiality.

11. International transfers

11.1 Transfer mechanism. Where Bennovate (or a sub-processor) transfers personal data outside the UK that is not covered by UK adequacy regulations, Bennovate shall ensure the transfer is subject to one of:

1. the International Data Transfer Agreement (IDTA) under s.119A DPA 2018; or
2. the UK Addendum to EU Standard Contractual Clauses; or
3. another mechanism approved by the Information Commission.

11.2 Transfer impact assessment. Where a restricted transfer takes place, Bennovate shall have conducted or make available the results of a transfer impact assessment (TIA). Where the TIA identifies a risk that cannot be mitigated, Bennovate shall notify the Controller and not proceed without written consent.

11.3 Current transfer positions:

12. Term

This DPA is co-terminous with the Agreement. It comes into force on the Effective Date and terminates automatically when the Agreement terminates, subject to the survival provisions at Clause 9.

13. Governing law and jurisdiction

This DPA is governed by the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales.

14. Order of precedence

In the event of any conflict between this DPA and the Terms of Service on data-protection matters, this DPA prevails. In the event of any conflict between this DPA and any applicable standard contractual clauses (IDTA or UK Addendum) incorporated by reference, the standard contractual clauses prevail.

Annex A: Managed Sub-Processors and BYOK Compatibility

Managed-provider evidence boundary. Before a managed provider receives Customer Personal Data, Bennovate must record the legal entity attached to the active account or order, the applicable retention and training/use terms, the configured processing region or chain, and any UK transfer safeguard and data protection test. Public provider material does not by itself prove which terms apply to Bennovate's account. Bennovate shall make the current account-specific position available to the Controller on request, subject to proportionate confidentiality protections.

Account-security role boundary. Bennovate determines the purpose and essential means of Legal AI password setup/reset, one-time verification and account-security messages and acts as controller for that processing. Plus Five Five, Inc. (Resend) acts as Bennovate's processor for that separate flow and is not a sub-processor of the Controller for matter data. No matter content or privileged material enters the flow.

Configured-key compatibility. Five plain-completion adapters exist: Anthropic API, OpenAI API, Gemini API paid services, Azure OpenAI Service and Amazon Bedrock EU. Tool-use parity and entitlement vary. In every own-credential use, the firm appoints the provider directly; the provider is not Bennovate's sub-processor for provider-side processing, although Bennovate remains processor for any relay it operates.

Provider identifiers. SP-02 and SP-17 are stable registry-candidate identifiers, not evidence of a current managed engagement. They acquire sub-processor status only if the corresponding managed route is activated under evidenced Bennovate account and contractual terms.

Controller-side services. GHL and Mailgun are limited to acquisition and sales; Stripe is the billing source; Resend handles account-authentication and security mail; Google Workspace and Microsoft 365 support Bennovate's own operations. Those services are disclosed in the Privacy Notice and are not authorised here as Customer subprocessors merely because Bennovate uses them for its own controller purposes. Self-hosted Documenso is software running on the Hetzner-hosted service, not a separate legal-person sub-processor.

Sub-processor additions and changes are subject to the 30-day notice procedure in Clause 6.2.

Annex B: Processing Details Summary (UK GDPR Art. 30 record)

Annex C: PII taxonomy register

This Annex is the register referred to at clause 6.5.1.3. It is generated from the product's taxonomy source and re-rendered whenever a class changes, so the published list and the code cannot diverge.

59 classes across the 5 markets listed in this register, 19 of which load in an England-and-Wales matter, and 9 stated gaps.

Classes loaded in an England-and-Wales matter

The other markets listed in this register

Stated gaps: what the pass does not reach

* Label-anchored. The class fires on the label written next to the value; the same value written bare in a sentence is not reached. Stated here rather than left to be discovered.

The substitution is reversible and is therefore pseudonymisation under UK GDPR Art. 4(5), not anonymisation. The mapping is generated in the Controller's browser, used there, and never transmitted. Several classes are label-anchored: they fire on the label written next to the value, and a value written bare is not reached: the date-of-birth and case-reference gaps below state where.