Data Processing Addendum

1. Scope and parties

This Data Processing Addendum (the Addendum) forms part of the agreement between the organisation that holds a LexCore account (the Customer) and Lex-Core Digital Services Limited (LexCore) for the LexCore service. It applies whenever LexCore processes personal data, privileged material or confidential business information on the Customer's behalf.

1.1 The Customer is the data controller of the data it uploads, and LexCore is the data processor, within the meaning of the Nigeria Data Protection Act (NDPA) 2023 and, where it applies, the EU General Data Protection Regulation (GDPR).

1.2 LexCore processes data only on the Customer's documented instructions. Using the service as designed — uploading a document, requesting a review, a draft, a redline or a search — is an instruction.

1.3 Where the Customer and LexCore have signed a separate data processing agreement, that agreement prevails over this Addendum to the extent of any conflict.

2. What is processed, and for how long

2.1 Categories. Account data (names, business email addresses, roles); the contracts, playbooks, templates and matter records the Customer uploads or creates; and the personal data those documents contain, which may include names, addresses, identification numbers and employment terms of the Customer's clients, employees and counterparties.

2.2 Purpose. To provide the LexCore service: analysis, drafting, redlining, verification, search, notification and audit, as configured by the Customer.

2.3 Duration. For the term of the agreement and until deleted under section 8. The Customer controls retention per matter and per document inside the service.

3. No training on Customer data

3.1 LexCore does not use Customer data to train, fine-tune, evaluate or otherwise improve any machine-learning model, whether LexCore's own or a provider's, and does not permit any sub-processor to do so on LexCore's behalf.

3.2 Where the service sends document text to a third-party AI provider (section 4), LexCore does so only under that provider's enterprise or API terms that exclude training on submitted content. The providers reachable in each deployment shape are listed in the Sub-processor Register.

3.3 Aggregate, non-identifying service metrics (token counts, latency, error rates) are not Customer data for the purpose of this section and are used to operate and bill the service.

4. Sub-processing and AI providers

4.1 The Customer authorises LexCore to engage the sub-processors published in the Sub-processor Register. LexCore imposes data-protection obligations on each of them that are no less protective than this Addendum, and remains responsible to the Customer for their performance.

4.2 LexCore updates the register when a sub-processor is added or removed and notifies the Customer where the agreement requires it. The Customer may object to a new sub-processor on reasonable data-protection grounds within thirty days of the notice; if the objection cannot be resolved, the Customer may terminate the affected service.

4.3 Bring-your-own-key carve-out. Where the Customer configures the service to use an AI provider account or API key that the Customer holds directly, that provider processes the Customer's data under the Customer's own agreement with it, not under section 3. In particular, a free-tier or consumer key is not covered by the no-training commitment in section 3, because the provider's consumer terms may permit training on submitted content. The service states this next to the key input at the time the key is entered. The Customer, not LexCore, is responsible for the terms attached to a key it brings.

4.4 In the sovereign, dedicated and air-gapped deployment shapes, no third-party AI provider is reachable, and section 4.3 cannot arise.

5. Where data is processed

5.1 On the managed deployment, Customer data rests on infrastructure in France (European Union), and the text of a document under review is transmitted to the AI provider the Customer selected for the duration of that review. Both transfers are disclosed in the Sub-processor Register.

5.2 Where Nigerian personal data is transferred outside Nigeria, LexCore relies on the recipient being subject to a law, binding corporate rules, contractual clauses or a code of conduct affording adequate protection, as section 41 of the Nigeria Data Protection Act (NDPA) 2023 permits, and on the Customer's instruction under section 1.2.

5.3 On a dedicated or sovereign deployment the Customer chooses the location, and LexCore processes nothing outside it.

6. Security

6.1 LexCore maintains technical and organisational measures appropriate to the risk, including: tenant isolation at the database, storage and search-index layer; role-based access scoped per matter; encryption in transit; an immutable audit record of every action and override; and configurable retention with hard purge. The current measures are described on the security page, which is updated as they change.

6.2 Persons authorised by LexCore to process Customer data are bound by confidentiality and receive access only where needed to operate or support the service, and every such access is recorded.

7. Personal-data breaches and data-subject requests

7.1 LexCore notifies the Customer without undue delay, and in any event within seventy-two hours of becoming aware of a personal-data breach affecting Customer data, with the information the Customer needs to meet its own notification duties under section 40 of the Nigeria Data Protection Act (NDPA) 2023 and, where applicable, GDPR article 33.

7.2 Where a data subject exercises a right against the Customer in respect of data LexCore processes, LexCore assists the Customer through the service's own export, correction and deletion controls and, where those are insufficient, on request to dpo@lexcore.ng. LexCore does not respond to a data subject directly except on the Customer's instruction or where the law requires it.

8. Return and deletion

8.1 The Customer may export its data from the service at any time during the term.

8.2 On termination, LexCore deletes Customer data from the live service within thirty days, and from backups within the backup rotation period, unless the law requires LexCore to retain it. Deletion is performed with the same hard-purge control the Customer can invoke per matter during the term.

9. Audit and records

9.1 LexCore makes available the information reasonably necessary to demonstrate compliance with this Addendum, including the Sub-processor Register, the security description and, on request, the audit record of access to the Customer's tenant.

9.2 Not more than once in any twelve months, or following a personal-data breach, the Customer or an independent auditor bound by confidentiality may audit LexCore's compliance on reasonable notice, during business hours, and without disrupting the service to other customers.

10. Contact

Questions about this Addendum, and requests under it: dpo@lexcore.ng.