Data Processing Agreement

Roles and scope

In this DPA, “controller,” “processor,” “personal data,” “processing,” and “data subject” have the meanings given under applicable data protection law. With respect to Customer Data, you (the Subscriber) act as the controller and Closeout acts as the processor, processing personal data on your documented instructions to provide the Service.

This DPA forms part of, and is subject to, the General Terms of Use (the “Agreement”). Where Closeout processes protected health information, that processing is also governed by the separate HIPAA Business Associate Agreement, which controls for PHI to the extent of any conflict.

Details of the processing

Subject matter and duration: Closeout processes personal data for the term of the Agreement and until Customer Data is deleted or returned as described below.

Nature and purpose: hosting, reading, classifying, and extracting data from case documents; surfacing potential liens and related information; and enabling settlement closeout, disbursement records, and the audit trail, all to provide and support the Service.

Categories of data

Data subjects: the Subscriber’s clients, opposing parties, providers, lienholders, and the Subscriber’s own personnel, as reflected in Customer Data.

Types of personal data: identifiers and contact details, matter and settlement information, financial and payment-related information, and, where the Subscriber submits it, medical and health information. Health information is handled under the HIPAA Business Associate Agreement.

Processing on your instructions

Closeout processes personal data only on your documented instructions, including as set out in the Agreement and as needed to provide the Service, unless required to do otherwise by law. If Closeout believes an instruction violates applicable data protection law, it will inform you.

Confidentiality

Closeout ensures that personnel authorized to process personal data are bound by appropriate confidentiality obligations and access personal data only on a least-privilege basis.

Security measures

Closeout implements appropriate technical and organizational measures to protect personal data, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256), per-firm isolation enforced at both the application and database layers, least-privilege access, and a tamper-evident audit trail.

Customer Data is not used to train shared, public, or third-party AI models. A fuller description of these measures is set out on our Security page and is available on request.

Sub-processors

You provide a general authorization for Closeout to engage sub-processors to help provide the Service. Each sub-processor is bound by a written agreement imposing data-protection obligations substantially equivalent to those in this DPA and, where it handles protected health information, a Business Associate Agreement.

Closeout’s current sub-processors are listed below. Closeout will give notice of any intended addition or replacement of a sub-processor and a reasonable opportunity to object on reasonable data-protection grounds.

Data subject requests

Taking into account the nature of the processing, Closeout will assist you, by appropriate technical and organizational measures and insofar as possible, to respond to requests from data subjects exercising their rights. If Closeout receives such a request directly, it will not respond other than to direct the person to you, unless legally required to do so.

Personal data breach

Closeout will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide the information reasonably available to it to help you meet your own notification obligations.

Assistance

Taking into account the nature of the processing and the information available to Closeout, Closeout will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities where applicable law requires them.

Return or deletion of data

On termination or expiry of the Services, Closeout will, at your choice, delete or make available for export the Customer Data, subject to the limited export window described in the Privacy Policy, and will delete existing copies except to the extent retention is required by law. Backup copies are deleted in the ordinary course.

Audits and information

Closeout will make available the information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including through third-party reports, security documentation, and responses to reasonable questionnaires.

Where an on-site audit is justified, it will be conducted on reasonable notice, during business hours, and subject to confidentiality and security controls so that other customers’ data is not compromised.

International transfers

Closeout hosts and processes Customer Data in the United States. Where personal data is transferred across borders in connection with the Service, the parties will rely on an appropriate transfer mechanism, such as Standard Contractual Clauses or a recognized adequacy mechanism, to the extent required by applicable law.

Liability and relationship to the Agreement

This DPA is incorporated into the Agreement. Except as expressly modified here, the Agreement remains in full effect, and each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement. If there is a conflict between this DPA and the Agreement regarding the processing of personal data, this DPA controls; for protected health information, the HIPAA Business Associate Agreement controls.

Governing law

This DPA is governed by the law that governs the Agreement, the State of Texas, without regard to its conflict-of-laws rules, except where applicable data protection law requires otherwise.